GDPR is less scary than it sounds: be honest about what data you collect, collect only what you need, keep it safe, and let people see or delete it. This is a practical checklist — not legal advice — of what that means for a website or app.
The basics every site needs
- A clear privacy policy: what you collect, why, and how long you keep it.
- A cookie banner that asks before setting non-essential cookies.
- Consent that is opt-in, not pre-ticked, and easy to withdraw.
- Forms that collect only what you actually need.
Handling and storing data
Store personal data securely — encrypted at rest, access limited by role. Hosting in the EU keeps data residency simple. If you use third-party processors (analytics, email, payments), you need agreements with them and should name them in your policy.
Collect less, worry less: the data you never collect cannot leak, cannot be requested, and cannot get you fined. Minimisation is the cheapest compliance there is.
People's rights
Users can ask to see their data, correct it, or have it deleted, and you must be able to respond. In practice this means knowing where personal data lives in your systems — which is far easier when the app was designed with that in mind from day one.