The short answer
Yes, the GDPR applies to your new website or webshop as soon as personal data flows through it. This happens faster than many entrepreneurs think: a contact form, an order with name and address, a cookie banner for analytics, or a chat window that requests an email address — they are all processing of personal data. The size of your business or the number of visitors plays no role in this.
What does differ is the scope of what is asked of you. An informational website with only an address and telephone number requires little. A webshop with customer accounts, payment details, delivery addresses and a newsletter requires more: multiple parties are involved who process data on your behalf, and this requires agreements.
When does this affect you concretely
The GDPR comes into play the moment your website or webshop does something with data that can be traced to a person. Think of a contact form that stores name and email address, an analytics tool that tracks visitor behaviour, an advertising pixel from a third party, a customer login account, or a checkout process where address and payment details are recorded and sent to a parcel service or payment provider.
Each of these components means there is a party processing the data on your behalf: your hosting provider, your webshop platform, your analytics provider, your email marketing tool. In most cases, a data processing agreement should exist for these parties. How you assess that agreement and what to look out for is detailed in the knowledge base with guidance for each situation.
When does this affect you less
A purely informational website without forms, without tracking cookies and without third parties monitoring, processes little to no personal data. In that case, the impact of the GDPR is limited. But in practice, this is rare: most sites have at least a contact form or an analytics script, and both count as processing.
So it is not a question of 'does this affect me or not', but 'to what extent'. A simple brochure website requires a brief privacy notice and a look at the tools used. A webshop with customer accounts and multiple suppliers requires a more complete picture: which tool processes what, who is a processor, and which data is stored where.
What this means in practice
When you build a new website or webshop, three questions usually arise at the same time. First: which tools and suppliers will process data on your behalf, and do you have a data processing agreement with each of them? Second: is there a privacy notice on the site that explains what you do and why? Third: is this new processing recorded in your records of processing activities, so you can demonstrate at any time what is happening?
These three questions should not be answered separately. A webshop platform, a payment provider and a shipping partner are often all three processors, and each should be given a place in the register. If something goes wrong along the way — for example because a supplier sends data insecurely — that is a moment to quickly assess what happened and whether this is reportable. A first indication of this is provided by with a few questions that immediately point a direction.
How this relates to existing obligations
A new website or webshop is usually not a separate GDPR obligation, but an extension of what already applied. If your business already processes employee data or already collects customer data, the website comes on top of that: new processors, new data flows, and therefore an addition to the register and existing processor agreements. The GDPR itself and the guidelines of the EDPB and the Dutch Data Protection Authority form the starting point; how that information is structured on this platform and where the source of each component is located, you can read about the explanation of how the information is structured.
Whether your specific website or webshop fully complies with the GDPR is something you can best discuss with a lawyer or, if you have doubts about a specific processing activity, with the Dutch Data Protection Authority. This article provides guidance, not legal advice.
Check yourself where you stand
Would you like to quickly see which components belong to your new website or webshop — which tools, which processors, which documents? Take the free quick-scan or browse through the topics in the knowledge base. If you want to track this structurally once the register and monitoring are in place, you can creating a business account and continue from where you are now.