GDPR in plain English, for people who run a shop

On Friday the GDPR applies across Europe, and if your inbox looks like ours, forty companies you forgot existed have asked you to "stay in touch". Behind the panic is a reasonable law: know what personal data you hold, have a reason for it, tell people, and let them say no.

For a garage, a restaurant, a clinic or a shop with a website, that comes down to a short list.

What counts as personal data

Names, email addresses, phone numbers, IP addresses, the contents of your contact form, your newsletter list, your customer database, the camera at the counter. If it can point at a person, it counts.

Five things to do on your website

1. Know your forms. Every form collects data. Say what you will do with it in one plain sentence underneath: "We use this to reply to you. Nothing else." That is the whole of consent for a contact form.
2. Newsletter: opt in, not opt out. No pre-ticked boxes. No adding customers to the list because they bought once. A clear tick, a clear unsubscribe.
3. Fix the privacy page. Not a 4,000-word template copied from an American site. A page that says what you collect, why, how long you keep it, who else sees it (your email tool, your analytics, your payment provider), and how someone can ask for a copy or deletion. Written like you talk.
4. Look at your analytics and plugins. Google Analytics, Facebook pixels, chat widgets, embedded maps — each one sends visitor data somewhere. Keep what you use. Delete the rest. For what stays, anonymise where you can and mention it.
5. Use HTTPS. If your site still shows "not secure" in the browser, the form data travels in the open. This one is not a privacy nicety; it is basic.

The cookie banner question

You need one if you set cookies that are not strictly necessary — tracking, advertising, most analytics. You do not need a banner that covers the whole screen and cannot be refused. The law wants a real choice. A small bar, plain words, accept or decline, both buttons the same size. Anything cleverer than that is a sign someone is trying to get around the point.

What you do not need

A lawyer for a five-page website. A €2,000 "GDPR compliance package". Pop-ups on every page. Panic. The businesses at risk are the ones that hold data they cannot explain, not the ones with a contact form and a mailing list they run honestly.

Deadline

25 May. If you own a site we built, we have already updated the forms and the privacy pages and we will email you what changed. If we did not build it and you want a second pair of eyes, send us the address. It takes fifteen minutes to tell you where you stand.