Without a privacy notice, your website lacks the document in which you explain which personal data you collect, why, and how long you keep it. GDPR requires organizations to inform visitors and customers about this in advance; this is called the transparency requirement. If this information is missing, you cannot demonstrate that you comply with this obligation.
What actually happens depends on who notices it. A visitor can file a complaint with the Dutch Data Protection Authority, a business customer can ask about it during a procurement process, and a payment provider or advertising platform can refuse to link to your website as long as there is no privacy notice. None of these situations are hypothetical; they stem from conditions that third parties themselves already impose, regardless of what a regulator might do.
Why a privacy notice is more than a formality
A privacy notice is visible proof of something you should know anyway: which data your website collects, through which forms, cookies or analytics tools, and for what purpose. If the notice is missing, there is a good chance that the inventory itself has not been made either. This affects not only the website, but also the broader picture of how your company handles personal data — something that also comes to light whenever you seek an answer to a specific GDPR question.
The EDPB and the Dutch Data Protection Authority have published guidelines on what a privacy notice must contain at minimum, such as the contact details of the controller, retention periods and the rights of data subjects. These guidelines are not law, but regulators do apply them when assessing whether the transparency requirement is met.
What actually happens in practice if the notice is missing
The most direct consequences rarely occur with a regulator, but with the parties you do business with. An insurer reviewing a cyber policy often asks for the privacy notice as part of the file. A contracting authority can do the same. And a visitor wondering what happens to a completed contact form may, in the absence of an explanation, decide not to do business with you, or file a complaint.
Moreover, a missing privacy notice is often a signal that other elements are also not in order: no overview of which SaaS tools process personal data, no data processing agreements with suppliers, no documented retention periods. This is exactly the kind of interconnection that a knowledge base with explanations for each GDPR topic makes clear: the privacy notice rarely stands alone.
The role of the regulator
The Dutch Data Protection Authority can take action when the transparency requirement is not met, but how and when this happens depends on the circumstances of the case and cannot be predicted in advance. What is certain is that the absence of a privacy notice is not an omission that becomes less visible as a website attracts more visitors — quite the opposite.
Whether a complaint actually leads to an investigation and what the outcome would be cannot be said in general terms. For the assessment of a specific situation, a lawyer or the Dutch Data Protection Authority itself is the appropriate point of contact.
How you fix this
Drawing up a privacy statement requires a clear overview of what your website actually collects: contact forms, cookies, an online shop with order data, a newsletter. Once that overview is in place, the statement itself is usually quick to write. For the underlying question of what data you actually process and through which tools, it helps to look at the way that overview is built up, for example through the how data and systems are mapped out.
A privacy statement is moreover not a one-time text. New forms, new tools or a new newsletter service change what is collected, and therefore also what must be stated in the statement. Those who want to keep that overview in step with changes to the website can record this in a business account so that it does not remain a one-off action.
Gdpria.eu offers the privacy statement generator free of charge, just like the knowledge base and the other basic checks. If you want to know where your business currently stands, the free quick-scan is a good starting point to see which components are already in order and which need attention.