Introduction
GDPR compliance for a website is a system of controls—not a single document or plugin. You need lawful processing, transparent notices, meaningful consent for cookies, enforcement that matches your banner, vendor contracts, and proof you maintain the program over time.
This checklist walks from discovery to ongoing monitoring. Use it when launching a new site, onboarding a marketing stack, or preparing for a customer security questionnaire. Items apply to most EU and UK-facing marketing and ecommerce properties.
Work through sections in order where possible: you cannot write an accurate cookie policy before you know which tags fire, and you should not publish a banner before blocking is wired.
What it means
Discovery: inventory pages, forms, embeds, GTM containers, plugins, and third-party scripts. Record which process personal data and whether each is necessary or consent-gated.
Lawful bases: assign consent for analytics and ads; document legitimate interests assessments where used sparingly. Align bases with banner categories.
Policies: publish privacy and cookie policies linked from the footer. Ensure controller contacts, rights, retention, transfers, and cookie tables match reality.
Consent UI: deploy first-layer Accept all and Reject all with equal prominence, granular preferences, persistent settings link, and accessible design.
Technical enforcement: load blocking or Consent Mode defaults before GTM; gate tags on consent; verify no pre-consent requests to ad and analytics domains.
Google stack: implement Consent Mode v2 parameters; map categories to analytics_storage, ad_storage, ad_user_data, and ad_personalization.
Vendor management: execute DPAs with processors; maintain subprocessor lists; restrict data sharing to what policies disclose.
Operations: define data subject request handling, breach notification playbooks, and scheduled rescans after deploys.
Why it matters
Checklists prevent predictable failures—especially pre-consent GA4 and missing reject paths—that appear in virtually every NGO scanner publication.
Buyers and insurers increasingly ask for evidence beyond policies. A completed checklist with scan timestamps demonstrates accountability under GDPR Article 5(2).
Marketing velocity destroys static compliance. A checklist embedded in your release process catches tag changes before they reach production unnoticed.
Common mistakes
- Treating compliance as legal-only without engineering verification.
- Checking production once and never after GTM updates.
- Policies updated but banner categories unchanged.
- Scanning only the homepage while campaigns use dedicated landers.
- Ignoring staging environments that leak tags to crawlers.
- No owner for consent logs or DSAR inbox.
- Assuming WordPress plugin green badges replace live testing.
Practical checklist
- Complete data and tag inventory across environments.
- Publish privacy and cookie policies with accurate vendor lists.
- Deploy banner with Accept all and Reject all equally visible.
- Install runtime guard before marketing tags in site template.
- Configure Consent Mode v2 denied defaults and updates.
- Block non-essential cookies until opt-in; test in private window.
- Sign DPAs with email, analytics, ads, and hosting vendors.
- Document DSAR process and assign responsible contact.
- Run external compliance scan; fix findings; rescan after changes.
- Schedule quarterly reviews and post-deploy automatic scans.
How GDPRChecker helps
GDPRChecker operationalizes much of this checklist: public scanner for discovery, dashboard setup wizard for install and banner milestones, tracker blocking for enforcement, and runtime heartbeat for ongoing proof.
Compliance score and report break down controls—consent banner active, cookie blocking, privacy policy found, monitoring, consent records—so you see which checklist items pass on the live site.
Managed sites receive continuous verification that your published CMP and guard script still load first after CMS edits, turning the checklist from a spreadsheet into monitored status.