Is Your Website RGPD-Compliant? The Practical Checklist for SMEs

RGPD compliance has a reputation problem among small-business owners: it sounds like a Paris-lawyer subject, priced accordingly, and irrelevant until the day it very much is not. The reality is more manageable. For a typical SME website — a showcase site with a contact form, perhaps a quote request or a newsletter — compliance comes down to a short list of concrete, checkable items. Here is that list, in the order an inspection (or an annoyed customer) would find the gaps.

First, the legal pages. French law requires mentions légales identifying who publishes the site — company name, legal form, address, registration, publication director, host. Alongside them, a privacy policy that says, in plain language, what personal data the site collects, why, for how long, and who to contact about it. These pages cost nothing to get right and their absence is the fastest possible signal, to a regulator or a procurement department, that nobody is minding the shop. A surprising share of the Cher's business sites are missing one or both.

Second, the cookie banner — the part most sites get actively wrong rather than merely incompletely. The CNIL's rules are clear: non-essential cookies (analytics, advertising, most embedded videos) require consent before they load; refusing must be as easy as accepting; and a banner that drops the cookies first and asks afterwards is not consent, it is decoration. The common failure we see is a free banner plugin installed years ago, showing the buttons but wired to nothing: the tracking loads regardless of what the visitor clicks. If you have analytics on your site and have never checked what happens when someone clicks refuse, check — or note that there are consent-free analytics configurations and cookieless approaches that remove the banner problem entirely for simple sites.

Third, the forms. The RGPD principle is minimisation: collect what you need for the stated purpose and nothing more. A quote-request form needs a name, a way to reply, and the request. It does not need a date of birth, a full address, or a mandatory phone AND email because the template came that way. Each form should say why the data is collected and link to the privacy policy; a pre-ticked newsletter box is a violation, not a growth hack. And the data's journey after submission matters as much as the form: if requests land in an inbox that three departed employees can still read, the form is the least of the problem.

Fourth, retention and rights. Data has a shelf life: prospect data that never converted should not sit in your systems for a decade. Define simple rules — quote requests kept two years, say — and honour the rights the law grants: a person who asks what you hold about them, or asks for deletion, must get an answer within a month. For an SME the volume is tiny; what matters is that somebody owns the mailbox where those requests arrive.

Fifth, the technical basics. HTTPS everywhere — a contact form submitting over plain HTTP is transmitting personal data in the clear, and browsers now say so to your visitors. If a third party built and hosts your site, processes your forms or runs your newsletter, they are a sous-traitant and your contract with them should say what they do with the data — the serious providers have this document ready and the absence of one tells you something.

Why does this matter beyond fine-avoidance? Two audiences read your compliance posture without ever mentioning it. B2B buyers — especially the industrial and public-sector clients this region runs on — increasingly screen suppliers on it: a visibly non-compliant site is a checkbox lost before a meeting happens. And your customers read the sloppiness emotionally: a site that mishandles the visible things invites doubt about how it handles the invisible ones. Compliance is not the reason to rebuild a site, but it is one of the things a serious rebuild gets right by default — the consent flow, the minimal forms, the HTTPS, the legal pages — and one of the cheapest kinds of trust an SME can buy.

Looking for Website Build & Optimization in Bourges?

This article covers the thinking. The service page covers the scope, the deliverables, and what it costs.