GDPR Compliant: What It Means and a Checklist You Can Finish

A freelancer sitting at a tidy desk with a closed laptop and a mug, looking out of a window.

Being GDPR compliant means handling personal data of people in the EU the way Regulation (EU) 2016/679 requires: a lawful reason for every use, only the data you need, plain-language notices, and working procedures for access, deletion and breaches. No regulator hands out a compliance badge, so it is a practice you can document, not a certificate you buy. And what triggers the law is where the person is, not what passport they hold.

TL;DR:

  • GDPR compliance is a documented practice, not a certification. No regulator issues a "GDPR compliant" badge, so treat vendor badges as marketing claims to verify.
  • The law follows location, not citizenship: an EU citizen living in the US is usually outside its reach, while a US tourist in Paris can be inside it.
  • The company as "controller" is accountable. You can outsource tasks to processors, but you cannot outsource responsibility.
  • Eight steps cover most small businesses: map your data, pick lawful bases, publish a notice, sign processor contracts, plan for rights requests and breaches, keep records, audit cookies, and check transfers.
  • Analytics is the easiest place to remove risk. Cookieless, aggregate measurement can avoid a consent banner, but it does not make the rest of your site compliant.
REPLASTATS

Need analytics without a consent banner?

See how ReplaStats tracks visitors, sources and top pages without cookies, keeps data on a separate server, and installs with one small script.

Visit →

Table of Contents

What "GDPR Compliant" Means, and What No One Can Certify For You

The General Data Protection Regulation, published as Regulation (EU) 2016/679, is the EU's law on processing personal data. "Personal data" is broader than most site owners assume. It covers any information relating to an identifiable person, including online identifiers such as IP addresses and cookie IDs, not just names and emails.

Compliance means you can show you follow the seven principles in Article 5:

  • Lawfulness, fairness and transparency. You have a valid legal basis, and people can read in plain language what you do with their data.
  • Purpose limitation. You collect data for a stated reason and do not quietly reuse it for something else.
  • Data minimization. You collect what the purpose needs. A newsletter form does not need a phone number.
  • Accuracy. You correct or delete data that is wrong.
  • Storage limitation. You set a retention period and stick to it.
  • Integrity and confidentiality. You protect data with access controls, encryption and sensible vendor choices.
  • Accountability. You can prove all of the above on request. This is the principle most small teams skip.

That last point shapes everything. No regulator hands out a universal "GDPR compliant" stamp. The regulation does allow voluntary certification schemes, but a footer badge reading "100% GDPR compliant" is the vendor's own statement. I would treat it as a claim to check against a signed data processing agreement, not as proof.

Does GDPR Apply to You? Location Beats Citizenship

Article 3 sets two main triggers. The first is being established in the EU: if your business, or even one office, sits in an EU country, GDPR covers the processing that happens in the context of that establishment. The second reaches outside the EU. GDPR applies when you offer goods or services to people who are in the EU, or when you monitor their behavior there.

The European Data Protection Board's guidelines on territorial scope stress that the test is where the person is when the processing happens, not their nationality or residence papers.

Does GDPR apply to EU citizens living in the US?

Usually not. An Italian citizen who lives in Texas and buys from a Texas shop that does not target the EU is generally outside GDPR, because they are not "in the Union." The obvious answer, "EU passport means GDPR," is wrong.

Two exceptions matter. If the shop itself is established in the EU, GDPR applies to its processing whoever the customer is. And if that same Italian citizen travels to Rome and your app tracks them there, they are in the EU at that moment.

Does GDPR apply to US data subjects?

It can. A US resident who is physically in the EU and is targeted by your offer or monitored by your site falls under Article 3(2). A US resident browsing from Ohio generally does not.

Which countries does GDPR cover?

The 27 EU member states, plus Iceland, Liechtenstein and Norway through the European Economic Area. Its reach beyond them depends on the triggers above.

The "just accessible" trap

Your site being reachable from Europe is not enough on its own. Signals that you are targeting the EU look like this:

  • Prices in euros.
  • EU shipping options.
  • A translated site for specific member states.
  • Ad campaigns aimed at EU countries.

Analytics deserves a second look here. Tracking visitors across sessions is "monitoring behavior," so a US-based site with meaningful EU traffic and persistent trackers can be in scope even without an EU storefront.

Who Is Responsible for GDPR Compliance in a Company?

Legally, the organization that decides why and how personal data is processed is the "controller," and Articles 5(2) and 24 make it accountable. In practice that lands on the owner or managing director, regardless of who sits in the IT department.

Role What they own Small-business example
Controller Decides purposes and means; accountable for everything You, the site owner or company
Processor Acts on your instructions; bound by an Article 28 contract; has its own security duties Email platform, hosting company, analytics vendor
Data Protection Officer Independent adviser; mandatory only in three cases under Article 37 (public authorities, large-scale systematic monitoring, large-scale special-category data) Most small sites do not need one
EU representative Contact point in the EU for non-EU companies in scope, under Article 27 A US store that targets EU shoppers
Staff and developers Follow procedures, report incidents, build with privacy in mind (Article 25) The freelancer who adds a tracking pixel

My position: name one person as the privacy owner even when no DPO is legally required. Compliance work that belongs to "everyone" stalls. A single named person with a shared folder of records is enough to start.

Agencies and freelancers get a special wrinkle. When you manage client sites, you are usually a processor for the client, who is the controller. You need a written agreement that says so, and you should be able to list every tool you install on their behalf.

GDPR vs. UK GDPR: The Difference That Changes Your Paperwork

The search "difference between GDPR and GDPR" is almost certainly a mangled version of a real question: how does the EU regulation differ from its UK twin? After Brexit, the UK kept a domestic copy called the UK GDPR, which sits alongside the Data Protection Act 2018 and is overseen by the Information Commissioner's Office. The ICO's UK GDPR guidance is the authoritative reference.

The practical differences:

  • Regulator. UK complaints go to the ICO. EU complaints go to the supervisory authority of the relevant member state.
  • Fines. The UK maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. The EU maximum is €20 million or 4%.
  • Representatives. A non-UK company in scope may need a UK representative, separate from an EU one.
  • Cookies. The UK handles cookie consent through its Privacy and Electronic Communications Regulations, not the ePrivacy Directive as implemented in EU countries.

If you serve both markets, build to the EU standard and then check the UK deltas. UK rules are being amended, so confirm current details on the ICO site before you rely on any summary, including this one.

A GDPR Compliance Checklist You Can Finish in One Afternoon

Three colleagues talking around a table in a sunlit studio with closed laptops in front of them.

Here is how to become GDPR compliant at small-business scale. None of this replaces legal advice for high-risk processing, but it covers the basics a regulator would ask about first.

  1. Map your data. List every place personal data enters: contact forms, checkout, newsletter, analytics, chat widgets, embedded videos. A spreadsheet with columns for data type, purpose, vendor and retention period is enough.
  2. Choose a lawful basis for each use. Article 6 offers six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Do not default to consent. Fulfilling an order runs on contract, and consent can be withdrawn at any time.
  3. Publish a privacy notice. Say who you are, what you collect, why, how long you keep it, who receives it, and how to exercise rights. Write it in plain English.
  4. Sign processor agreements. Every vendor touching personal data needs an Article 28 data processing agreement. Most reputable vendors publish one you can accept online.
  5. Prepare for rights requests. People can ask for access, correction, deletion and more. You generally have one month to respond under Article 12. Decide now who receives these emails and how you verify identity.
  6. Write a one-page breach plan. Article 33 requires notifying the regulator of a reportable breach without undue delay.

Seventy-two hours. That is the window Article 33 gives you to notify the regulator after becoming aware of a personal data breach, where feasible.

  1. Keep records. Article 30 requires a record of processing activities. Organizations under 250 employees get a partial exemption, but it falls away if processing is regular, risky or involves special categories, so most should keep the record anyway.
  2. Audit cookies and transfers. Check what your site stores in visitors' browsers and where your vendors send data. Transfers outside the EU need a valid mechanism, such as adequacy decisions or standard contractual clauses.
Eight steps to GDPR compliance: 1. Map your data; 2. Choose a lawful basis; 3. Publish a privacy notice; 4. Sign processor agreements; 5. Prepare for rights requests; 6. Write a breach plan

GDPR Compliant Examples, and the Issues That Trip Companies Up

There is no official GDPR compliant list of companies. Regulators publish enforcement decisions, not approved-vendor registers, and any "list of compliant companies" you find is someone's marketing or opinion.

What exists instead is behavior you can recognize.

Examples of compliant behavior

  • A newsletter form with an unticked consent box, a clear description of what you will send, and a one-click unsubscribe.
  • A privacy page that names every vendor category and states retention periods.
  • A deletion request handled within the month, with the vendor's copies removed too.
  • Analytics that count visits in aggregate and store no persistent identifier on the visitor's device.

Issues that cause real trouble

  • Consent that is not consent. Pre-ticked boxes, "Accept all" buttons far more prominent than "Reject," and trackers that fire before the visitor clicks anything.
  • Unmapped vendors. The heatmap tool a freelancer installed in 2021 and nobody remembers.
  • International transfers. The Irish Data Protection Commission fined Meta €1.2 billion in 2023 over transfers of EU user data to the US, the largest GDPR fine on record at that time.
  • Endless retention. Data kept "just in case" breaks storage limitation.
  • No records. When a complaint arrives, "we were careful" without documents counts for little.

Up to €20 million or 4% of worldwide annual turnover, whichever is higher: that is the ceiling for the most serious violations under Article 83(5).

Most small sites will never see a fine near that ceiling. Regulators typically scale penalties to size and conduct. Still, the consent and vendor-mapping failures above are the ones that generate complaints, and complaints trigger investigations.

Analytics Is the Easiest Place to Become GDPR Compliant, and the Easiest to Get Wrong

Analytics runs on almost every site, touches visitor data every day, and is often installed once and forgotten. That makes it a good first cleanup target. If you want the groundwork, our explainer on what website analytics measures and what tools only guess covers what you actually need to collect.

Two separate laws are in play, and mixing them up causes most of the confusion:

Question Governing rule What it asks
Can you store or read something on the visitor's device? ePrivacy Directive, Article 5(3) Consent, unless strictly necessary
Can you process the data you collect? GDPR A lawful basis, minimization, transparency, security

Going cookieless solves the first question and only part of the second. IP addresses and device fingerprints still count as personal data, and fingerprinting is caught by the device-access rule just like a cookie.

France's regulator has been the most specific. The CNIL has said that audience measurement can be exempt from consent only under tight conditions, such as producing anonymous statistics for the site publisher alone, with no cross-site tracking. A tool that profiles visitors across sites fails that test however it is marketed.

There is a real trade-off. Aggregate, cookieless measurement gives you accurate counts of visitors, sources and top pages. It gives up cross-session user-level attribution and ad retargeting audiences. For a site owner, freelancer or small agency, I would pick the aggregate option every time: the numbers you actually act on survive, and the consent banner you would otherwise defend disappears. If you are comparing options, pick an analytics tool without a consent banner walks through the criteria, and why the dominant free analytics platform is so hard to use explains why many site owners are leaving it.

Pro Tip: Test what your site stores before anyone clicks a consent button. Open a private window, load your site, then check the Application tab in your browser's developer tools for cookies and local storage, and the Network tab for requests to third-party domains. The surprises are rarely in your analytics tool. They are in embedded videos, chat widgets and font loaders that set identifiers on first load.

Session replays and heatmaps deserve their own assessment. They record far more granular behavior than page counts, so check what the tool masks, state its use in your privacy notice, and read our heatmap setup guide for WordPress before adding one to a live site.

If analytics is your biggest consent headache, Replastats removes that piece. It is a cookieless analytics service that shows visitors, sources, top pages and live traffic for every site you run, on WordPress, Shopify, Squarespace, Wix, Webflow, a JavaScript framework or plain HTML. It installs with one 4.7 KB deferred script tag or a WordPress plugin, stores data on a separate server rather than in your site's database, and needs no consent banner for the measurement itself. The free tier covers one site. Paid tiers add longer history, session replays and heatmaps from Starter, and a multi-site board on Pro and Agency.

The caveat is the one this article has repeated: no analytics tool makes your site GDPR compliant on its own. You still need a privacy notice, processor agreements and a clean audit of embeds, forms and ad tags. Session replays and heatmaps collect more detail than page counts, so check the spec sheet for what is masked and mention them in your notice. Confirm the setup against your own lawyer's advice before you drop a banner.

Frequently Asked Questions

What is GDPR compliance?

GDPR compliance means you process personal data of people in the EU according to Regulation (EU) 2016/679: a lawful basis for each use, data minimization, transparency, security, and procedures for rights requests and breaches. It is demonstrated through documentation and practice. No regulator issues a universal compliance certificate.

Does GDPR apply to EU citizens living in the US?

Generally no. GDPR follows where the person is, not their citizenship, so an EU citizen living in the US dealing with a business that does not target the EU is usually outside its scope. It applies if the business is established in the EU, or if the person is physically in the EU when you offer them services or monitor their behavior.

What is the difference between GDPR and GDPR?

The question is most likely a duplicate of the real comparison: the EU GDPR versus the UK GDPR. They are near-identical in substance, but the UK version is overseen by the ICO, carries a £17.5 million or 4% maximum fine, and works alongside the Data Protection Act 2018 and separate UK cookie rules.

Who is responsible for GDPR compliance in a company?

The controller, meaning the company that decides why and how data is processed, is accountable under Articles 5(2) and 24. Processors such as hosting and email vendors have their own duties, and a Data Protection Officer is required only in specific cases under Article 37. In practice, name one person as the privacy owner so tasks do not stall.

Is a cookieless analytics tool automatically GDPR compliant?

No. Going cookieless avoids the device-storage consent rule in the ePrivacy Directive, but IP addresses and fingerprints can still be personal data under GDPR. You still need a lawful basis, a privacy notice and a processor agreement, and you should confirm the tool does not profile visitors across sites.

Sources