What documents do you need for a new website or webshop?
A new website or webshop requires a standard set of documents: a privacy notice, a cookie policy if tracking cookies are placed, and a data processor agreement with each party that processes personal data on your behalf. The last item is often the most questioned at this purchase moment, because a new website rarely comes with just one processor, but usually four or five at the same time.
Think of the hosting provider, the company behind your analytics tool, the email service for newsletters, the payment provider for a webshop, and possibly a chatbot or booking system. Any party that processes visitor or customer data on your servers or in your name should in principle have a data processor agreement in place. So the question is not "which document do I need", but "with whom do I need to make agreements, and has that party already arranged it".
Why this purchase moment involves multiple agreements at once
With other occasions, such as a customer sending you an agreement, it usually concerns one relationship that you assess. With a new website it is the opposite: you are the one choosing the tools, and choosing a tool often automatically comes with a standard agreement that the supplier has ready. Many well-known SaaS tools, from hosting providers to analytics services, offer such an agreement digitally, often via a link in the customer portal. The challenge is not in finding those documents, but in keeping track: which tool have you added, is the agreement already there, and is the text still current. A library of known tools with the agreement status listed helps with this, so you do not have to figure out what is going on with each supplier separately. worked out per situation what GDPR requires of you
The privacy notice and cookie policy
In addition, a privacy notice should be posted on the website explaining which data are collected, for what purpose, and how long they are kept. For a webshop, this is accompanied by the cookie policy, especially if cookies are placed for advertising or analytics before the visitor has given permission for this. The rules around cookies are not only in GDPR but also touch on other legislation about electronic communications; the precise implementation varies by situation, so for cases of doubt the supervisory authority or a lawyer is the right point of contact.
What this means for your processing activities record
Every new tool you link to the website should also be reflected in your processing activities record: what data the tool processes, for what purpose, and where the data physically reside. For a webshop there is often an additional layer, because payment data and order history follow a different retention path than, for example, newsletter subscriptions. If you maintain the record manually, you risk a new tool being added but the associated agreement not, or vice versa. A record that automatically grows with the tools you actually use prevents that gap.
Security as part of the assessment
Alongside the paperwork side, there is also the technical side when launching a new website: where the data reside, who has access, and whether the connection is secure. This is not a separate document, but something that should be reflected in your data processor agreement and in your own assessments. how security and privacy are connected in practice
Uncertainty about a specific tool or clause
Some suppliers work with standard agreements that do not fully align with the situation of a small business, or that refer to transfers outside the EU without making that immediately clear. If you have doubts about a specific clause, it is advisable to have it reviewed by a lawyer, or to submit the question to the Dutch Data Protection Authority. Frequently asked questions about cookies, consent, and the role of third parties on a website can also be found in the overview of frequently asked questions. answers to frequently asked questions
Keep overview without having to figure out everything yourself
The core of this purchase moment is therefore not a single document, but a set that grows with the tools you choose: privacy statement, cookie policy where applicable, a data processing agreement per relevant supplier, and the update of the processing register. Anyone who figures that out per tool separately will quickly spend several hours comparing standard texts. A system that links the library of known tools to the register and monitors the agreements takes most of that research work off your hands.
Would you like to see how that looks for your own website or web shop? Do the free quick-scan or browse through the knowledge base to see which documents belong to your situation, and then set up a business account if desired to let the register grow with you. start a business account