←  All terms
D
Security & Compliance

GDPR

The General Data Protection Regulation governs personal-data processing in the EU and strengthens individuals' data rights.

The General Data Protection Regulation governs personal-data processing in the EU and strengthens individuals' data rights. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to Data Processing Agreement and Consent Management Platform.

Read more

Data Processing Agreement

Consent Management Platform

Server-Side Tracking

Hosting

FAQ

GDPR

Which technical aspects of a website are relevant to data protection?
Relevant aspects are hosting location and provider, embedded third-party services such as fonts, maps, and videos, the tracking setup, server logs, forms, and retention periods. Every integration that transmits data to third parties should be documented. The legal assessment remains a task for those responsible for data protection, while the technology supplies the facts.
Does a consent banner make a website GDPR-compliant?
No, a banner is only one building block. Data minimization, a deletion concept, a record of processing activities, and review of third-country transfers stand alongside it. Technically, visitors' choices must actually take effect: scripts may load only after consent. No statement of compliance can be derived from a banner.
When does GDPR require a data processing agreement?
A data processing agreement under Art. 28 GDPR is needed when a service provider processes personal data on behalf of another party. For websites this typically concerns hosting, analytics tools, and newsletter services. Whether processing on behalf exists in a given case is a legal assessment that varies with the roles involved.
When is consent required on a website?
Not for every processing activity, since the GDPR recognizes several legal bases. For non-essential cookies and tracking, consent is usually required in practice. Whether it is needed in a specific case depends on the purpose, the technology, and national implementation of ePrivacy rules, and belongs in a legal review.
What does the GDPR specifically regulate for websites?
The GDPR, Regulation (EU) 2016/679 and applicable since May 25, 2018, covers any processing of personal data on a website, such as IP addresses, form entries, or tracking. It requires a legal basis, transparency, and respect for data subject rights. Assessment of a specific case is a matter for legal counsel.