GDPR for websites 2026: what it must include and what you risk if you're not compliant
In this guide (8)
The GDPR has been in force since 2018. In 2026, many Italian websites are still not compliant — and site owners don't even know it.
Not because they're negligent, but because GDPR compliance for a website doesn't end with the cookie banner. There are precise technical obligations regarding how data is collected, stored and protected — obligations that most web agencies don't implement correctly because it isn't their core business.
This guide explains what a website must concretely have to be GDPR compliant in 2026, what the real penalties are that the Garante has already imposed, and how to check your site's situation today.
What GDPR means for a website
GDPR — General Data Protection Regulation, EU Regulation 2016/679 — applies to any website that collects personal data from European users. A website collects personal data in almost every case: when a visitor fills out a contact form, when they accept analytics cookies, when they sign up for a newsletter, when they purchase a product.
The data controller — i.e. the company or professional that owns the site — is responsible for ensuring that this data is collected, stored and processed in compliance with GDPR. This responsibility is not transferred to the web agency that built the site, even if it was the agency that configured the forms and cookies. In the event of a violation, the penalties fall on the controller.
GDPR compliance for a website has three levels, all of which must be present:
The informational level — up-to-date privacy policy and cookie policy, specific notices for each type of processing. The consent level — collecting consent in the correct form for each type of processing. The technical level — adequate security measures to protect the data collected.
Most Italian websites have the first level partially in place, the second often poorly implemented, and the third almost never properly addressed.
Cookie banner: what it really needs to do
The cookie banner is the most visible element of GDPR compliance — and also the one most often implemented incorrectly.
What is NOT enough
A banner that says "This site uses cookies. By continuing to browse you accept the use of cookies" is not compliant. Scrolling the page is not consent. Continuing to browse is not consent. An "Accept" button without an equivalent "Reject" button is not free consent.
These implementations were already non-compliant back in 2018 — the Italian Data Protection Authority has explicitly sanctioned them on several occasions.
What GDPR actually requires
The cookie banner must allow the user to express granular consent by cookie category: necessary technical cookies (no consent required), analytics cookies, and profiling/marketing cookies. Rejection must be just as accessible as acceptance — the same number of clicks. The user must be able to change their preferences at any time from the same interface. Consent must be recorded and documentable — date, policy version, choices made.
The Italian Data Protection Authority's 2021 guidelines and subsequent rulings have clarified that the "cookie wall" — blocking access to the site for those who do not accept cookies — is lawful only when a paid or equivalent access alternative is available.
If you're completely unfamiliar with this topic, you can always ask us for a consultation
The third-party cookies many forget about
Google Analytics, Meta Pixel, Microsoft Clarity, LinkedIn Insight Tag — all these tools install third-party cookies that require the user's explicit consent before being loaded. The banner must block these scripts until consent is obtained, not simply inform users of their presence.
A site with Google Analytics active before the user accepts analytics cookies is not compliant — regardless of the quality of the privacy policy.
Privacy policy: what it must contain
The privacy policy is not a standard document downloaded from the internet and placed in the footer. It must specifically describe the processing carried out by that site, with the information required by Art. 13 GDPR.
The mandatory elements
The identity and contact details of the data controller — not just the company name but also specific contact details for privacy requests. The purpose and legal basis of each processing activity — why the data is collected and what the legal basis is (consent, contract, legitimate interest). The recipients of the data — who receives the data besides the controller: the web agency, email marketing providers, Google, Meta. The retention periods — how long data from each category is kept. The rights of the data subject — access, rectification, erasure, portability, objection — and how to exercise them in practice. The right to lodge a complaint with the Data Protection Authority.
The updates many forget
The privacy policy must be updated every time a processing activity changes — when a new analytics tool is added, when a newsletter is started, when a CRM is integrated. A privacy policy that describes processing activities no longer carried out, or fails to describe active ones, is not compliant.
Contact forms and data collection
Every form on the site that collects personal data is a processing point that requires specific management.
The contact form
The contact form must include a link to the privacy notice specific to that processing activity — not just a generic link to the privacy policy. If it collects special categories of data — descriptions of legal, health or financial issues — it requires separate explicit consent for that category of data. Data submitted through the form must be stored securely in the database, not in plain text.
The newsletter form
Signing up for the newsletter requires explicit and documented consent. Double opt-in — confirmation via email — is not legally mandatory but is strongly recommended because it provides proof of consent. The consent checkbox cannot be pre-selected. Consent to the newsletter cannot be made a condition for accessing a service.
The e-commerce form
Checkout collects billing, shipping and payment data. It requires specific privacy notices for each processing activity, separate consent for any marketing communications, and adequate technical measures to protect payment data.
The technical obligations nobody tells you about
This is the part that most web agencies don't implement — and that the Italian Data Protection Authority (Garante) considers in its investigations.
Encryption of data at rest
Art. 32 GDPR requires adequate technical measures to protect personal data. For data collected through web forms, the main technical measure is encryption at rest: data must be encrypted even when stored in the database, not just during HTTPS transmission.
Most WordPress sites store contact form data in plain text in the database. Anyone with access to the database — an external developer, an unprotected backup, an attacker who has compromised the server — can read all messages received from customers. This alone is already a non-compliance with Art. 32 GDPR.
Access control
Who has access to the personal data collected by the site? Does the web agency managing the server have access to the database containing form data? Do the developers working on the site have access to production data? The GDPR requires that access to personal data be limited to people who actually need it — the principle of access minimization.
Logs and traceability
In the event of a data breach, the controller must be able to reconstruct what happened, when, and what data was exposed. This requires logs of access to the system and to the data. A site without adequate logging cannot demonstrate compliance in the event of an incident.
The Data Processor Agreement
Every party that processes data on behalf of the controller — the hosting provider, the web agency, the email marketing provider — must have signed a DPA (Data Processing Agreement). Without this agreement, the transfer of data to these parties is not GDPR compliant.
DPIA for high-risk processing
For certain types of processing — health data, judicial data, large-scale profiling — the GDPR requires a Data Protection Impact Assessment (DPIA) before processing begins. The DPIA must document the risks of the processing and the measures adopted to mitigate them. A website for a law firm or a private clinic that collects descriptions of legal or health issues through forms falls into this category.
The Garante's real fines
GDPR fines are not theoretical. The Italian Data Protection Authority has issued concrete fines to companies of all sizes — not just large corporations.
The most frequent fines concern non-compliant cookie banners — the Garante has fined dozens of Italian websites for banners that did not allow rejection as easily as acceptance. Typical amounts for SMEs: from €5,000 to €50,000.
Fines for unreported data breaches are more severe — the GDPR requires notification to the Garante within 72 hours of discovering a breach that poses a risk to the rights of data subjects. Failure to notify can double the fine.
The maximum fines provided for by the GDPR are up to €20 million or 4% of global annual turnover — whichever is higher. For Italian SMEs, the actual fine is proportionate but can still be significant relative to turnover.
The Garante can also order the suspension of processing — in practice, blocking the site until non-compliance issues are resolved. This is the most immediate operational risk, regardless of the amount of the fine.
How to check your site today
These are checks you can carry out on your own in 30 minutes to get an initial assessment of the situation.
Cookie banner check
Open the site in incognito mode. Does the banner appear before third-party scripts are loaded? Is there a visible "Reject" button without having to open advanced settings? Are analytics cookies loaded only after consent? Check with the browser's developer tools — Network tab — whether Google Analytics or other scripts are loaded before consent is given.
Privacy policy check
Does the privacy policy specifically list all the analytics tools used on the site? Does it state retention periods for each category of data? Does it specify how to exercise your rights? Has it been updated in the last 12 months?
Basic technical check
Does the site use HTTPS on all pages? Do forms submit data via HTTPS? Is there a signed DPA with the hosting provider? Does the web agency have access to the production database? If so, has a DPA been signed?
The limits of self-diagnosis
These checks identify the most obvious non-compliances. Technical non-compliances — data encryption in the database, log management, adequacy of security measures under Art. 32 — require specific technical verification that goes beyond what can be done manually. For law firm and professional websites that handle sensitive data, the specific technical requirements are covered in depth here.
GDPR and NIS2: what changes in 2026
Since 2024, the NIS2 directive has been in force, transposed in Italy through Legislative Decree 138/2024. For certain categories of organizations — including healthcare facilities, medium-sized companies in critical sectors, and digital service providers — NIS2 adds cybersecurity obligations that overlap with and reinforce those of the GDPR.
The most relevant practical difference for websites is the incident notification timeframe: the GDPR requires notification to the Data Protection Authority within 72 hours, while NIS2 requires a preliminary notification to the ACN (National Cybersecurity Agency) within 24 hours. For entities falling within the NIS2 scope, this requires more structured and documented incident response processes.
If your organization falls within the NIS2 scope, website compliance must also be assessed against NIS2 requirements — not just the GDPR. The technical measures required by NIS2 are generally stricter than those of the GDPR and require more detailed documentation.
If you want to find out concretely whether your site complies with the GDPR and current regulations — cookie banner, privacy policy, technical measures, DPA — you can request a free audit. We analyze the current situation and tell you exactly what's missing and how to fix it.
