The short answer
A GDPR-ready website has a lawful basis for every use of personal data, a privacy notice at collection that names every recipient, consent before non-essential cookies, working access and deletion rights, security appropriate to the risk, contracts with processors, a 72-hour breach plan, and safeguards for transfers outside the EEA. It applies to non-EU businesses that offer services to or monitor people in the EU.
Key takeaways
- The GDPR applies to businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour (Art. 3).
- There is no small-business exemption from the core duties. Only the record of processing has a limited exemption below 250 staff.
- Cookie consent comes from the ePrivacy Directive, but consent quality comes from GDPR Art. 7: as easy to withdraw as to give.
- Fines reach €20 million or 4% of worldwide annual turnover for the most serious breaches (Art. 83(5)).
- SafeLaunch checks every item that is visible in a website, code or app, cites the article, and drafts what's missing.
On this page
01
Does the GDPR apply to my website if I'm not in the EU?
Yes, in two situations under Article 3(2): when you offer goods or services to people in the EU (paid or free), or when you monitor their behaviour in the EU, which includes analytics and ad tracking that profiles visitors. Signals that you offer services to the EU include EU languages or currencies, EU shipping and marketing aimed at EU countries.
If you're not established in the EU but the GDPR applies, Article 27 usually requires you to appoint a representative in the EU. SafeLaunch's compliance pack lists representatives and registrations for each market you choose.
02
The 16-point GDPR checklist
| # | Requirement | Article | What it looks like on a website |
|---|---|---|---|
| 1 | A lawful basis for every use of personal data | Art. 6 | Consent for marketing and tracking; contract for running the account; legitimate interest documented for the rest |
| 2 | A privacy notice at collection | Art. 12 to 14 | Identity and contact, purposes and legal basis, recipients, retention, rights, right to complain, transfers |
| 3 | The notice names every recipient | Art. 13(1)(e) | Your hosting, database, email, analytics, payment and AI providers, by name or category |
| 4 | Consent that is free, specific, informed and as easy to withdraw as to give | Art. 7 | No pre-ticked boxes, Reject next to Accept, a way to change your mind later |
| 5 | Prior consent for non-essential cookies | ePrivacy Art. 5(3) | Analytics, ads and session replay load only after Accept, and stay off after Reject |
| 6 | Explicit consent for special-category data | Art. 9 | Health, biometrics, religion, sexuality and similar need explicit consent or another Art. 9 condition |
| 7 | Parental consent for children's accounts | Art. 8 | Under 16 (or the national age, 13 to 16) needs a parent's consent for online services |
| 8 | Access, correction, deletion, portability and objection | Art. 15 to 22 | A working way to ask, answered within one month |
| 9 | No solely automated decisions with legal or similar effects without safeguards | Art. 22 | Human review for AI decisions about credit, jobs or access |
| 10 | Security appropriate to the risk | Art. 32 | HTTPS, access control on every table, no exposed secrets, security headers |
| 11 | Data protection by design and by default | Art. 25 | Collect only what each feature needs; privacy-protective defaults |
| 12 | Contracts with processors | Art. 28 | A data processing agreement with each provider that handles personal data for you |
| 13 | A record of processing activities | Art. 30 | Required at 250+ staff, or when processing isn't occasional, which covers most online services |
| 14 | Breach notification within 72 hours | Art. 33 to 34 | A plan: who assesses, who notifies the authority, when you tell users |
| 15 | A DPIA before high-risk processing | Art. 35 | Large-scale sensitive data, systematic monitoring or profiling |
| 16 | Safeguards for transfers outside the EEA | Art. 44 to 49 | Adequacy (such as the EU-US Data Privacy Framework), standard contractual clauses or another Chapter V tool |
03
Which GDPR gaps are most common on websites?
- 01
Tracking before consent
The most visible gap, and the one regulators test first. See why only a real-browser test proves this.
- 02
A notice that doesn't match the site
Template notices list services you don't use and miss the ones you do. Article 13(1)(e) requires the recipients, so a missing analytics or AI provider is a finding.
- 03
Rights with no working route
A notice that lists rights but gives no form, email or account setting to exercise them.
- 04
No processor agreements
Most providers offer a standard DPA; it still needs accepting, and listing in your records.
- 05
Transfers without a basis
US providers are often covered if they are certified under the EU-US Data Privacy Framework; others need standard contractual clauses.
04
How SafeLaunch checks GDPR
- Reads your notice and checks the Article 13 contents and that every service the site contacts is named.
- Tests cookies: trackers in the page source on every scan, and on paid audits in a real browser before a choice, after Reject and after Accept.
- Traces every form field to what it collects and flags data a feature doesn't need.
- Checks security in code and on the live site, mapped to Article 32.
- Prepares the paperwork in Launch Fix: record of processing, processor list, breach plan with deadlines, DPIA screening and representative requirements.
Your EU score shows how close you are: 80 or above is Low risk. What the score means, or start a free scan.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- GDPR, Regulation (EU) 2016/679 (EUR-Lex)
- ePrivacy Directive 2002/58/EC
- EDPB guidelines and recommendations
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading