If you run a small website or blog, the EU’s General Data Protection Regulation (GDPR) can feel intimidating. Here’s the plain-English version: GDPR is a set of rules about how you collect, use, and protect information that can identify a person in (or from) the EU/EEA. Even tiny sites may be covered—not because of company size, but because of who your visitors are and what data you touch.
Quick disclaimer: This guide is educational, not legal advice.
When should a small site care?
You should pay attention to GDPR if any of these are true:
- You have visitors from the EU/EEA (very common), and your site collects personal data—even just an email for a newsletter or an IP address through analytics.
- You sell to EU/EEA customers or ship there.
- You run ads, contact forms, comment systems, or analytics that store user identifiers.
If you run a purely informational site with no tracking, no forms, no comments, no cookies, the risk is lower—but modern sites rarely meet that bar.
What counts as “personal data”?
Any info that identifies or can reasonably identify someone:
- Obvious: name, email, address, phone, profile photo.
- Common on small sites: IP address, device IDs, cookie IDs, contact form messages, newsletter lists, order history.
- Sensitive categories (health, religion, etc.) require extra caution—most small blogs don’t need these at all.
Your role: controller vs. processor
- Controller: You decide what data to collect and why (e.g., you run a blog, add a signup form).
- Processor: A service you use handles data on your behalf (e.g., your email platform, hosting, analytics vendor).
You’re usually the controller of your site; vendors you use are processors. GDPR expects you to choose reputable vendors and understand (at a high level) what they do with the data.
The six “lawful bases”
Think of a lawful basis as your legal reason to process data:
- Consent – User clearly agrees (e.g., newsletter signup).
- Contract – Needed to deliver something the user requested (e.g., fulfilling an order).
- Legal obligation – Required by law (e.g., tax records).
- Legitimate interests – Your reasonable business interest that doesn’t override user rights (e.g., basic security logging).
- Vital interests – Life-or-death situations (rare for websites).
- Public task – Government roles (not typical for blogs/business sites).
For newsletters, consent is standard. For orders, contract applies. For security logs, legitimate interests often fits. For ads and many analytics cookies, consent is commonly required in the EU.
Rights visitors have (and what that means for you)
EU/EEA visitors can:
- Access their data (what you have, why, where it came from).
- Correct inaccurate info.
- Delete data (with some exceptions).
- Object or restrict certain uses.
- Port data (get a copy).
- Withdraw consent at any time (for consent-based processing).
For a small site, this mainly means being able to respond politely and reasonably to requests about newsletter lists, order data, or contact form entries.
GDPR for small websites: a quick-view table
| Area | Common Examples on a Basic Site | Typical Lawful Basis | What “Good” Looks Like (non-technical) |
|---|---|---|---|
| Contact/lead forms | Name, email, message | Legitimate interests or Consent | Say why you collect it, where replies go, how long you keep messages; don’t ask for data you don’t need |
| Newsletter signups | Email for updates | Consent | Plain opt-in language; easy unsubscribe; no pre-ticked boxes |
| Orders & fulfillment | Name, email, shipping, billing | Contract | Collect only what’s needed to deliver; keep invoices as required by law; don’t reuse emails for marketing without consent |
| Comments/community | Display name, email, IP for abuse prevention | Legitimate interests + (maybe) Consent for extras | Explain moderation/anti-spam use; allow deletion requests |
| Analytics | IP addresses, device/cookie IDs | Often Consent in the EU (depends on tool/mode) | Be transparent about what’s tracked, why, and with whom; respect opt-outs; consider privacy-friendly modes |
| Security & logs | IP, timestamps, pages | Legitimate interests | Keep for a sensible time; use only to protect the site; don’t share broadly |
| Ads/retargeting | Cross-site IDs, cookies | Consent | No tracking before consent; clear choices; easy to change preferences |
| Email outreach | Transactional vs. marketing | Contract (transactional), Consent (marketing) | Distinguish order emails from promotions; honor unsubscribes |
Privacy notice vs. cookie notice (what’s the difference?)
- Privacy Notice/Policy: The big-picture page explaining what you collect, why, who you share with, how long you keep it, your lawful basis, and how people can exercise rights.
- Cookie Notice/Choices: The short interface (often a banner) for consent and settings related to cookies/trackers that aren’t strictly necessary.
For a basic site, think: one clear privacy page + a simple way to choose tracking preferences where required.
Practical risk signals for beginners
If you answer “yes” to any of these, your GDPR exposure is higher and you should take privacy more seriously (and possibly ask for professional advice):
- You collect emails for marketing or run retargeting ads.
- You use multiple third-party embeds (ad networks, social widgets, video platforms) that drop cookies.
- You handle EU/EEA orders with personal details.
- You store contact form submissions indefinitely.
- You installed analytics/ads without thinking about EU consent rules.
Data minimization: the small-site superpower
The less you collect, the less you must explain and protect. Ask yourself:
- Do I really need this field on my form?
- How long do I need to keep these submissions?
- Could I use privacy-friendly analytics settings/modes?
- Do I rely on third-party scripts I don’t understand?
Reducing data reduces risk—full stop.
International transfers (one-paragraph version)
If data about EU/EEA visitors leaves the EU (common when using global SaaS tools), GDPR expects adequate protections (standard contractual clauses, vendor safeguards). For small sites, this mostly means choosing reputable providers who state how they handle EU data and offering transparency in your privacy notice.
“Do” and “Don’t” for basic sites
Do:
- Be transparent in plain English.
- Collect only what you need, and for a clear purpose.
- Offer real choices where consent is needed, and make opt-out easy.
- Keep data for sensible periods, then clean it up.
- Choose trustworthy vendors and understand (at a high level) their privacy posture.
- Respond respectfully to data requests.
Don’t:
- Pre-tick consent boxes or bundle consent with unrelated stuff.
- Hoard form submissions or email lists “just in case.”
- Mix transactional messages with marketing without permission.
- Assume “I’m small, so rules don’t apply.” GDPR is about people, not company size.
A 10-minute sanity check (non-technical)
- List your data touchpoints: forms, newsletters, comments, analytics, orders.
- For each, ask: what do I collect, why, how long, which vendor, which lawful basis?
- Check your privacy page: does it reflect reality in plain words?
- Consent where needed: do visitors have a real choice before non-essential tracking?
- Housekeeping: delete very old exports/submissions you no longer need.
Bottom line
GDPR isn’t trying to stop small sites. It asks for clarity, choice, and care with people’s data. If you’re clear about what you collect and why, keep only what you need, and respect visitor choices, you’re already most of the way there—even as a one-person blog.