Key points
- The GDPR (Regulation (EU) 2016/679) is the legal framework for data protection, supplemented by the ePrivacy Directive on cookies.
- Article 6 lists the lawful bases for processing: consent, contract, legal obligation, vital interests, public task or legitimate interest.
- Articles 12 to 14 require concise and accessible information, in practice through a clear privacy policy; the legal notice, for its part, falls under the LCEN (French Digital Economy Act).
- Consent to cookies (Article 82 of the French Data Protection Act, loi Informatique et Libertés) must be freely given, specific, informed and unambiguous (Article 4(11) of the GDPR), and withdrawing it must be as easy as giving it (Article 7(3)).
- Article 32 requires security measures appropriate to the risk, such as pseudonymisation and encryption; HTTPS and restricted access are common applications.
- If you have doubts about a website’s compliance, consulting a data protection lawyer makes it possible to assess the measures in place.
Protecting your users’ personal data is not just an obligation, it is a commitment. Every day, businesses try to understand how to apply the GDPR correctly without complexity. You have probably felt this concern when faced with legal requirements and technical terms. You want clear answers, concrete steps and accessible explanations. Here you will find what you need: precise guidance on lawful bases, consent management and data security. No needless jargon, only practical information to help bring your website into compliance. Your objective: comply with the law and reassure your users. Our mission: to guide you simply through this process.
The legal foundations of the GDPR
The GDPR, or Regulation (EU) 2016/679, is the basic legal framework for the protection of personal data in the European Union. In particular, it requires every processing operation to rest on a lawful basis: users’ consent is only one of six. This Regulation is supplemented by the ePrivacy Directive (2002/58/EC), transposed in France in Article 82 of the French Data Protection Act (loi Informatique et Libertés), which more specifically covers electronic communications and the use of cookies and trackers.
Article 6 of the GDPR lists the lawful bases for processing data, including consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a task carried out in the public interest or a legitimate interest pursued by the controller. A website must therefore make sure that each data processing operation meets at least one of these conditions.
Transparency and information tools
Transparency and information are pillars of the GDPR. Articles 12 to 14 provide that the information given to users must be concise, transparent, intelligible and easily accessible, using clear and plain language. This includes in particular the privacy policy, which must detail the types of data collected, the purposes of processing, the recipients of the data and the rights of data subjects.
A website’s legal notice must clearly state the identity of the website publisher, such as the company name, registered office address and contact details. This information tells users who publishes the website; the identity and contact details of the controller, for their part, appear in the privacy policy (Article 13 of the GDPR).
To go further, HASHTAG Avocats offers tailored support to bring your privacy policy into compliance.
What to check in the privacy policy
- Types of data collected.
- Purposes of the data processing.
- Recipients of the data (internal or external).
- Users’ rights (access, rectification, erasure, objection, portability).
- Data retention period.
Managing user consent
Under Article 4(11) of the GDPR, consent must be freely given, specific, informed and unambiguous. For cookies and trackers, Article 82 of the French Data Protection Act requires this prior consent, except for strictly necessary trackers; in practice, this takes the form of a cookie banner informing users of their use and offering an active option to accept or refuse these cookies.
You should check that data collection forms include tick boxes that are not pre-ticked, so that users can give their consent explicitly. Consent must also be as easy to withdraw as to give (Article 7(3) of the GDPR).
Data security
Data security is another key aspect of GDPR compliance. Under Article 32, websites must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by the processing. In case of doubt, it is necessary to consult a GDPR lawyer to assess the measures in place.
These measures may include the use of HTTPS protocols to encrypt communications between the user’s browser and the server, as well as practices such as anonymisation and pseudonymisation of data.
Common security measures
- Use of HTTPS and SSL certificates.
- Anonymisation and pseudonymisation of sensitive data.
- Restricted access to data (strong authentication and role management).
- Regular security testing and system audits.
Privacy charter and legal notice
In addition to the privacy policy, a privacy charter may specify how a business processes data specific to certain interactions or services. This charter should be easily accessible and detailed to strengthen users’ trust.
The legal notice must also meet specific requirements set by French legislation, in particular the French Digital Economy Act (loi pour la confiance dans l’économie numérique, LCEN). It must in particular state the identity of the publisher, the publication director and the name, address and telephone number of the hosting provider (Article 1-1 of the LCEN). General terms of use, while useful, are not part of these mandatory notices.
A compliant website also requires proper organisation: a record of processing activities, information for data subjects and, in some cases, a DPO (data protection officer). Our article on the mandatory DPO explains when an appointment is required. An outsourced DPO can provide this follow-up over time.
Data audit and ongoing compliance
A data audit is essential to check regularly that data processing remains compliant with the GDPR. This involves keeping the record of processing activities up to date in accordance with Article 30, which must contain detailed information on all the data processing activities carried out by the website.
An audit also helps identify any security flaws or non-compliance and correct them quickly. We recommend carrying out these audits periodically and thoroughly, ideally with the assistance of a DPO (data protection officer).
FAQs on website GDPR compliance
What are the signs that a website is GDPR compliant?
What penalties does a non-compliant website face under the GDPR?
What documents are needed to prove GDPR compliance?
How do you carry out a GDPR compliance audit of a website?
- Review of processing policies and legal documents.
- Assessment of data collection and consent practices.
- Verification of the security measures applied.
- Analysis and updating of the records of processing.
- Staff training and awareness of good practice.
