Legal basics & privacy · · 6 min read · By Alexander
Make your GDPR website compliant: the SME checklist
A GDPR website needs more than a legal notice and a cookie banner. This checklist helps small businesses in Germany identify which areas to review, which rules depend on specific functions and when specialist legal advice is appropriate.
Which rules actually apply to your website?
Start with a list of functions rather than a generic legal-text generator. A simple company website with a telephone number has different obligations from a shop, booking system, newsletter or application form. Record every function, external provider and point where data is entered or transferred.
The Dresden Chamber of Commerce checklist covers domains and trade marks, legal notices, privacy, third-party content, prices, online contracts, social-media elements, newsletters, cookies and accessibility; page accessed 6 November 2026. Not every item applies to every business, so the review must match the actual service.
Create a legal inventory with four columns: function, provider, transferred data and required text or consent. Include background technology such as analytics, maps, videos, fonts, chat, booking, payment providers and review widgets.
- Record all pages, forms and downloads
- Check cookies, local storage and external requests
- Map hosting, newsletter and booking providers to contracts
- Assess B2B, B2C and shop functions separately
What belongs in a German legal notice?
Section 5 DDG requires commercial digital services normally offered for remuneration to keep provider information easily recognisable, directly accessible and permanently available. Depending on the business, this includes name, serviceable address, representatives, email address, register details, supervisory authority, professional information and existing VAT or business identification numbers. Source: German federal legislation portal, accessed 6 November 2026.
Use a clearly labelled “Impressum” link in the footer and test it on mobile devices. The established two-click principle is described by German Chambers of Commerce. A PO box is not a serviceable address, and old templates should no longer rely on the Telemedia Act that ceased to apply in 2024.
Extra information may apply to regulated professions, editorial services and online shops. Do not copy another company’s legal notice because its legal form, register, chamber and regulator may differ.
How do you audit privacy, forms and cookie consent?
The privacy notice must reflect real processing. Article 13 GDPR requires information when personal data is collected, including the controller, purposes, legal bases, recipients, retention and data-subject rights. Source: EUR-Lex, accessed 6 November 2026. A standard document becomes inaccurate when new tools are added.
Review every form field. Collect only information needed for the task, identify mandatory fields and encrypt transmission. Health data, job applications and other sensitive information require particular care. A data-processing agreement may be required for providers processing personal data on your behalf.
Under Section 25 TDDDG, storing or reading information on a user’s device generally requires informed consent. Exceptions include operations that are strictly necessary for a service explicitly requested by the user. Source: German federal legislation portal, accessed 6 November 2026. Marketing, external videos or analytics must not start before required consent, and users need a practical way to reject and later change their choice.
- Compare the privacy notice with services actually loaded
- Minimise and secure forms
- Block non-essential services until consent
- Test consent and withdrawal on mobile and desktop
Are content, prices and advertising claims legally safe?
Running the website does not automatically give you usage rights. Keep evidence for photographs, videos, fonts, icons, maps, text and logos, including licence terms and permissions from identifiable people. German Chamber of Commerce guidance warns that third-party content normally needs permission; accessed 6 November 2026.
Review claims such as “market leader”, “guaranteed”, before-and-after outcomes, testimonials and quality seals. Claims should be demonstrable and not misleading. Reviews must not be invented, purchased or edited out of context. Reference projects need clear permission for names, logos, images and stated results.
Consumer prices must follow the applicable price-information rules. A monthly offer should state clearly whether the amount includes VAT, the minimum term and additional charges. Our public website-subscription net tiers are Starter €79, Business €149 and Premium €299 per month, plus statutory VAT; the final presentation must match the audience and contract.
What extra duties apply to shops and online contracts?
If consumers can order, book or conclude a paid contract online, further information and design duties apply. Review essential characteristics, total price, term, cancellation, delivery, payment, order button, withdrawal information and the technical checkout. Pure B2B services may follow different rules, but the audience must genuinely be restricted.
Since 19 June 2026, Germany requires an electronic withdrawal function for eligible distance contracts concluded online. The enacted amendment entered into force for this requirement on that date; source: German Bundestag legislative database, accessed 6 November 2026. Check that the function is easy to find, continuously available and technically documented. It is separate from the cancellation button for subscriptions.
Accessibility may also be mandatory. The BFSG includes certain e-commerce services. Micro-enterprises providing services are exempt under Section 3(3); the definition generally means fewer than ten employees and no more than €2 million annual turnover or balance-sheet total. Sources: German federal legislation portal, accessed 6 November 2026. The actual service still needs an individual scope check.
How does a website remain compliant?
Compliance is not a one-off launch task. A new video, newsletter tool, application form or payment module can change privacy, consent and information obligations. Require a technical and content review before each new function goes live.
Run an audit after major changes and on a fixed schedule. Compare the site with the function inventory, test footer links, forms and consent settings, and review licences and contracts. A six-month cycle is our organisational recommendation, not a statutory deadline.
A managed website subscription can combine maintenance, technical checks and implementation of approved legal texts. A web agency does not replace individual legal advice. Shops, health data, regulated professions, international services and legal claims deserve specialist review.
- Name an owner and deputy
- Log changes to tools and forms
- Update legal texts after technical changes
- Obtain legal review for high-risk cases
Frequently asked questions about website compliance
Does every German business website need an Impressum?
Commercial digital services generally require a legal notice under Section 5 DDG. The exact contents depend on legal form, profession and service.
Does every website need a cookie banner?
No. A banner is only useful where consent is genuinely required. Strictly necessary operations may fall within the exception in Section 25(2) TDDDG.
Is a free privacy-policy generator enough?
Only if its result matches the real technology and processing. Recheck it whenever forms, analytics, videos, maps or other services change.
Does the BFSG apply to every small business?
No. Its scope and exemptions require review. Micro-enterprises providing services are exempt under Section 3(3), although other accessibility duties may still matter.
Can a web agency guarantee legal compliance?
An agency can implement technology and approved legal texts carefully, but cannot give a blanket legal guarantee for every case. Individual legal questions require qualified advice.