A GDPR website checklist for an EU business covers a clear privacy notice, cookie consent before non-essential cookies load, forms that collect only needed data, a written processor contract with your offshore developer and host, security basics and a plan for 4 kinds of request: access, correction, deletion and objection. This is not legal advice.
Key Takeaways
- As the business, you are usually the controller; your developer and host are processors acting for you.
- The European Commission says controller and processor need a contract setting out the processor's duties.
- Non-essential cookies, such as analytics and advertising, need consent before they load.
- Forms should collect only what you need, with a link to the privacy notice.
- Offshore developers should have limited, logged access and delete copies of data after work ends.
Who Is Responsible Under GDPR When a Site Is Built Offshore?
EU businesses increasingly have websites built by teams in Pakistan and elsewhere. Building offshore does not change who is responsible for personal data on your website. Under the GDPR, the organisation that decides why and how personal data is processed is the controller, usually your business. An external party processing data on your behalf, such as a developer, hosting company or cloud provider, is a processor. The European Commission's guidance says the processor may only act on the controller's behalf and that their relationship must be set out in a contract.
This GDPR website checklist is practical guidance for working with an offshore team. It is not legal advice; consult your data protection adviser for your situation. UK businesses follow UK GDPR, overseen by the ICO, with very similar principles.
What Is on the GDPR Website Checklist?
| # | Item | Who acts |
|---|---|---|
| 1 | List every type of personal data the site collects: forms, orders, analytics, chat | You, with developer |
| 2 | Write a privacy notice: who you are, what you collect, why, legal basis, who receives it, retention, rights | You, with adviser |
| 3 | Cookie consent banner that blocks non-essential cookies until consent | Developer |
| 4 | Equal options to accept or reject, and an easy way to change choices later | Developer |
| 5 | Forms collect only necessary fields, with a link to the privacy notice | Developer |
| 6 | Separate, unticked opt-in for marketing emails | Developer |
| 7 | HTTPS everywhere, updated software, strong admin authentication | Developer, host |
| 8 | Processor contracts with developer, host and key service providers | You |
| 9 | Know where data is hosted and how transfers outside the EU are covered | You, with adviser |
| 10 | Retention periods set, and old form entries deleted on schedule | You, developer |
| 11 | A process to handle access, correction and deletion requests | You |
| 12 | A breach plan: who to contact and how fast | You, developer, host |
How Should Cookie Consent Work?
Strictly necessary cookies, such as those keeping a shopping cart working, can run without consent. Analytics, advertising and many embedded third-party tools set cookies that need consent first. The European Data Protection Board's consent guidelines (05/2020, adopted 4 May 2020) address consent quality, including that consent must be freely given and clearly expressed. In practice: show a banner on first visit, do not load non-essential scripts until the visitor agrees, give an equally easy way to reject, and record the choice. Ask your developer to prove it works by loading the site with consent refused and checking which cookies are set.
What Should the Developer Contract Include?
- That the developer processes personal data only on your written instructions.
- Confidentiality obligations for everyone with access.
- Security measures, including limited and logged access.
- No subcontracting without your prior written authorisation, as the Commission's guidance notes.
- Help with data subject requests and breaches.
- Deletion or return of personal data when the work ends.
For transfers of personal data to a country outside the EU, such as Pakistan, additional safeguards may be required. Ask your adviser which mechanism applies. Our guide to outsourcing contracts and code ownership covers the commercial side.
How Can Offshore Access Be Minimised?
Most build work needs no real customer data at all. Developers can work on a staging site with test data, and production access can be limited to specific tasks. Give each developer their own account, remove access when the project ends, and ask for confirmation that downloaded copies are deleted.
Which Security Basics Matter Most?
HTTPS on every page, updated software, two-step login for admin accounts, regular backups and protection against common attacks. Our security checklist lists the full set.
How We Work With EU Clients
We build with consent-first cookie set-ups, minimal forms and staging data, and sign processor terms on request. Business websites start from Rs 85,500 in PKR. Our guide to hiring Pakistani developers explains our process. See business websites.
See also Website Development Cost in Saudi Arabia, Compared With Hiri and Website Design Cost in Qatar.
Frequently Asked Questions
- European Commission — What is a data controller or a data processor?
- European Commission — Rules for business and organisations
- EDPB — Guidelines 05/2020 on consent
- EUR-Lex — General Data Protection Regulation (EU) 2016/679
- ICO — UK GDPR guidance and resources
How we researched this: Controller and processor definitions and contract points come from the European Commission's page, and the consent guidelines reference from the EDPB's page dated 4 May 2020, both checked 30 October 2026. Only official EU and UK sources are cited, as the plan requires. The checklist is editorial and not legal advice. Our prices come from the published list in PKR.
Building for EU customers?
Message us on WhatsApp for a fixed quote, or see our published pricing first.