{"id":3241,"date":"2025-03-08T10:39:38","date_gmt":"2025-03-08T09:39:38","guid":{"rendered":"https:\/\/trackboxx.com\/?p=3241"},"modified":"2026-09-09T22:07:05","modified_gmt":"2026-09-09T20:07:05","slug":"operate-website-dsgvo-compliant","status":"publish","type":"post","link":"https:\/\/trackboxx.com\/en\/website-dsgvo-konform-betreiben\/","title":{"rendered":"How to make your website GDPR-compliant"},"content":{"rendered":"<p class=\"wp-block-paragraph\">The General Data Protection Regulation (GDPR) sets strict standards for protecting personal data online. What does that mean for your website? This article walks you through the key steps to address GDPR requirements and reduce legal risks.<\/p>\n\n\n\n<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-40b050d stk-block-background\" data-v=\"2\" data-block-id=\"40b050d\"><style>.stk-40b050d {border-top-left-radius:1px !important;border-top-right-radius:1px !important;border-bottom-right-radius:1px !important;border-bottom-left-radius:1px !important;overflow:hidden !important;box-shadow:none !important;border-style:solid !important;border-color:#cecece !important;}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-40b050d-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-83d1557\" data-block-id=\"83d1557\"><style>.stk-83d1557 {margin-bottom:0px !important;}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-b08ea4a\" data-block-id=\"b08ea4a\"><style>.stk-b08ea4a .stk--svg-wrapper .stk--inner-svg svg:last-child, .stk-b08ea4a .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g, path, rect, polygon, ellipse){fill:#eb267d !important;}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-b08ea4a\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-b-08-ea-4-a-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-b-08-ea-4-a-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-f2ecf02\" id=\"wer-muss-sich-an-die-dsgvo-halten-gibt-es-ausnahmen\" data-block-id=\"f2ecf02\"><h5 class=\"stk-block-heading__text\">Who does the GDPR apply to \u2014 and are there exceptions?<\/h5><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR applies when you process personal data* as part of the activities of an establishment in the EU. It can also cover providers outside the EU that offer goods or services to people in the EU or monitor their behaviour there. Citizenship is not the deciding factor. The exemption for purely personal or household activities is narrow: a publicly accessible website is not exempt simply because it makes no money.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>*Personal data<\/strong> means any information relating to an identified or identifiable person. That includes obvious details such as a name, address or email address, but also information such as IP addresses, location data and website activity. What matters is whether the information can identify someone, directly or indirectly.<\/p>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>1. Make your privacy policy easy to find<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your website processes personal data, it needs a privacy policy. Make it easy to find \u2014 for example, with a link in the footer \u2014 and include the required information. Key questions to answer include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What data is collected?<\/li>\n\n\n\n<li>Why do you process the data?<\/li>\n\n\n\n<li>What legal basis do you rely on?<\/li>\n\n\n\n<li>How long will the data be stored?<\/li>\n\n\n\n<li>What rights do visitors have over their data?<\/li>\n\n\n\n<li>Who is the data controller?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A privacy policy generator can give you a starting point. Check that the result accurately covers how your website actually handles data. Using a generator does not, on its own, ensure legal compliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2. Get cookie consent right<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In Germany, Section 25 of the TDDDG generally requires consent to store information on a user\u2019s device or access information already stored there. Exceptions include operations that are strictly necessary to provide a service the user has explicitly requested. The rule is not limited to cookies. If personal data is subsequently processed, you also need an appropriate legal basis under the GDPR. For cookies and similar technologies that require consent:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Active opt-in<\/strong>: Only set cookies that require consent after the user has actively opted in.<\/li>\n\n\n\n<li><strong>A genuine choice<\/strong>: Give users a genuine, voluntary choice, including the option to reject cookies that require consent.<\/li>\n\n\n\n<li><strong>Clear information<\/strong>: Which cookies do you use, and what are they for?<\/li>\n\n\n\n<li><strong>Easy withdrawal<\/strong>: Users must be able to withdraw consent at any time, as easily as they gave it.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cookie consent tools such as Borlabs Cookie or Cookiebot can help. For more detail, read our guide to <a href=\"https:\/\/trackboxx.com\/en\/gdpr-compliant-design-of-consent-banners\/\" data-type=\"link\" data-id=\"https:\/\/trackboxx.com\/dsgvo-konforme-gestaltung-von-consent-bannern\/\">designing GDPR-compliant consent banners<\/a>.<\/p>\n\n\n\n<div class=\"wp-block-stackable-call-to-action stk-block-call-to-action stk-block stk-9da87ca is-style-default\" data-v=\"2\" data-block-id=\"9da87ca\"><div class=\"stk-block-call-to-action__content stk-content-align stk-9da87ca-column stk-container stk-9da87ca-container stk-hover-parent\"><div class=\"has-text-align-center stk-block-content stk-inner-blocks stk-9da87ca-inner-blocks\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-a31a9f8\" id=\"webanalyse-ohne-cookies-moglich\" data-block-id=\"a31a9f8\"><h3 class=\"stk-block-heading__text\">Web analytics without cookies<\/h3><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-06835b4\" data-block-id=\"06835b4\"><p class=\"stk-block-text__text\">Even if <strong>you do not set cookies<\/strong> , other tracking technologies may still <strong>require consent<\/strong> . The GDPR protects <strong>personal data<\/strong>, regardless of the technology used to collect it.<\/p><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Web analytics with Trackboxx: <a href=\"https:\/\/trackboxx.com\/en\/\" data-type=\"link\" data-id=\"https:\/\/trackboxx.com\">Our tracking tool<\/a> helps you <strong>understand how visitors use your website<\/strong>. Whether consent is required depends on your specific setup and the features you use. Assess your website\u2019s privacy requirements rather than assuming that not using cookies removes the need for consent.<\/p>\n\n\n\n<div class=\"wp-block-stackable-button-group stk-block-button-group stk-block stk-29dbbf2\" data-block-id=\"29dbbf2\"><style>.stk-29dbbf2 .stk-button-group{flex-direction:row !important;}@media screen and (max-width: 1023px){.stk-29dbbf2 .stk-button-group{flex-direction:row !important;}}@media screen and (max-width: 767px){.stk-29dbbf2 .stk-button-group{flex-direction:row !important;}}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content stk-button-group\">\n<div class=\"wp-block-stackable-button stk-block-button stk-block stk-14c83c0\" data-block-id=\"14c83c0\"><style>.stk-14c83c0 , .stk-14c83c0 .stk-button{width:100% !important;}.stk-14c83c0 {flex:1 0 var(--stk-button-group-flex-wrap, 0) !important;}.stk-14c83c0 .stk-button{padding-right:40px !important;padding-left:40px !important;background:linear-gradient(135deg,rgb(226,1,119) 0%,rgb(0,92,174) 100%) !important;border-top-left-radius:50px !important;border-top-right-radius:50px !important;border-bottom-right-radius:50px !important;border-bottom-left-radius:50px !important;}.stk-14c83c0 .stk-button__inner-text{color:#ffffff !important;}<\/style><a class=\"stk-link stk-button stk--hover-effect-darken\" href=\"\/en\/helpcenter\/30-day-free-trial\/\"><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M352 256c0 22.2-1.2 43.6-3.3 64H163.3c-2.2-20.4-3.3-41.8-3.3-64s1.2-43.6 3.3-64H348.7c2.2 20.4 3.3 41.8 3.3 64zm28.8-64H503.9c5.3 20.5 8.1 41.9 8.1 64s-2.8 43.5-8.1 64H380.8c2.1-20.6 3.2-42 3.2-64s-1.1-43.4-3.2-64zm112.6-32H376.7c-10-63.9-29.8-117.4-55.3-151.6c78.3 20.7 142 77.5 171.9 151.6zm-149.1 0H167.7c6.1-36.4 15.5-68.6 27-94.7c10.5-23.6 22.2-40.7 33.5-51.5C239.4 3.2 248.7 0 256 0s16.6 3.2 27.8 13.8c11.3 10.8 23 27.9 33.5 51.5c11.6 26 20.9 58.2 27 94.7zm-209 0H18.6C48.6 85.9 112.2 29.1 190.6 8.4C165.1 42.6 145.3 96.1 135.3 160zM8.1 192H131.2c-2.1 20.6-3.2 42-3.2 64s1.1 43.4 3.2 64H8.1C2.8 299.5 0 278.1 0 256s2.8-43.5 8.1-64zM194.7 446.6c-11.6-26-20.9-58.2-27-94.6H344.3c-6.1 36.4-15.5 68.6-27 94.6c-10.5 23.6-22.2 40.7-33.5 51.5C272.6 508.8 263.3 512 256 512s-16.6-3.2-27.8-13.8c-11.3-10.8-23-27.9-33.5-51.5zM135.3 352c10 63.9 29.8 117.4 55.3 151.6C112.2 482.9 48.6 426.1 18.6 352H135.3zm358.1 0c-30 74.1-93.6 130.9-171.9 151.6c25.5-34.2 45.2-87.7 55.3-151.6H493.4z\"><\/path><\/svg><\/div><\/span><span class=\"has-text-color stk-button__inner-text\">Try it for 30 days, with no obligation<\/span><\/a><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>3. HTTPS and TLS: protect data in transit<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use HTTPS with up-to-date TLS encryption to protect data as it travels between the browser and your web server. This is particularly important for personal data (<a href=\"https:\/\/trackboxx.com\/en\/contact-forms-consent-is-required\/\" data-type=\"post\" data-id=\"1942\">for example, through contact forms<\/a>). Encryption protects data in transit, but it does not make your website GDPR-compliant on its own.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>4. Handle contact form data properly<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your website has contact forms, keep the following in mind:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>data minimisation<\/strong>: Only ask for the information you actually need.<\/li>\n\n\n\n<li><strong>Purpose limitation<\/strong>: Tell visitors why you collect the information in the form.<\/li>\n\n\n\n<li><strong>Choose the right legal basis<\/strong>: Depending on the enquiry, processing may be necessary to fulfil a contract, take steps before entering into one, or pursue a legitimate interest. A consent checkbox is not automatically required. Explain how you handle the data alongside the form and link to your privacy policy.<\/li>\n\n\n\n<li><strong>Retention periods<\/strong>: Do not keep the data indefinitely.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>5. Check your third-party integrations<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Many websites use third-party services such as Google Analytics, the Facebook Pixel or embedded YouTube videos. For each service, check where data goes, the legal basis for processing it and any transfers to third countries. No short checklist or single tool can guarantee GDPR compliance:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Google Analytics<\/strong>: Review your configuration, the necessary agreements and any data transfers. Tracking that requires consent must not start until the user has validly opted in; shortening an IP address is not enough.<\/li>\n\n\n\n<li><strong>YouTube, Google Fonts, social media plugins<\/strong>: Check how each service is integrated. Services that require consent must not load before the user agrees. Locally hosted fonts, for example, do not trigger a request to an external font provider.<\/li>\n\n\n\n<li><strong>Consider alternatives<\/strong>: Consider locally hosted fonts or analytics tools configured differently. With alternatives such as Matomo, compliance still depends on how you use them.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>6. Put a data processing agreement in place<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If an external service provider processes personal data on your behalf, you will generally need a <strong>data processing agreement (DPA)<\/strong>. This sets out how the provider must handle the personal data. Many providers, including Mailchimp and Google, make these agreements available online. So do we.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>7. Keep a record of processing activities<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Businesses and self-employed website operators generally need to keep a <strong>record of processing activities<\/strong> . The exemption for organisations with fewer than 250 employees is narrow and does not, for example, cover the regular processing of customer or employee data. The record sets out information such as processing purposes, data categories, recipients, retention periods and safeguards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>The bottom line: privacy compliance takes ongoing work<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR sets clear responsibilities for website operators. Transparent privacy information, appropriate legal bases, secure data transmission and carefully chosen third-party services are all important. You need a consent banner where consent is actually required. These measures help reduce privacy risks, but they are no substitute for reviewing your website\u2019s specific setup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review your website regularly for changes to services, data flows and privacy requirements. This article provides general guidance, not a legal assessment of your individual circumstances.<\/p>\n\n\n\n<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-30e0ea4 stk-block-background\" data-v=\"2\" data-block-id=\"30e0ea4\"><style>.stk-30e0ea4 {border-top-left-radius:1px !important;border-top-right-radius:1px !important;border-bottom-right-radius:1px !important;border-bottom-left-radius:1px !important;overflow:hidden !important;box-shadow:none !important;border-style:solid !important;border-color:#cecece !important;}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-30e0ea4-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-0a3ce1d\" data-block-id=\"0a3ce1d\"><style>.stk-0a3ce1d {margin-bottom:0px !important;}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-8b4e7c8\" data-block-id=\"8b4e7c8\"><style>.stk-8b4e7c8 .stk--svg-wrapper .stk--inner-svg svg:last-child, .stk-8b4e7c8 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g, path, rect, polygon, ellipse){fill:#eb267d !important;}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-8b4e7c8\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-8-b-4-e-7-c-8-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-8-b-4-e-7-c-8-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-b3d0742\" id=\"dsgvo-im-fokus\" data-block-id=\"b3d0742\"><h5 class=\"stk-block-heading__text\">The GDPR at a glance<\/h5><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The EU adopted the GDPR in 2016, and it has applied since 25 May 2018. It strengthens the protection of personal data and establishes a common framework across the EU. Its scope goes well beyond websites: it also covers businesses, public authorities, associations and healthcare organisations. For the legislation and up-to-date guidance, visit the <a href=\"https:\/\/europa.eu\/youreurope\/business\/dealing-with-customers\/data-protection\/data-protection-gdpr\/index_de.htm\" data-type=\"link\" data-id=\"https:\/\/europa.eu\/youreurope\/business\/dealing-with-customers\/data-protection\/data-protection-gdpr\/index_de.htm\" rel=\"nofollow noopener\" target=\"_blank\">European Commission website<\/a> or a national data protection authority such as Germany\u2019s <a href=\"https:\/\/www.bfdi.bund.de\/SharedDocs\/Downloads\/DE\/Broschueren\/INFO1.html\" target=\"_blank\" data-type=\"link\" data-id=\"https:\/\/www.bfdi.bund.de\/SharedDocs\/Downloads\/DE\/Broschueren\/INFO1.html\" rel=\"noreferrer noopener nofollow\">Federal Commissioner for Data Protection and Freedom of Information (BfDI)<\/a>.<\/p>\n<\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Die Datenschutz-Grundverordnung (DSGVO) stellt hohe Anforderungen an den Schutz personenbezogener Daten im Internet. Doch was bedeutet das konkret f\u00fcr Webseitenbetreiber? In diesem Artikel erf\u00e4hrst Du, welche Schritte notwendig sind, um Deine Website DSGVO-konform zu gestalten und rechtliche Risiken zu vermeiden. Wer muss sich an die DSGVO halten: Gibt es Ausnahmen? Die DSGVO gilt insbesondere, wenn [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3245,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,67],"tags":[],"class_list":["post-3241","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogboxx","category-datenschutz"],"acf":[],"_links":{"self":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/3241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/comments?post=3241"}],"version-history":[{"count":2,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/3241\/revisions"}],"predecessor-version":[{"id":5062,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/3241\/revisions\/5062"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media\/3245"}],"wp:attachment":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media?parent=3241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/categories?post=3241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/tags?post=3241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}