Updated 18 September 2026. This guide replaces our 2018 GDPR launch advice. The offers and deadlines in that original article have ended.
Website privacy is an ongoing part of running your business. Start with these five checks, then review the details against your own tools and activities.
1. Check what your forms collect
Remove unnecessary fields and explain the purpose near the form. Link to relevant privacy information. Keep a request for a quote separate from a marketing subscription. Sharing data with a service provider does not automatically mean consent is the correct lawful basis; the purpose and relationship matter. Read the ICO’s guidance on choosing consent.
2. Test cookies and embedded tools
Check what loads before a visitor makes a choice, after rejection and after consent. Include advertising tags, analytics and embedded media. Where consent is required, a banner must control the technology, not merely describe it.
UK rules include specific exceptions, including strictly necessary uses and narrowly defined statistical purposes. They have conditions, and some require clear information and an easy way to object. Do not assume every analytics tool qualifies. Check the ICO’s current exceptions guidance for your actual configuration.
3. Review how people join your mailing list
Unsolicited marketing emails to individual subscribers generally need consent or a valid soft opt-in. For the products-and-services soft opt-in, collect details directly during a sale or negotiation, promote your own similar offerings, and provide an opt-out both when collecting details and in every message. Corporate subscribers have different rules; sole traders are not automatically corporate subscribers. Read the ICO’s electronic marketing guidance before relying on an exception.
Check the journey from form to email marketing platform, including unsubscribe handling.
4. Keep privacy information accurate
Explain how your organisation actually uses information, including relevant providers and retention. Review it whenever the process changes. The ICO’s checklist sets out what information may be required. Our website data-mapping guide helps you prepare that review.
5. Look beyond the HTTPS certificate
HTTPS protects the connection, but it does not fix vulnerable plugins, poor access controls or an exposed database. Review updates, accounts, backups and recovery alongside the certificate. See our HTTPS explanation and hosting and support options.
Ask the inLIFE team about the technical setup. This checklist is not legal advice or a guarantee of compliance; use current ICO guidance and appropriate specialist advice for your circumstances.
