A privacy-compliant website covers three things clearly on every page that collects data from a visitor: a privacy notice explaining what personal data is processed and for what purpose, a clear cookie notice-and-consent mechanism, and a separately captured explicit consent on contact or order forms. On top of that comes an SSL certificate and, where required, registration with a data processing authority. A missing privacy notice or a cookie banner that runs without real consent can trigger a fine running into the thousands of euros even for a small business; this article walks through, in plain language, why each element is required under data protection laws such as the EU's GDPR and Türkiye's KVKK, and how to add it to your site.
Why does this matter so much for websites?
Modern data protection law defines personal data broadly: name, email, phone number, IP address — even the visit history a cookie stores counts. The moment a website collects this kind of data through a contact form, a membership signup, a newsletter opt-in, or a checkout flow, it falls under the "data controller" definition that both the GDPR and Türkiye's KVKK use. That covers far more than large companies; it applies just as much to a hair salon running a single-page site or a restaurant taking orders online.
The misconception we run into most often in the field is: "we're a small business, nobody's watching us." In reality, the majority of complaints that reach a data protection authority start with a single customer reacting to an unsolicited marketing email or noticing a missing cookie banner on a site. In other words, what triggers the risk is usually not an audit — it's one dissatisfied visitor filing a complaint.
Take a concrete example: a manufacturing business adds a new "request a quote" form to its site. The form collects name, phone, and email; the team publishes it quickly but pushes the privacy notice to "we'll add it later." Three months on, a prospective customer files a complaint saying they don't know how the information they submitted through the form will be used. The surprising part for the business owner is that the form works fine technically — the problem is that the notice behind the form was never written at all. This kind of case isn't the exception in the field, it's the rule: adding a form reads as a technical task, while writing a privacy notice too often gets filed under "later."
What is a privacy notice, and where should it live on the site?
A privacy notice is a page that clearly explains what personal data your site processes, for what purpose, on what legal basis, and who it might be shared with. It isn't a formality; both the GDPR (Articles 13–14) and Türkiye's KVKK (Article 10) explicitly require this disclosure, and a notice with missing content carries risk similar to having no notice at all.
In practice, a privacy notice is expected to be accessible from three places on a site:
- A permanent link in the footer: reachable from every page in a single click, never buried in a hidden menu.
- Next to every form that collects data: right above or below the contact form, membership form, or order form, together with a line such as "I have read the privacy notice regarding the processing of personal data."
- As a separate, standalone page: not to be confused with a privacy policy — the two serve different purposes, though in practice most sites present them on the same page under separate headings.
When planning a corporate website, don't leave this page for last; plan it alongside content and design, since you can't write an accurate privacy notice until you know exactly which forms collect which data.
A point that often causes confusion is the difference between a privacy notice and a privacy policy. A privacy notice is a formal disclosure mandated by data protection law and must include certain minimum items: the identity of the data controller, the purpose of processing, the legal basis, transfers, and retention periods. A privacy policy is a broader trust document — it covers the site's general approach to data, third-party tools, and user rights. In practice the two are often published on the same page under separate headings, but the privacy notice meeting the legally required minimum content is a requirement independent of the privacy policy's style.
Cookie notice and consent management
Dropping a cookie into every visitor's browser without their knowledge carries real risk under data protection law. Every non-essential cookie — analytics, advertising, social media pixels — should not run before the visitor has given explicit consent. In practice that requires two things: a cookie banner that informs the visitor, and analytics/advertising cookies that stay dormant until the visitor says "I accept."
The most common mistake we see in the field is a banner that appears while Google Analytics or an ad pixel is already firing in the background before the visitor has made any choice at all. A setup like this — visually compliant but technically not — is one of the first issues flagged in an audit. In a correctly built setup, the banner offers three options: accept all, reject all, and manage preferences; only strictly necessary (technical) cookies may run without consent.
It also matters that reject is just as easy to reach as accept; on some sites the "accept" button is large and colorful while "reject" is hidden as a small link. That design choice conflicts with the principle that consent must be "freely given," and can be flagged as a standalone issue in an audit. It's also good practice to offer a persistent settings link, usually in the footer, so visitors can change their cookie preferences at any time.
How do you capture explicit consent on a contact form?
Explicit consent on a contact form is a separate, deliberate signal of the visitor's informed, free, and unambiguous agreement — it doesn't happen automatically just because someone clicks "submit." In practice this usually means an unchecked consent box: the form shouldn't submit until the visitor reads the text and ticks it themselves.
A few practical points worth watching:
- The consent checkbox should arrive unchecked by default; a pre-checked box doesn't count as valid consent.
- The consent text should link to the privacy notice, not repeat it; the two texts should stand independently while referencing each other.
- Businesses that want to send marketing emails or texts need a separate, additional consent checkbox for that; general consent on a contact form isn't enough to cover marketing communication.
- How long the submitted data will be retained also needs to be stated in the privacy notice.
Why is an SSL certificate treated as mandatory?
On a site without an SSL certificate — one where the address bar shows "not secure" instead of a lock icon — any data collected is transmitted unencrypted. That both breaches the "appropriate technical measures" requirement in data protection law and breaks visitor trust from the outset. Since SSL now comes free with nearly every hosting and infrastructure provider, going without it reads as neglect rather than a technical limitation.
SSL isn't just a compliance checkbox — it's also a trust and performance signal: browsers warn visitors away from unencrypted sites, and search engines give unencrypted sites lower priority. While reviewing your site's technical infrastructure, it's worth tackling site speed and Core Web Vitals at the same time, since security and speed are often shaped by the same infrastructure decisions.
For sites that take payments, SSL matters even more: every page processing card data being encrypted is a precondition both for payment processor integration requirements and for payment security standards more broadly. Running a payment form on an unencrypted page isn't an acceptable practice under either data protection law or payment industry rules.
The data processing inventory and registration requirements
A data processing inventory (or record of processing activities) is a table showing which personal data your business collects, in what process, for what purpose, and for how long it's retained — it's the foundational document of privacy compliance. Every data flow collected through your website — contact form submissions, order data, membership records — should appear as a line in this inventory.
Depending on jurisdiction, this comes with a registration obligation: under the GDPR this typically takes the form of a record of processing activities under Article 30, while under Türkiye's KVKK certain data controllers must register with VERBİS, the national Data Controllers' Registry. Whether the obligation applies, and to what extent, depends on factors like annual staff count and processing volume — many small businesses fall under an exemption, but each business needs to confirm this for itself. Clearly listing what data is collected as you set up your site's forms and membership structure makes both the inventory and the registration assessment easier. This becomes especially critical for sites collecting order, membership, and payment data; when planning how to build an e-commerce site, we recommend putting the compliance assessment on the same timeline as the software setup.
The cost of non-compliance: administrative fines
Administrative fines for data protection violations scale up depending on the type of breach — failing to meet the disclosure obligation, failing to implement data security measures, failing to register where required — and the amounts are revised each year. The fine a hair salon or a small e-commerce site ends up paying is often several times the cost of building the site in the first place — and a fine isn't just a financial loss, it damages brand trust too.
The realistic picture we see in the field is this: most of the fine risk comes not from complex violations but from the most basic gaps — no privacy notice, a cookie banner that's just for show, a pre-checked consent box on a form. None of this requires a large budget; what it requires is including these items in the plan when the site is being built. When getting a website quote, ask whether privacy compliance items are included in the price — adding them later is always more expensive than planning for them from the start.
Privacy-compliant website checklist
It's also worth clarifying who's responsible for what: the technical infrastructure and form/cookie setup is generally the job of the agency building your site, but the content of the privacy notice and any registration assessment call for legal review. In a healthy division of labor, the agency handles the technical build while the business owner or their counsel signs off on the text — when both sides' responsibilities are clear, nothing falls through the cracks. Walk through the following items in order as you review your site:
- Is the privacy notice live and reachable from the footer?
- Does the cookie banner keep analytics/advertising cookies blocked until the visitor makes a choice?
- Do contact and order forms have an unchecked explicit consent box?
- Is there a separate consent mechanism for marketing communication?
- Is the site served over SSL, with a lock icon showing in the address bar?
- Has a data processing inventory been prepared, and has the registration obligation been assessed?
- Are data retention periods stated in the privacy notice?
As you build or refresh your site, we recommend treating this checklist as part of the technical web design and development process; forms, cookie infrastructure, and privacy notices are things you build in from the start, not patches you add later. If you'd like to assess your site's privacy compliance together, get in touch; in a free initial call, we'll review your current site quickly and put together a concrete list of gaps.
This article is for general information only and does not constitute legal advice; for the data protection obligations specific to your business, we recommend consulting a lawyer or a data protection specialist.