Anyone building a new website or webshop thinks first about design, payment methods and inventory. The GDPR side often comes later, or not at all. What actually happens then: you can't give a complete answer if a visitor asks what data you hold about him, your contracts with hosting and analytics partners are missing, and cookies may be placed before a visitor has given consent. These aren't abstract risks, but situations that occur fairly quickly in practice.
This isn't about one fine or one moment of inspection. It's about a series of gaps where the Regulation asks for something, and which only become visible once someone asks: a customer, a business partner, or the visitor himself.
The privacy notice is the visible part
A missing or incomplete privacy notice is usually the first thing that stands out, even to visitors themselves. But the notice is only the surface. Behind the scenes, the Regulation requires, among other things, that you know which parties process data on your behalf, and that you have agreements in place about it. Without those agreements, you have no visibility of what a hosting provider, an email tool or a payment service actually does with your visitors' data.
Cookies and tracking tools without consent
A webshop or website often uses analytics, advertising pixels or chat widgets that collect data as soon as the page loads. If that happens before the visitor has made a choice, it anticipates the consent that the Regulation requires for it. This is one of the points that supervisory authorities explicitly examine in general guidelines, without that saying anything about an individual situation.
No processor agreement, no overview
Every tool that processes data from your visitors or customers — a package tracking system, a newsletter tool, a review platform — is generally a processor. The Regulation requires you to have a processor agreement with them. If it's missing, you're missing not just a document, but also the overview of who holds which data where. That overview is exactly what a processing register makes visible, and it's also what a customer or contracting authority can ask about. If you want to see what such an agreement looks like in practice, you can go through the knowledge base by topic.
If something does go wrong
A webshop generally processes more data than an average website: name, address, payment details, sometimes date of birth. If something goes wrong with any of the parties processing this data, the breach notification obligation applies, along with the timeline that comes with it. Without an overview of which tools process which data, it's difficult to quickly determine whether and how to respond. A first indication of the situation you get by answering a few short questions about the situation.
Questions from visitors you can't answer
Every visitor and customer has the right to ask what data you hold about them, or to request deletion. Without a register and without clarity on which tools hold data, such a request is hard to answer completely within the timeframe the Regulation sets for it. That affects not only the relationship with that one visitor, but also the image a business partner or insurer gets of your company if they ask about it.
Where this usually pinches
In practice, it is rarely one major shortfall. It is an accumulation: a missing contract here, a cookie placed too early there, no overview of where data is actually stored. Each element on its own seems minor, but together they make it difficult to give a complete answer to a question — from a visitor, a customer, or a supervisory authority. How basic data security fits in with this is explained on the page on data security.
This text is a general description and not legal advice about your own website or webshop. For an assessment of your specific situation, you can contact a lawyer or the Dutch Data Protection Authority.
Would you like to see first where your own website or webshop currently stands? The free quick-scan provides an indication in a few minutes, without requiring you to create an account.