Website compliance

Three questions about your website so we only ask what's relevant. These aren't scored. Have your website open in another tab.

1. Does your website use anything beyond the bare essentials, such as Google Analytics, advertising or social media pixels, embedded YouTube videos or maps, or chat widgets?
2. Does your website have forms that collect personal details, such as contact, booking, membership, newsletter or job application forms?
3. Does your website or app let consumers buy, book or pay for services online (for example an online shop, bookings or ticketing), and are you larger than a micro-enterprise (10 or more people, or annual turnover and balance sheet both above €2 million)?

Your website is where most people will look for how you use their data.

1. Is there a privacy notice on your website, linked from every page (usually in the footer)? Knock-out Owner or data protection lead
2. Does the notice explain in plain language who you are, what you collect, why, your legal basis, who you share it with, how long you keep it, and people's rights including complaining to the DPC? Data protection lead
3. Does the notice name the outside services your website uses to handle visitors' data (for example your web host, email marketing tool, analytics or booking system)? Web developer

From the help text

GDPR requires you to tell people how you use their personal data, and your website is the natural home for that information. 'Yes' means a current privacy notice one click from any page.

Collect only what you need, keep it safe, and don't hold on to it longer than necessary.

Asked only if you answer “Yes” to: Does your website have forms that collect personal details, such as contact, booking, membership, newsletter or job application forms?

1. Do your website forms only ask for what you actually need, with optional fields clearly marked? Web developer
2. Where do form submissions end up? Web developer
3. If a form offers newsletters or marketing, is there a separate, unticked opt-in box rather than signing people up automatically? Marketing lead
4. Are old form submissions deleted after a set period (from the website, inboxes and any linked tools)? Web developer

From the help text

Data minimisation is a core GDPR principle. 'Yes' means every required field has a clear reason, like needing a phone number to confirm a booking.

An accessible website works for more people, including those using screen readers, keyboards or zoom. These checks are good practice for every site.

1. Do meaningful images have text descriptions (alt text) so people using screen readers know what they show? Web developer
2. Can someone use your site with just a keyboard (Tab, Enter, arrow keys), including menus, forms and the cookie banner, and can they see where they are on the page? Web developer
3. Is text easy to read, with enough contrast against the background and still usable when zoomed to 200%? Web developer
4. When was your website last checked for accessibility? Web developer

From the help text

Screen readers read out alt text in place of images. 'Yes' means informative images have a short description, and purely decorative ones are marked as such.

Since 28 June 2025 the European Accessibility Act has applied to many consumer services, including e-commerce. Micro-enterprises providing services are exempt.

Asked only if you answer “Yes” to: Does your website or app let consumers buy, book or pay for services online (for example an online shop, bookings or ticketing), and are you larger than a micro-enterprise (10 or more people, or annual turnover and balance sheet both above €2 million)?

1. Has your website or app been checked against WCAG 2.1 level AA, the widely used accessibility benchmark, with the issues found being fixed? Web developer
2. Can someone using a screen reader or only a keyboard complete your core journey from start to finish, whether that's buying, booking or paying? Web developer
3. Do you publish information explaining how your service meets accessibility requirements (often called an accessibility statement), with a way for people to report problems? Owner or Web developer

From the help text

The Act sets accessibility requirements for in-scope services and WCAG 2.1 AA is the benchmark most organisations test against. 'Yes' means a recent audit and a plan to fix what it found.

A neglected website is an easy target. These basics protect your visitors and your reputation.

1. Does every page load securely over HTTPS (padlock in the browser), with plain http addresses redirecting automatically? Web developer or Hosting provider
2. Are your website platform, theme and plugins kept up to date, with unused plugins removed? Web developer
3. Is two-step login (MFA) switched on for website admin, hosting and domain registrar accounts, with each person using their own login? Web developer
4. Is the website backed up regularly, with a copy stored away from the web server, and do you know how to restore it? Web developer or Hosting provider

From the help text

HTTPS protects anything visitors type into your site and browsers warn people away from sites without it. 'Yes' means a valid certificate and automatic redirects.