How to Check if Your Website is GDPR Compliant — Practical Guide 2026

By Tibzi Team — 2026-03-03T14:47:19.158Z

The GDPR (General Data Protection Regulation) applies to any website that collects personal data from people in the EU, and that means almost every website with a contact form, analytics or cookies. This practical guide walks you through checking and securing your website's compliance, step by step.

What counts as "personal data" on a website

Many people think the GDPR only applies if you collect "sensitive data." In reality, the GDPR defines personal data very broadly:

Obviously personal: name, email, phone number, address (contact forms, orders)
Online identifiers: IP address, cookie IDs, device fingerprint (collected automatically)
Behavioral data: pages visited, time on site, clicks (Google Analytics, Hotjar)
Transaction data: order history, products viewed (online stores)

Bottom line: If your website uses Google Analytics, the Facebook Pixel, a contact form, a newsletter or third-party cookies, you are collecting personal data and you must comply with the GDPR.

GDPR checklist for websites

1. Privacy policy

It must be reachable from every page (usually from the footer) and must include:

The controller's identity: who you are (company name, tax ID, address, contact details)
Types of data collected: what data you process and where you get it from
Purposes of processing: why you collect each type of data
Legal basis: the grounds on which you process it (consent, contract, legitimate interest, legal obligation)
Data subjects' rights: access, rectification, erasure, portability, objection, withdrawal of consent
Retention period: how long you keep the data
Recipients: who you share the data with (processors, partners, authorities)
International transfers: whether the data leaves the EU/EEA
DPO contact details: if you have appointed a data protection officer
Right to lodge a complaint: a statement that people can file a complaint with ANSPDCP (Romania's data protection authority)

2. Cookie consent

The ePrivacy Directive (transposed in Romania by Law 506/2004) requires:

A visible banner on the first visit, with no non-essential cookies active by default
Clear options: accept, reject, customize. An "Accept all" button on its own is NOT enough
Granularity: users must be able to choose by category (essential, statistics, marketing)
Cookies blocked until consent is given: Google Analytics, the Facebook Pixel and similar tools must NOT load before the user clicks Accept
Easy withdrawal: users must be able to change their choice at any time
Consent records: you must be able to prove that you obtained consent

3. Forms and consent

A required checkbox: every form that collects data needs a consent checkbox (unchecked by default)
Newsletter: double opt-in: send a confirmation email before adding anyone to your subscriber list
Specific purposes: don't bundle consent for the newsletter with consent for third-party marketing

4. Company details and legal information

Law 365/2002 on e-commerce (Romania's e-commerce law) requires you to display:

The company's full legal name
The CUI (the company's unique registration code, i.e. its Romanian tax ID)
The Trade Register registration number
The registered office address
Contact details (email is mandatory, a phone number is recommended)

Penalties for non-compliance: fines from 5,000 to 100,000 RON (under Law 365/2002).

5. ANPC and SAL (for e-commerce)

If you sell products or services online, legal compliance is critical. You can quickly check every element with an audit tailored to online stores.

Mandatory elements:

ANPC link: a working link to anpc.ro (ANPC is Romania's consumer protection authority)
SAL pictogram: ANPC's alternative dispute resolution pictogram, on the home page, linking to the ANPC platform: reclamatiisal.anpc.ro (ANPC Order 270/2026). The ODR link is no longer required: the European platform was shut down on July 20, 2025.
Right of withdrawal: 14 days under OUG 34/2014 (Romania's consumer-rights ordinance, GEO 34/2014)
Prices including VAT: displayed prices must include VAT

6. User rights (GDPR Art. 15-22)

You must be able to honor user requests:

Right of access: users can ask for a copy of all their data
Right to rectification: they can ask for incorrect data to be corrected
Right to erasure (to be forgotten): they can ask for their data to be deleted, with certain exceptions
Right to data portability: they can ask for their data in a structured format (CSV, JSON)
Right to object: they can refuse processing based on legitimate interest

Response deadline: 30 days from receiving the request.

What you risk if you're not compliant

GDPR fines

Less serious violations: up to 10 million EUR or 2% of global annual turnover
Serious violations: up to 20 million EUR or 4% of global annual turnover

Fines in Romania

ANSPDCP (the National Supervisory Authority for Personal Data Processing) has already issued significant fines in Romania. The most common reasons: failure to inform people properly, no consent for cookies, and inadequate security measures.

Other risks

Complaints from users to ANSPDCP
Lawsuits for moral and material damages
Loss of customer trust
Remediation costs that are higher than the cost of prevention

How to check automatically

Our GDPR check tool automatically analyzes:

Whether a privacy policy exists and is easy to reach
Whether a cookie consent mechanism is in place
Whether the mandatory company details are displayed
The ANPC link and the SAL pictogram
Web accessibility (WCAG 2.1)

For a full website audit (security, SEO, performance, email, legal, accessibility), run a free full audit across 27 modules.

Conclusion

GDPR compliance is not a one-time project. It's an ongoing process. Legislation evolves, your website changes, and requirements get updated. We recommend checking at least once a quarter, and always after significant changes (a redesign, new features, a new analytics provider).

Start now: check your website's GDPR compliance for free.