AVG Privacy Legislation

The General Data Protection Regulation (GDPR) is the European law that, since May 2018, has governed how organizations handle personal data. The General Data Protection Regulation (GDPR) imposes strict requirements on the collection, storage, use, and security of data such as names, email addresses, IP addresses, and purchasing behavior. These rules apply to every small and medium-sized business (SMB) with a website, ecommerce store, or CRM system as soon as it processes data from European citizens.

How GDPR privacy legislation works in practice

The legislation applies six basic principles: lawfulness (you have a valid reason), purpose limitation (you use data only for the purpose for which you collect it), data minimization (do not ask for more than necessary), accuracy (keep data up to date), storage limitation (do not retain data longer than necessary), and integrity (secure data properly). In practice, this means you must request active consent for every contact form, newsletter, or customer account. That consent must be voluntary, specific, and informed. A pre-checked box is no longer allowed. You must also clearly explain what you do with the data, how long you retain it, and with whom you share it. Customers have the right to access, correct, and delete their data. In the event of a data breach affecting more than 250 individuals, you must report it to the Dutch Data Protection Authority within 72 hours.

Why the GDPR privacy legislation was introduced in 2018

Before 2018, every European country had its own privacy regulations. Companies could shop around for countries with lenient legislation. At the same time, the number of data breaches and instances of personal data misuse skyrocketed. The European Union sought a single, uniform system with genuine enforcement and fines that really hurt (up to 20 million euros or 4% of global annual revenue). The goal was to give citizens control over their own data and to compel companies to exercise due diligence. Since its implementation, thousands of fines have been issued, including to Dutch small and medium-sized enterprises (SMEs) that lacked a privacy policy or retained data for too long.

What the GDPR means for your business

Although the GDPR is often seen as an administrative burden, compliance delivers tangible benefits. Customers trust companies that handle data transparently. A clear privacy policy and secure data processing strengthen your reputation. You’ll avoid fines that can quickly run into the tens of thousands of euros. The law also forces you to consider what data you truly need, which often leads to more efficient processes. When having a website design or ecommerce store design performed,GDPR compliance is a standard part of a professional delivery. This includes cookie banners, privacy policies, data processing agreements with hosting providers, and secure storage of customer data. Getting things right from day one saves you legal headaches and reputational damage down the road.

GDPR privacy legislation affects nearly every aspect of your business operations as soon as you work digitally—from your website to your accounting software, from your newsletter to your employee records. Below are four specific situations in which the law directly applies and what you need to do.

Contact forms and lead generation on your website

Every contact form, quote request, or download form collects personal data. According to GDPR privacy legislation, you must include a link to your privacy policy on every form and request active consent for newsletters or marketing purposes. That consent must not be required in order to submit the form. An ecommerce store with 200 visitors per day that lacks a clear consent process runs the risk of a fine at the first complaint. In practice, this means you must update your forms to include a separate opt-in checkbox, be able to demonstrate when someone gave consent, and provide a simple way to unsubscribe. You must also specify how long you will retain the data. For quote requests, two years is standard; for newsletters, data is retained until the subscriber unsubscribes.

Email marketing and newsletters

Do you send newsletters via Mailchimp, ActiveCampaign, or another platform? If so, you are the data controller and must enter into a data processing agreement with that party. You may only send emails to people who have given explicit consent, unless you have an existing customer relationship (soft opt-in). Purchased mailing lists are prohibited. Every newsletter must include a clear unsubscribe link. You must be able to demonstrate when someone subscribed, via which form, and for what purposes. A B2B service provider with 1,200 contacts in its system without documentation of consent cannot demonstrate, in the event of an audit, that the processing is lawful. This will immediately result in a warning or a fine. Therefore, always include a review of your email marketing setup as part of your SEO projects.

Ecommerce stores and customer accounts with order history

An ecommerce store processes names, addresses, payment information, order history, and often browsing behavior via cookies. GDPR privacy legislation requires that you inform your customers in advance about what data you collect and why. You must link to a privacy policy during checkout and upon account registration. Customers have the right to have their account and all data deleted, except for data you are legally required to retain (such as invoices for the tax authorities, for seven years). An ecommerce store that also engages in remarketing via Google or Meta must request separate consent for those cookies. The cookie banner must offer three options: accept all, reject all, and customize settings. Displaying only an “Accept” button does not comply with the law. You can find more information about compliance for ecommerce stores in the knowledge base under GDPR compliance.

When is GDPR privacy legislation the right focus, and when is it not?

The GDPR always applies as soon as you process personal data of EU citizens, but the level of effort required depends on your risk profile. A sole proprietorship with a simple contact page has less to manage than an ecommerce store with 10,000 customers and targeted ads. Start by investing in the basics: a clear privacy policy, proper consent workflows, and a data processing agreement with your hosting provider. Only then should you look into more advanced matters such as a Data Protection Impact Assessment (DPIA) or a data protection officer. Companies that don’t process personal data (for example, a portfolio site without a form) have fewer requirements, but as soon as you start running analytics or placing cookies, you’ll need to take action.