Friday, 6:40 pm. The site is delivered, DNS has switched over, the home page loads. The client re-reads the quote and sends one last message: "And GDPR, are we good?" The question lands on the developer. A large part of the answer is in fact technical and can be settled before launch: which scripts load and when, which fields the forms collect, where the logs go, who holds an admin account. This article gathers those points into a tick-box list, phase by phase, with the legal text each item rests on. It is written for a developer or integrator delivering a site for a French or other EU client.
Disclaimer: this article is provided for information only and does not constitute legal advice. The texts cited are those in force at the time of writing; for a specific situation, consult a qualified legal professional.
Each phase points to a specific article of Regulation (EU) 2016/679 (the GDPR) or of French law.
On the practical side, the CNIL, the French data protection authority, publishes a Guide RGPD du développeur (developer's GDPR guide), organised as themed fact sheets (securing websites and servers, minimising collected data, managing users, keeping control of libraries and SDKs, testing applications, informing people, among others), open to contributions on GitHub. The phases below follow roughly that order, cut down to what an integrator can do alone in half a day.
Before talking about consent, the first step is to know what the page loads. Open the Network tab of the developer tools on three typical pages, in a private window, without touching the banner. Note every third-party domain contacted: tag manager, externally hosted fonts, interactive map, embedded video player, chat widget, CDN, advertising pixel, analytics tool. Every request to a third party transmits at least the visitor's IP address, which is an online identifier within the meaning of GDPR Article 4(1) (recital 30 names IP addresses expressly). The CNIL fact sheet "Maîtriser vos bibliothèques et vos SDK" asks the two useful questions: what data are sent through these dependencies, and to which recipients.
| Item | Where to check | Done |
|---|---|---|
| List of every third-party domain called before any click on the banner | Network tab, third-party filter, fresh browser profile | Yes / No |
| For each third party: what leaves (IP, page URL, identifier, form content) | Request headers and bodies; vendor documentation | Yes / No |
| Fonts, maps, videos: self-hosted version or click-to-load placeholder possible? | Theme sources, CMS settings | Yes / No |
| Libraries maintained and up to date (security updates) | Dependency file, package manager | Yes / No |
Output of this phase: a table of third parties, each marked "necessary for the service" or "non-essential". That table feeds phases 2 and 7.
Article 82 of the Loi Informatique et Libertés is clear about the order: information, then consent, then access to the terminal. A banner displayed while the pixel loads behind it does not follow that order. In practice, the tag manager fires no non-essential tag until the consent signal exists, and third-party embeds (video, map, chat) wait for the same signal or are replaced by a clickable image that loads nothing before the click.
Two nuances. Audience measurement may be exempt from consent if it meets the conditions described by the CNIL on its page "Cookies : solutions pour les outils de mesure d'audience": a purpose strictly limited to measuring the audience on the publisher's behalf, anonymous statistics only, no cross-referencing with other processing and no cross-site tracking, a limited tracker lifetime (thirteen months is given as an example) and data kept for twenty-five months at most. And under GDPR Article 7(3), withdrawing consent is to be as easy as giving it: a permanent link to the preference manager in the footer settles that point.
| Item | Where to check | Done |
|---|---|---|
| No cookie and no non-essential request before any interaction with the banner | Brand-new browser profile, Network and Storage tabs, no click | Yes / No |
| The "Refuse" button sits at the same level as "Accept" | Banner rendering, mobile and desktop | Yes / No |
| After refusal: still no non-essential request, across several pages | Same test, after clicking "Refuse" | Yes / No |
| Permanent link to change or withdraw the choice | Footer | Yes / No |
| Proof of consent stored (timestamp, banner version, choice made) | Consent management tool settings | Yes / No |
The test that matters is the first row, with a genuinely fresh browser profile. A profile you have used before often carries a remembered consent and skews everything.
A contact form is the site's first collection point. Article 5(1)(c) requires data limited to what is necessary; the CNIL fact sheet "Minimiser les données collectées" puts it plainly: if a piece of data is not necessary for a category of people, do not collect it. Article 13 requires the controller's identity, the purposes, the legal basis, the recipients and the retention period to be provided at the time the data are obtained: a short notice under the submit button, linking to the privacy policy, answers at that moment. Recital 32 of the GDPR states that pre-ticked boxes do not constitute consent: the "receive the newsletter" box starts unticked.
Two practices that no text imposes but that make the client's life simpler: double opt-in for the newsletter, which produces a dated record of consent that helps with Article 7(1); and an invisible honeypot field rather than a third-party captcha, which itself loads an external script and sends you back to phase 2.
| Item | Where to check | Done |
|---|---|---|
| Every mandatory field has a reason; the others are optional or removed | Form definition | Yes / No |
| Information notice under the form, linking to the policy | Form rendering | Yes / No |
| No pre-ticked box | Form rendering | Yes / No |
| Newsletter: email confirmation before subscription | Emailing tool settings | Yes / No |
| Anti-spam without a third-party script where possible | Form sources | Yes / No |
| Where submissions are stored and for how long | CMS database, form plugin, mailbox | Yes / No |
The CNIL fact sheet "Sécuriser vos sites web, vos applications et vos serveurs" asks for TLS 1.2 or 1.3 on every site, HTTPS enforced through HSTS, and the Secure and HttpOnly flags on cookies. That is the concrete form of the encryption mentioned in Article 32(1)(a). Security headers (content security policy, frame protection, content-type sniffing) fall under the same article's measures appropriate to the risk; they remain generic defensive measures, to be tuned to the site.
| Item | Where to check | Done |
|---|---|---|
| Every HTTP URL redirects to HTTPS, with and without "www" | Manual requests, Network tab | Yes / No |
| No mixed content (image, script or font loaded over HTTP) | Browser console | Yes / No |
| HSTS header present | Response headers | Yes / No |
Session cookies carry Secure, HttpOnly and a SameSite attribute | Storage tab, Set-Cookie headers | Yes / No |
| Security headers set and tested without breaking the site | Web server configuration | Yes / No |
| Automatic TLS renewal configured | Hosting provider or scheduled task | Yes / No |
Web server logs contain IP addresses, so they contain personal data. Article 5(1)(e) limits retention to what is necessary. For security logs, the CNIL indicates in its recommendation on logging measures a period of between six months and one year in the general case. Log rotation set within that range, and written down, is enough for a brochure site or a small shop.
Backups answer Article 32(1)(c) (restoring access to data after an incident), but they also have a lifespan: a backup kept forever contains the data the site has since deleted. Finally, the CNIL fact sheet "Tester vos applications" is unambiguous: real production data are not to be used in development and testing; build a fictitious dataset, and anonymise whatever you import from production. A staging site cloned from the live database and reachable without a password is one of the most frequent gaps at delivery.
| Item | Where to check | Done |
|---|---|---|
| Server log rotation set, retention period written in the hand-over document | Web server or hosting configuration | Yes / No |
| Automatic backups, restore tested once | Hosting panel, backup tool | Yes / No |
| Backup retention period defined | Same place | Yes / No |
| Staging without real data, or with anonymised data | Staging database | Yes / No |
| Staging protected (authentication, not indexed) | Direct URL access, X-Robots-Tag header | Yes / No |
The CNIL fact sheet "Gérer les utilisateurs" asks for identifiers unique to each individual, authentication before any access to personal data, strong authentication where possible, and written procedures for joiners and leavers. The fact sheet on securing websites adds a dedicated password policy for administrators, passwords changed at least whenever an administrator leaves, and access to admin interfaces limited to authorised people only. These measures fall under Article 32. The item most often forgotten at delivery: the agency's account, with the highest privileges, still active after the contract ends.
| Item | Where to check | Done |
|---|---|---|
| One named account per person; no shared "admin" account | CMS and hosting user lists | Yes / No |
| Minimal role per account (editor rather than administrator) | CMS roles | Yes / No |
| Two-factor authentication enabled on administrator accounts | CMS plugin or setting; hosting panel | Yes / No |
| Agency account removed or disabled at hand-over, passwords changed | User list, FTP/SSH access, hosting panel | Yes / No |
| API keys and secrets outside the code repository, rotated at delivery | Environment files, repository history | Yes / No |
Take the third-party table from phase 1 and add what the browser does not show: the hosting provider, the transactional email service, the emailing tool, the external backup provider, the payment module. Each processes data on the client's behalf, which makes it a processor within the meaning of GDPR Article 28. Paragraph 1 requires the use of processors providing sufficient guarantees only; paragraph 3 requires a written contract that covers, among other things, processing on documented instructions, confidentiality of authorised staff, the security measures of Article 32, conditions for sub-processors, help with data subject requests, and deletion or return of the data at the end of the contract. With most online vendors that contract already exists as a data processing agreement (DPA). The developer does not negotiate it; the developer confirms it exists, notes where it is, and records the hosting location the vendor states.
| Item | Where to check | Done |
|---|---|---|
| Full list of vendors that process data (visible and invisible) | Phase 1 table + server and CMS configuration | Yes / No |
| For each: data processing agreement found and link noted | Vendor account area or legal documentation | Yes / No |
| Data hosting location recorded for each | Same source | Yes / No |
| Unused vendors removed (plugin deactivated, account closed) | CMS plugins, vendor accounts | Yes / No |
The last phase is not code. It consists of writing, on one page, what has been settled and what remains with the client. The client is the controller; Article 25 addresses the controller, and the controller answers requests from individuals. Without this document, the work of phases 1 to 7 is invisible to the client.
Secure and HttpOnly cookies, security headers tested.The free Sitetals check reviews your home page and reports, among other things, whether a legal notice page or a privacy policy page is missing or unreachable, and which third-party services your site loads. It is a starting point for the review described above, not a replacement for it.
Also worth reading:
Sources: Regulation (EU) 2016/679, articles 4, 5, 7, 13, 25, 28 and 32, recitals 30 and 32 · Law no. 78-17 of 6 January 1978, article 82 · CNIL, Guide RGPD du développeur (fact sheets Sécuriser vos sites web, Minimiser les données collectées, Gérer les utilisateurs, Maîtriser vos bibliothèques et vos SDK, Tester vos applications, Informer les personnes) · CNIL, recommendation on logging measures · CNIL, Cookies : solutions pour les outils de mesure d'audience · Sitetals methodology.
Sitetals editorial team