Why websites need a live data protection mindset
This page is designed to give high-level, practical guidance only. Exact obligations can depend on how your website operates, the technologies it uses, the audiences it serves and the way the underlying business model works in practice.
A website can create data protection questions through contact forms, account features, bookings, checkout, support tools, analytics, chat widgets, advertising technologies, embedded media and more. The wider the journey, the more likely it is that multiple moving parts affect the live position.
That is why businesses often think they have a policy issue when the real issue is governance. They may have wording in place, but no clear ownership, no reliable review cadence and no central process for checking whether the site still behaves the way the public documentation suggests.
A stronger approach is to treat website data protection as an evidence and alignment question. What does the site do? What does it say it does? Which providers are involved? Who owns review? How are changes logged or checked?
For a faster route into that question, use the website compliance process guide or go straight to the compliance estimator.