Table of contents
Why website privacy matters (and isn't just red tape)
Every website that collects data — even just a contact form or visit statistics — has obligations towards its visitors. It isn't a technicality for large companies: it also applies to a craftsman's brochure site or a professional firm. The rules come from the GDPR, the European data protection regulation, enforced in Italy by the Data Protection Authority.
The good news: making a typical business website compliant is neither complicated nor expensive. It takes a few elements, done well. Let's see which ones — without scaremongering, but without shortcuts either.
The privacy policy: what it is and what it must say
The privacy policy is the document that tells visitors what data you collect, why, how long you keep it and what their rights are. It must be reachable from every page, usually via a footer link. Copying one from another site isn't enough: it must reflect what your site actually does (forms, newsletter, statistics, third-party tools).
If you collect contacts through a form, the policy must state so clearly, along with the data controller (your company) and how to exercise the rights granted by the GDPR.
The cookie banner: when you need it and how it must work
Cookies are small files that sites save in the browser. Not all require consent: technical cookies (necessary for the site to work) are free, whereas profiling or third-party statistical ones (like some analytics tools or advertising pixels) require the user's explicit consent.
The Authority's guidelines are clear on some points: the banner must allow visitors to accept, reject or customise their choices with equal prominence. A banner with only an "Accept" button, or where rejecting is harder than accepting, is not compliant. And non-technical cookies must not be activated before the user has given consent.
Google Analytics, forms and external tools
Many sites use Google Analytics for statistics or tools like maps, embedded videos and chat. Each of these can install cookies or transfer data, so it must be handled in the banner and mentioned in the policy. In particular, tools that transfer data outside the European Union need careful assessment: a topic the Authority has addressed several times.
For a typical business website the practical solution is: use a serious consent management system, activate tools only after consent, and keep the policy updated when you add new services.
What you risk if the site isn't compliant
GDPR fines can be heavy, but for an SME the most common concrete risk is a user complaint or a check leading to requests for adjustment. Beyond the fine, there's a matter of trust: a site with deceptive banners or no policy signals carelessness to exactly the people deciding whether to contact you.
In short: for most business websites three things done well are enough — an up-to-date privacy policy, a compliant cookie banner (accept/reject/customise), and activating tools only after consent. It's not complicated, but it must be done properly.