GDPR and your website: what companies in Germany must observe in 2026
The GDPR sets clear requirements for company websites. I explain what is mandatory and how to be on the safe side legally.
A GDPR-compliant website: what is really mandatory in 2026?
The GDPR has applied since 2018. In 2026 fines have risen noticeably because authorities are more active, and many small companies are still not compliant. This article shows what you need to implement in concrete terms, with a focus on German law.
The basic obligations for every website
1. Legal notice (Impressum, § 5 DDG)
Every commercial website in Germany needs a complete legal notice. Mandatory details:
Common mistake: the legal notice is hard to find. It must be reachable in at most two clicks.
2. Privacy policy
The privacy policy is the heart of GDPR compliance. It must explain:
3. Cookie banner (TDDDG)
Since the TTDSG (2021), today the TDDDG, cookies that are not technically necessary may only be set after explicit consent. A banner that only offers “Accept” is not enough.
Compliant means:
4. Contact forms
Contact forms process personal data. You need:
What Google Analytics means
Google Analytics transfers data to the USA. After the CJEU ruling (Schrems II) and the new Data Privacy Framework, Google Analytics 4 can be used legally again under certain conditions, but only with:
Recommendation: switch to a GDPR-native alternative such as Plausible or Matomo (self-hosted).
Fines: what is the real risk?
Supervisory authorities increasingly fine small companies too. Typical fines for SMEs:
How I implement data protection on websites
Data protection is considered from the start of every project. Typical measures:
No legal advice: this article gives technical and organisational guidance. For individual legal advice, contact a data protection officer or a lawyer.