Determine the applicable requirements first
A website privacy checklist begins with identifying which requirements apply. GDPR, UK GDPR, CCPA and Israeli privacy law have different scopes; an international audience does not make them interchangeable. Ask the responsible adviser to assess the organization and processing. ICO guidance illustrates technical and organizational security considerations for UK GDPR, but is not a universal compliance template.
Trace the data beyond the contact form
Map which fields the website collects, where enquiries are stored and which mail, CRM, analytics, payment or hosting services receive them. Include administrator access, exports, logs and backups. For each flow, record the business owner and the purpose supplied by the organization.
Check the implemented controls
Review access rights, supported MFA, transport encryption, retention and deletion workflows against the agreed requirements. Test how a verified request for access, correction or deletion is handed to the responsible team. A policy page should reflect actual operations; installing a banner alone does not establish compliance.
Keep evidence and assign decisions
Provide your adviser with the inventory, relevant settings, test results and outstanding gaps. Requirements for notices, legal bases, contracts, international transfers or breach reporting need appropriate professional assessment. NIST and ISO references can help organize security work, but a technical checklist is not a certification or a legal opinion.
Connect approved requirements to technical evidence
A website review must distinguish legal requirements, owner decisions and technical observations. Jurisdiction depends on the actual business, people and processing, not simply on the page language. UK regulator guidance is not worldwide law.
- Map field, purpose, recipient and stored copies.
- Identify providers and relevant jurisdictions.
- Ask the owner/adviser to approve requirements.
- Translate each requirement into a test and evidence.
Data copies and decisions for your adviser
Prepare an evidence pack with implementation findings, provider list, notices and unresolved questions. Do not invent retention periods or claim full compliance from changing a checkbox. Record review dates and regulator notices; implementation and legal approval remain distinct responsibilities.
| Data copy | Technical check | Decision needed |
|---|---|---|
| Application | Fields and retention behavior | Purpose and duration |
| Message provider | Actual destination | Disclosure and provider terms |
| Logs/backups | Copies and access | Retention/deletion obligations |
Example: one form creates several retained copies
A contact form produces an application request, a messaging copy and server records. An adviser needs that map before a deletion process can be described accurately. This is an illustrative scenario, not a customer case or a promised result.
