GDPR and cookies: what they mean for a small business website in Ireland

Most small business websites collect some personal data: a contact form, a booking, an order, an email sign-up. Many also use cookies. Two sets of rules apply: the GDPR, with Ireland's Data Protection Act 2018, for personal data; and the ePrivacy Regulations 2011 for cookies and marketing messages. In Ireland both are overseen by the Data Protection Commission (DPC).

This is general information, not legal advice. If you handle sensitive information, such as health details, talk to a solicitor.

Know what your website collects

Make a list: every form, what each one asks for, where the answers go (an inbox, a spreadsheet, a booking system), who can see them, and how long they are kept. That list is the start of everything else.

Have a reason for each thing you collect

Under the GDPR you need a lawful basis for using personal data. For a small business website it is usually one of these:

• To do what the person asked: reply to an enquiry, deliver a booking or an order.

• A legal duty: keeping sales records for Revenue.

• Consent: newsletters, and anything optional.

If you cannot say why you need a piece of information, do not ask for it.

Write a privacy notice people can find

Link to it from every page, usually in the footer, and from each form. In plain words it should say:

• Who you are and how to contact you

• What you collect and why

• Who else handles it (your website host, email provider, payment provider)

• How long you keep it

• People's rights, and that they can complain to the DPC

Keep it only as long as you need it

Decide how long each kind of data is kept, and delete it after that. A year is plenty for most enquiries. Sales records are kept for as long as Revenue requires. The less you hold, the less there is to lose.

Answer requests on time

People can ask to see what you hold about them, to correct it or to have it deleted. In most cases you have one month to answer. Know where your data is, so you can find someone's details quickly.

Cookies need consent, except the necessary ones

Under the ePrivacy Regulations, you may store something in a visitor's browser, or read it back, only with their consent, unless it is strictly necessary for something they asked for: keeping a basket, keeping someone signed in, remembering their cookie choice.

Analytics and advertising cookies are not strictly necessary, so they need consent first. The DPC's guidance on cookies is clear on how:

• Nothing optional runs before the visitor chooses

• No pre-ticked boxes, and "by continuing to browse you agree" is not consent

• Rejecting must be as easy as accepting

• Say what each cookie is for and who sets it

• Changing your mind must be easy, from a link on every page

If your site uses no optional cookies at all, you do not need to ask anything. That is often the simplest choice.

Marketing emails need their own yes

You can email your newsletter only to people who agreed to receive it, with a box that is not ticked in advance. Agreeing to be contacted about an enquiry is not agreeing to marketing. There is one exception: you may email existing customers about similar products or services if you gave them the chance to opt out when you took their details, and you give it again in every email. Every marketing email needs a working unsubscribe link.

If something goes wrong

If personal data is lost, stolen or sent to the wrong person, and it could put people at risk, you must tell the DPC within 72 hours of finding out. Keep a short note of every incident, even small ones.

Where to find more

The DPC's website, dataprotection.ie, has guidance written for small businesses, including its guidance on cookies.

How a Webseer site helps

Each Webseer form keeps its entries for as long as you choose, and its consent question keeps the exact words someone agreed to. Webseer counts visits without cookies, so a site that needs nothing else asks visitors nothing. When a site does use something optional, its cookie banner offers Reject all and Accept all side by side, runs nothing optional before a choice, and keeps a Cookie settings link in the footer. We help you write your privacy notice when we build your site. See how forms work.