Skip to main content

GDPR checklist for your website

What should you set up for GDPR and privacy?

Privacy is not only a legal requirement; it is also part of earning trust. If your website uses analytics or other tracking, collects personal data through forms, or lets people subscribe to a newsletter, visitors need clear information about what happens to their data. In some cases, you also need their consent. This checklist shows the Demona settings that support those tasks.

This checklist is not legal advice. It explains the privacy-related controls available in Demona. The exact requirements for your business depend on what data you collect, why you collect it and the laws that apply to you. If you are unsure, ask a qualified privacy professional.

1. Privacy notice

Create a page for your privacy notice and make it easy to reach from anywhere on the site, for example through the footer's legal links. The cookie banner and form-consent text can link to this page too.

Your notice should accurately describe the personal data you collect — such as form submissions, newsletter subscriptions and analytics data — why you process it, how long you keep it, and which external services are involved, such as Google Analytics or reCAPTCHA. The exact wording and legal basis should reflect your own processing activities.

2. Cookie consent and analytics

If you use tracking configured through Demona, enable the cookie banner and add a link to your privacy notice. Demona loads those configured tracking tools only after the visitor accepts tracking. If they reject or later withdraw consent, Demona prevents those tools from loading and removes recognised tracking cookies it knows about.

Also give visitors an easy way to change their choice later, such as the Cookie settings link in the footer. See Cookie consent and Analytics and tracking for the full setup.

3. Forms and newsletter signup

  • Contact forms: in the Contact form block, enable the privacy-consent option when your process requires it and link to your privacy notice.
  • Newsletter signup: in newsletter forms — including footer layouts with newsletter signup — enable the required privacy-consent option when appropriate and add the privacy-notice link.
  • Collect only what you need: keep only the form fields that are genuinely necessary for the purpose of the enquiry or subscription.

4. Spam protection

Forms already include built-in anti-spam measures such as a hidden honeypot field, minimum completion time and submission limits. If you still need captcha protection, Cloudflare Turnstile is available alongside Google reCAPTCHA. If you use reCAPTCHA, make sure your privacy information reflects the data sent to Google. See Google Places and captcha integrations.

5. Manage the data you collect

  • Messages: review and delete old form submissions when you no longer need them. See Manage contact form messages.
  • Access: only give editor access to people who need it, and remove access when someone leaves or no longer works on the site. See Manage website users.
  • Exports: a website export can contain personal data, so treat the archive as confidential and store or share it accordingly. See Export your website.

Privacy-friendly defaults Demona already provides: website fonts are served by the site rather than fetched from a separate font provider; tracking configured through Demona waits for the required consent; and forms include built-in anti-spam measures even without captcha.

Privacy checklist

Work through the essentials and make sure each one reflects how your own business actually handles personal data.

Privacy notice published

Available through the site's legal links and written to match your real data-processing activities.

Cookie consent configured

Enabled when required for the tracking tools you use, with a clear link to the privacy notice.

Consent can be changed later

Visitors have a clear way to reopen cookie settings and update their choice.

Forms use appropriate consent

Contact and newsletter forms include the consent wording and privacy link your process requires.

External services are documented

Your privacy information reflects services such as Google Analytics, Meta Pixel, reCAPTCHA or embedded maps when you use them.

Old data and access are reviewed

Remove data you no longer need and periodically review who can edit the website.

TIPS AND TRICKS

Start with cookie consent.

See how to configure the banner, privacy link and the way visitors can change their consent later.

Cookie consent →Back to the Help Center