GDPR and cookies on a small website: a practical checklist

The two documents behind the rules

The GDPR (Regulation (EU) 2016/679) has applied since 25 May 2018 and governs the processing of personal data: who collects it, why, how long it is kept and what rights the person has.

The cookie rule comes from a different act — the Directive on privacy and electronic communications (2002/58/EC, known as the ePrivacy Directive), Article 5(3). Under it, storing or reading information on a user’s device requires consent, unless it is strictly necessary for a service the user has explicitly requested.

In Bulgaria the supervisory authority for personal data is the Commission for Personal Data Protection (КЗЛД). Its website has guidance and templates worth reviewing.

Step 1: an inventory of everything the site loads

You cannot describe in a policy something you do not know about. Open the site in a browser with the developer tools (F12) and look at the cookies section and the network requests. Make a table:

• Analytics — Google Analytics, Matomo and similar.
• Embedded maps and video — Google Maps, YouTube, Vimeo. They often set cookies as soon as the page loads.
• Chat widgets and social media buttons.
• Fonts and scripts from third-party servers — loading them sends the visitor’s IP address to third parties.
• Advertising and remarketing — pixels and ad networks.
• Your own cookies — login, cart, language.

For each row note: who the provider is, what it is for, what data goes to it and how long it is kept.

Step 2: consent before non-essential cookies

Strictly necessary cookies (for login, the cart, remembering the cookie choice) do not require consent. Everything else — analytics, advertising, most embedded services — must load only after the person agrees.

• The “Reject” button must be as easy as “Accept” — at the same level, not hidden in settings.
• No pre-ticked boxes.
• Consent is given separately for each purpose (analytics, advertising).
• Refusing should not block access to the content of an ordinary information site.
• People must be able to change their choice easily later.
• Test it in practice: after rejecting, the network requests should show no analytics or ad scripts.

Maps and videos can be replaced with a static image and a “Load map” button that loads the service only on click.

Step 3: a privacy policy that tells the truth

The policy should be written in plain language and match what the site actually does. The minimum content:

• Who the controller is: company name, registration number, address, contact email.
• What data you collect and where from (form, cookies, orders).
• For what purpose and on what legal basis.
• How long you keep it.
• Who you pass it to (hosting, email service, analytics) and whether it leaves the EU.
• What rights people have and how to exercise them.
• The right to complain to the supervisory authority (КЗЛД).
• A list of cookies with provider, purpose and duration.

Step 4: contact forms

• Ask only for what you need: for a reply, a name, email and message are usually enough. Phone and address only if you really need them.
• Below the form, briefly say what you will use the data for and link to the policy.
• Set a retention period, for example deleting enquiries that did not become clients after a set time.
• If you want to send a newsletter, ask for separate, explicit consent — do not bundle it with sending an enquiry.
• The site must run over HTTPS so that data is transmitted encrypted.

Step 5: processors, requests and breaches

Your hosting, email service, CRM system and analytics are usually processors — they hold data on your behalf. You need a data processing agreement with them; with large providers it is often part of the terms of service and can be accepted from your account.

People have the right to request access to their data, correction or deletion. Prepare a simple routine: who watches the inbox, where the data is searched and how replies are given. As a rule, the reply is due within one month.

In the event of a security breach — a leaked database, a hacked account — the GDPR requires notifying the supervisory authority within 72 hours where there is a risk to people. Write down in advance what you will do, so you are not searching for information in a panic.

Security is closely tied to data protection. See also backups and hosting basics.

A short checklist

1. I have listed all cookies and external services on the site.
2. Non-essential cookies load only after consent.
3. “Reject” is as easy as “Accept”.
4. The privacy policy matches reality and is easy to find.
5. Forms ask only for necessary data and have a retention period.
6. I have agreements with my processors.
7. I know how to answer a request and what to do in a breach.
8. I review everything again whenever I add a new service or ads.

If you are building a new website, it is easiest to plan for these things from the start. You can get in touch with us if you would like to discuss them for your project.