5.3GDPR & compliance
The essentials in 30 seconds
- As soon as a site collects data (form, statistics, shop), the GDPR applies: it is not optional.
- Consent must be prior and freely given: no non-essential tracker before acceptance, and refusing must be as easy as accepting.
- Legal notice and privacy policy accessible, plus respect for rights (access, deletion): the basis of compliance.
Running mini-case — bringing the workshop into compliance
The workshop's contact form collects names and emails, and the site uses statistics. Samir installs a consent plugin, configures tracker blocking before acceptance, and drafts legal notice and a privacy policy with Hassan, tailored to the site. He checks that refusing is as easy as accepting and that deletion requests can be handled.
Sequel to case 5.2 — migrating also means bringing obligations up to date.
1. Consent and transparency
The GDPR governs the processing of personal data. A site that collects information — contact form, comments, statistics, shop — must meet concrete obligations. The first concerns cookies and trackers: trackers that are not strictly necessary must not load before consent.
A compliant cookie banner allows acceptance, refusal and choice by category, with refusal as easy as acceptance. A plugin such as Complianz or CookieYes blocks trackers until a choice is made and keeps proof of consent. A simple informational message is not enough.
2. Legal information and rights
The site must publish legal notice (publisher, host, contact) and a clear privacy policy: what data, why, for how long, with whom. Samir makes them accessible from the footer and adapts them to the actual site, without generic copy-paste.
People have rights: access, rectification, erasure, objection. It must be possible to respond to requests and delete data when it is no longer needed. Compliance is a living process: to be reviewed when the site adds a form, a shop or a new tracking tool.
🔎 Concrete example — Bringing the workshop into compliance (Samir's case)
Trackers: statistics + embedded map → "measurement" category.
Banner: Accept / Refuse / Preferences.
Refusal as accessible as acceptance.
Legal notice: publisher, host, contact.
Privacy: form, orders, retention period, rights.
→ Deletion request handled within 30 days.Result: an informed site that respects the choice.
Lesson: consent is proven, not assumed.
Section vocabulary
- GDPR
- European regulation on the protection of personal data, applicable as soon as data is collected.
Simple example: a contact form is covered.
What it is not: believing GDPR only targets large companies.
Reflex: data collection = obligations.
- Prior consent
- Agreement given before non-essential trackers are set.
Simple example: statistics only load after acceptance.
What it is not: loading cookies on arrival.
Reflex: no tracker before yes.
- Tracker / cookie
- A small file or technology that tracks activity; some are functional, others are not.
Simple example: a statistics tool.
What it is not: treating all cookies as exempt.
Reflex: non-essential = consent.
- Privacy policy
- A page explaining what data is collected, why, for how long and what rights apply.
Simple example: the site's privacy page.
What it is not: copying a template unrelated to the site.
Reflex: inform clearly and precisely.
- Data subject rights
- Access, rectification, erasure, objection: requests that must be handled.
Simple example: deleting a customer's account on request.
What it is not: ignoring a deletion request.
Reflex: provide a simple procedure.
In practice — Setting up the foundations of compliance
- List the data collected and the trackers active on the site.
- Install a consent plugin and configure blocking before acceptance.
- Draft or adapt the legal notice and the privacy policy.
- Test the journey: refusal, acceptance, preferences and the deletion procedure.
Ready-to-use script — talking compliance without jargon (25s)
"Your site collects data: it must ask for permission before tracking cookies, explain what it does with the information and allow it to be deleted. I set up the banner, the legal pages and the procedure. It is also a mark of trust for your customers."
Present compliance as protection and a sign of seriousness.
Copy-paste template — compliance sheet
DATA COLLECTED: _______________
NON-ESSENTIAL TRACKERS: _______________
CONSENT PLUGIN: _______________
REFUSAL AS EASY AS ACCEPTANCE: yes / no
LEGAL NOTICE: up to date / to do
PRIVACY POLICY: up to date / to do
DELETION PROCEDURE: _______________Showcase site
Form + statistics: banner, privacy, legal notice.
Shop
Add order, payment and delivery data.
Blog
Comments and newsletters: consent and unsubscribe.
Non-profit
Memberships and donations: limit collection to what is necessary.
✓ Best practices
- Block trackers before consent.
- Make refusal as easy as acceptance.
- Adapt the legal pages to the actual site.
✗ Common pitfalls
- A purely informational banner.
- Tracking cookies loaded before the choice.
- A privacy policy copied without adaptation.
Key takeaways
- The GDPR applies as soon as data is collected.
- Consent is prior, free and reversible.
- Legal notice and privacy must be accessible.
- Data subject rights require a procedure.
48h Challenge — apply tomorrow
Inventory a site's trackers, install a compliant banner and test refusal. Write a privacy policy tailored to the site. 35 minutes.
- I identify a site's data and trackers.
- I configure prior consent.
- I provide for legal information and data subject rights.
Frequently asked questions
Is a simple banner saying 'this site uses cookies' enough?
No: consent must be prior and free. Users must be able to refuse as easily as to accept, and non-essential trackers only load after acceptance. An informational banner that sets cookies on arrival is not compliant.
Which tools trigger the consent obligation?
All trackers that are not strictly necessary: statistics, advertising pixels, embedded maps and videos, chats. Strictly functional cookies (cart, session) are exempt. A consent plugin helps to categorise them.
Does the GDPR apply outside Europe?
The GDPR applies in particular to sites that target people located in Europe. Other countries have their own rules. The safest approach is to apply the basic principles — information, minimisation, consent — and to check the local framework with the client.
What is the correct principle for non-essential cookies?