GDPR and Privacy for SME Websites: A Practical Guide

"GDPR is for big companies" is one of the most expensive assumptions a small business can make. In practice, any website with a contact form already processes personal data (name, email, phone number) and is subject to the same rules that apply to a multinational. In Portugal the regulation is known as RGPD, and the national authority is the CNPD. The good news is that meeting the essentials does not require a legal department, just doing the right things from the start.

Note: this article is a practical, operational guide, not legal advice. For specific or higher-risk cases (sensitive data, large volumes, regulated sectors), it is worth consulting a data protection lawyer.

When GDPR Applies to Your Site (Almost Always)

Common situations that already involve personal data processing:

• A contact form asking for a name, email or phone number
• A WhatsApp button that opens a chat with the visitor's number
• Google Analytics, which records the IP address and browsing behaviour
• A newsletter with a subscriber list

If your site does any of these, and the vast majority do, GDPR already applies.

The Bare Minimum Every Site Needs

A Real Privacy Policy

Not one copied from another site with the company name swapped in a hurry. It should explain, in plain language: what data the site collects, for what purpose, how long it is kept, who it might be shared with (for example the email tool or hosting provider), and how a visitor can ask for their data to be deleted.

A Clear Legal Basis for Each Type of Processing

Responding to a contact request has a different legal basis than sending a monthly newsletter. The first relies on legitimate interest: the visitor asked, so it makes sense to reply. The second requires explicit consent, usually an unticked checkbox.

A Cookie Consent Banner (When Applicable)

Cookies strictly necessary for the site to function (for example keeping a shopping cart) do not require a banner. Tracking tools such as Google Analytics or the Meta Pixel require prior consent in most contexts, so tracking should only start after the visitor accepts.

Forms That Only Ask What Is Necessary

Every extra field on a form is one more piece of data to justify and protect. If you do not need a tax number (NIF) to answer a simple question, do not ask for it.

A Defined Retention Period

Keeping form submissions indefinitely, for no reason, is one of the most common and easiest-to-fix practices. Defining a period, for example deleting unanswered contacts after 24 months, already resolves most of the risk.

The Most Common Mistakes on Small Business Websites

• A generic privacy policy with no real company name or valid contact for data requests
• Google Analytics firing before any consent is given
• No defined process for when someone asks for their data to be deleted
• Third-party tools (forms, chat, email marketing) chosen without checking where and how they store the collected data

Tools That Help Without Adding Complexity

For the cookie banner, tools such as Complianz or CookieYes (both with a free tier for WordPress) cover most small business cases. For anyone using GA4, Google Consent Mode v2 lets tracking automatically respect the visitor's banner choice, without complex manual setup.

A Starting Point, Not the Finish Line

Meeting the essentials of GDPR is not a one-time project. It is a set of habits: revisiting the privacy policy whenever a new tool joins the site, checking that cookie consent still works correctly, and staying clear on where each piece of collected data actually lives.

You can see this applied in practice in this site's own privacy policy. Basic compliance setup (forms with consent, a tailored privacy policy and correctly configured tracking tools) is already part of every project in my web development services, from the Presence plan at € 390. To review the current state of your site, ask for a free review or get in touch via the form or WhatsApp.