The Legal Housekeeping Most Sites Skip

Know what you collect

1. Form submissions, stored in the database and emailed
2. Analytics, which may or may not be personal data depending on configuration
3. Any tracking pixels from advertising platforms
4. Chat conversations, if you have chat
5. Comments, if enabled

Most businesses can name two of those five. The audit takes an hour and it is the foundation of everything else.

The privacy notice

What you collect, why, how long you keep it, who you share it with, and how someone exercises their rights. Written plainly, not copied from a generator.

A generated notice that describes practices you do not follow is worse than a short accurate one.

Consent, where required

• Necessary cookies do not need consent; tracking generally does
• Consent must be a genuine choice, not a wall with one button
• Record what was consented to and when
• Make withdrawing consent as easy as giving it

Be able to find and delete

If someone asks what you hold about them, you need to search form submissions, comments, chat logs, analytics and any CRM. Most businesses have never tried.

Do it once as an exercise. It takes an afternoon and it turns a future deadline into a routine task.

Retention

Indefinite retention of form submissions is the most common quiet failure, because nobody ever decided anything.

Frequently asked questions