Why it shows up in your week
For website operators, GDPR shows up in live systems: analytics tags, forms, CRMs, chat widgets, and cloud processors. A privacy policy alone does not prove compliance.
In plain language
If your site loads marketing or analytics tools, you usually need prior consent and a clear reject option that is as easy as accept.
Every vendor that processes personal data for you needs a Data Processing Agreement (AVV in German) before the data leaves your control.
People can ask for a copy of their data or ask you to delete it. You need a workflow that answers within the legal deadline.
Facts worth keeping
Last reviewed
- Type
- EU / EEA personal-data regulation
- Also known as
- DSGVO (Datenschutz-Grundverordnung)
- In force
- 25 May 2018
- Website duties
- Lawful basis, consent before non-essential tags, DPAs, DSAR workflow
- Related DE rule
- TTDSG for storing/accessing information on end devices
- Sibling terms
- DSAR (access request), DPA / AVV (processor contract)
Not the same as
- A privacy policy PDF aloneThe policy describes intent. GDPR asks what the live site, tags, and processors actually do.
- Cookie banner theatreA banner is not compliance if analytics still fire before consent or reject is harder than accept.
- US state privacy lawsCCPA/CPRA and similar rules are separate regimes. EU traffic still triggers GDPR duties.
Where it bites
GDPR bites when a complaint or authority asks what your site actually sends. Teams feel it when a cookie banner is installed while Google Analytics still loads on first visit.
What to check
- Do non-essential tags stay silent until the user accepts?
- Is every analytics, CRM, chat, and form processor listed with a signed DPA?
- Can someone submit an access or deletion request and get a real response path?
Common questions
Does GDPR apply to US companies?
Yes, when you offer goods or services to people in the EU or monitor their behaviour (for example analytics on EU visitors). Location of the company HQ does not remove the duty for that traffic.
Is a cookie banner enough for GDPR?
No. The banner only helps when non-essential tags stay blocked until accept, reject is equally easy, and the privacy policy plus processor contracts match what the site does.
What is the difference between GDPR and DSGVO?
They are the same regulation. GDPR is the English name. DSGVO is the German name (Datenschutz-Grundverordnung). German sites also follow related national rules such as the TTDSG for terminal storage and access.