Legal and compliance
What is GDPR?
The data protection regime applying to the personal data of people in the UK and EU, regardless of where the business processing it is located. It sets principles for processing, grants individuals rights over their data, and requires a lawful basis for every processing activity.
Also called: UK GDPR · General Data Protection Regulation
The obligations that reach a small website
- A lawful basis for every category of data you process
- A published privacy notice describing all of it accurately
- Consent before non-essential cookies and before marketing email
- Responding to access, correction and deletion requests within a month
- Reporting qualifying breaches to the regulator within 72 hours
- Written agreements with processors handling data on your behalf
It applies extraterritorially
A developer in Pakistan building a store for UK customers is processing UK personal data, and the regulation follows the data subject rather than the supplier. This is why hosting location, processor agreements and transfer mechanisms come up in briefs from British and Irish clients.
The practical reading for a small site
Collect less, name every third party honestly, get consent before analytics, and be able to delete someone on request. Most compliance failures on small sites are not exotic — they are a contact form emailing data to an address nobody documented.
Where this is covered in depth
A definition can only go so far. Who actually owns your website — a checklist you can verify today covers this properly — 3 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.