# GDPR website checklist for companies | Illia BizTech > Forms, analytics, embedded services and hosting. What needs consent, what needs a contract and how to run a first check yourself. Source: https://illia-biztech.de/en/blog/dsgvo-website-checkliste 1. [Home](/en) 2. [Resources](/en/blog) 3. Checking your company website against the GDPR ![Person reviewing a checklist on a laptop by a window](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_dsgvo_website_checkliste_634ef23ea7.png) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) By: Illia Belichenko July 23, 2026 # Checking your company website against the GDPR The GDPR touches an ordinary company website at three points where data gets collected, the contact form, analytics and embedded services such as maps or videos, and all three can be checked yourself in about half an hour. The privacy policy, a dedicated page describing how data is handled, is required on almost every website and has to match what the site actually does rather than a template downloaded a year ago. More often than the use of analytics or forms themselves, it is the gap between that text and the scripts actually loading that turns into a problem. The contact form usually processes data under [Article 6(1) of the GDPR](https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex:32016R0679), typically as necessary to answer the enquiry, and that legal basis needs no separate consent checkbox as long as the form only asks for what answering the enquiry actually requires. An analytics tool such as Google Analytics needs the visitor's consent before the script counts anything at all, and that consent is separate from whatever the contact form relies on. Germany's data protection authorities set this out in a [joint guidance for website operators from December 2021](https://www.datenschutzkonferenz-online.de/media/oh/20211220%5Foh%5Ftelemedien.pdf), and analytics running before consent remains one of the most common violations on ordinary sites since. Maps, video players and fonts loaded directly from a third party server transmit the visitor's IP address the same way external fonts do, and need either consent or a move to local hosting before the element loads at all. If hosting, analytics or newsletter tools sit outside the European Union, transferring data to them needs extra safeguards, usually EU standard contractual clauses, and without them using such a service for website data becomes legally questionable. Every provider that technically processes the site's data, hosting, newsletter sending, a CRM, needs a data processing agreement, covered in its own article on the topic, and without that agreement the company is formally liable for the provider's actions as if they were its own. The half hour self check runs like this. Submit the contact form and check where the message goes and what happens to the data afterward. Open the page with a script blocker on and see which domains try to load before anyone clicks consent. Compare that list with what the privacy policy actually says. This text explains what to look for in a self check and does not replace legal advice. A full assessment of a website needs a look at the actual scripts, forms and provider contracts, and a specialist should make that call in unclear cases. **Share** [ ![Hand hovering over a laptop trackpad with a website and its banner open on screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_cookie_banner_tdddg_99dac077fa.png) Previous Post A consent banner that actually works](/en/blog/cookie-banner-tdddg) [ ![Two people comparing documents at an office desk](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_agentur_freelancer_oder_anstellung_ee09c743f8.png) Next Post Agency, freelancer or your own hire](/en/blog/agentur-freelancer-oder-anstellung) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) ##### Illia Belichenko Illia is responsible for the technical side of Illia BizTech: website development, website updates, forms, integrations, automation and technical support. He works on connecting websites, content, advertising and internal workflows so they work together without creating unnecessary manual work. ##### Recent Posts [![An editor working in video editing software with AI features on screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_ki_tools_videoschnitt_vor_und_nachteile_f3a71162be.png)](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) #### [What AI Editing Tools Actually Do, and What They Don't](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) October 16, 2026 [](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) [![A video editor reviewing a flawed shot on a monitor before deciding on a reshoot](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_content_nachdrehen_oder_um_fehler_schneiden_f8735cb368.png)](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) #### [When a Reshoot Pays Off and When Editing Can Save the Footage](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) October 15, 2026 [](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) [![A video editor selecting a cover frame for a video on a laptop screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_thumbnail_vorschaubild_video_wirkung_a1fe6c0cd9.png)](/en/blog/thumbnail-vorschaubild-video-wirkung) #### [Why the Video Thumbnail Decides Whether Anyone Clicks](/en/blog/thumbnail-vorschaubild-video-wirkung) October 14, 2026 [](/en/blog/thumbnail-vorschaubild-video-wirkung) A GDPR checklist for a website is easiest to work through during development rather than hunting for problems on a site that is already live. Illia BizTech goes through the contact form, the cookie banner, externally loaded fonts and the site's own providers before launch, which is exactly why the checklist in this article does not turn into a separate expensive project once the site is already running. Illia BizTech builds and maintains websites for companies in Germany in German, English, Russian and Ukrainian, from the first version through ongoing maintenance and search visibility work. One monthly plan covers the website, advertising and content, the scope is agreed in advance and can be moved between them when priorities change. The domain, hosting and ad accounts stay registered to the company, so the work can continue on the existing setup without a full rebuild. That fits businesses moving to Germany or expanding into the German-speaking market who want to explain their task once.