If your website has an enquiry form, takes bookings or counts its visitors, it handles personal data, and GDPR applies to you however small you are. For most small Irish sites that comes down to five things: a privacy notice in plain words, a reason for each piece of data you collect, a cookie banner only if you use cookies that are not essential, a note of who processes the data for you, and a way to answer someone who asks what you hold on them. The regulator is the Data Protection Commission, and most of this is less work than it sounds.
One thing before the detail. We build websites; we are not a solicitor. This is how we handle data protection on the sites we build and why. If your business holds health information, children’s details or legal files, get advice that fits your work.
What a small website actually collects
Walk through your own site as a customer and the list appears.
| Data | Where it comes from | Why you have it | How long, typically |
|---|---|---|---|
| Name, phone, email, message | Enquiry form | To reply | Until dealt with, then delete, or keep if they become a customer |
| Name, contact, appointment, notes | Booking system | To provide the service | While they are a customer, plus what the accounts need |
| Deposit or payment record | Card processor | To take and refund money | Six years for Revenue records |
| Card number | Card processor only | You never see or store it | Held by the processor |
| Pages viewed, rough location, device | Analytics | To see what works | Days to months, and ideally never tied to a person |
| Email address | Newsletter sign-up | Marketing, with consent | Until they unsubscribe |
Each row needs a reason you could say out loud to the customer. “To reply to you” and “to keep your appointment” are good reasons. “Because the form had the field” is not, and the fix is to remove the field.
Who is who
In GDPR language you are the controller: you decide what is collected and why. The companies that handle the data for you are processors: your booking system, your email provider, your web host, the form service that delivers enquiries, the card processor, the review request tool. In Ireland the law is the GDPR itself plus the Data Protection Act 2018, and the regulator is the Data Protection Commission, whose guidance for small organisations is readable and free.
You need two things from each processor: their data processing terms, normally part of the standard contract you accepted when you signed up, and a line in your privacy notice naming them. Keep a short list somewhere. If you ever get a question, that list is where you start.
The privacy notice
A privacy notice is required, and it is the one document every small site should have. It should say, in plain words: who you are and how to contact you; what you collect and from where; why you collect each thing and on what basis; who you share it with; how long you keep it; the rights people have to see, correct and delete their data; and that they can complain to the Data Protection Commission.
The “basis” part frightens people and need not. For a booking or a sale, the basis is that you need the data to provide what they asked for. For replying to an enquiry or keeping security logs, it is your legitimate interest in running the business. For a newsletter or non-essential cookies, it is consent, which must be freely given and easy to withdraw.
One page, linked from the footer and from any form, in language your customers would use. It does not need legal phrasing. It needs to be true. A privacy page is on our list of what a small business website should include for exactly this reason.
Cookies: when a banner is needed and when it is not
Irish law on cookies is the ePrivacy Regulations of 2011, as we understand it, and the rule is that you need consent before storing or reading anything on a visitor’s device unless it is strictly necessary to provide the thing they asked for. The Data Protection Commission’s guidance adds the practical detail: no pre-ticked boxes, no “by continuing you agree”, rejecting must be as easy as accepting, and you cannot lock people out for refusing.
The useful consequence is that a banner is only needed if you have something that needs one.
| On your site | Needs consent first? |
|---|---|
| Enquiry form that emails you | No. No cookies are set. Cover it in the privacy notice. |
| Login or basket cookie for a booking in progress | No. Strictly necessary. |
| Google Analytics | Yes. It sets cookies and sends data to Google. |
| Cookie-free analytics (Plausible, Fathom, Simple Analytics and similar) | Generally no, when set up without cookies. Mention it in the notice. |
| Embedded YouTube video, Instagram feed, Facebook pixel | Yes. Third party code and cookies load with the page. |
| Embedded Google Map | As we understand it, yes. A static image with a directions link avoids it. |
| Live chat widget | Depends on the provider. Ask them what it stores. |
A small business site that avoids the “yes” rows does not need a cookie banner at all, and most do not need any of those rows. A banner that everyone clicks away is bad for the visitor and, if it says “by continuing you agree”, is not valid consent anyway. The cleanest answer is to build the site so the question never arises.
Analytics without cookies
You can still know how many people visited, which pages they read and whether they came from Google or Instagram without identifying anyone. Cookie-free analytics tools count visits from aggregated data and discard anything that could point at a person, so the monthly numbers a shop owner actually looks at survive intact. Mention the tool in the privacy notice, because it handles the visitor’s IP address briefly to do the counting, but the banner and the consent machinery behind it can go.
Booking data and how long to keep it
The GDPR gives no fixed periods; it says keep data as long as you need it for the purpose and no longer. For a booking business that means two different clocks. Records that back up your accounts (invoices, deposits, refunds) have to be kept for six years because Revenue requires it. Appointment histories and notes have no such rule, so you set one: for example, delete or anonymise customers who have not visited in a set number of years, and say so in the notice.
Health related notes (a physio’s treatment notes, a counsellor’s records) follow your professional body’s rules as well, which are usually longer and stricter. If you take bookings through a system such as Fresha or Booksy, the data is still yours as the controller. Know how to export it, and check what the provider deletes if you close the account. Our guide to taking online bookings covers the practical side.
Marketing messages and review requests
Sending a newsletter or a text offer needs consent, recorded somewhere you can find it. There is an exception, as we understand it, for your own existing customers: you can email them about similar services to what they bought, within a limited time of the sale, provided every message has an easy way to opt out. A single message after a visit asking for a Google review, with no offer attached, is generally treated as part of the service rather than marketing, but keep it to one message and honour any request to stop.
When someone asks what you hold
Anyone can ask you for a copy of their personal data. You have one month to respond, extendable by two more for complicated requests, and you cannot normally charge. In practice: check their identity if you are not sure who is asking, search your inbox, booking system, WhatsApp and paper diary, and send them what you found along with why you have it, who you shared it with and how long you keep it. Deletion requests work the same way, except that you may keep what Revenue requires.
If something goes wrong, such as a lost phone with booking details on it or a hacked email account, work out whether people could be harmed. If they could, report it to the Data Protection Commission within 72 hours of finding out; its website has a form. If the risk to the people affected is high, tell them too.
What we do for clients
Every site we build gets a privacy page written in plain words, listing what the site collects, why, and which processors are involved. Enquiry forms ask for a name, a way to reply and the message, and nothing else. Visitor counting is done without cookies, so the site has no banner unless the owner asks for something that needs one, such as Google Analytics or an embedded video, and then we explain the trade-off first.
On Complete, where bookings, deposits and review requests run through the site, the customer data belongs to the client, and if they leave they get their booking history with the rest of their content. If you are a counsellor, a clinic or anyone else holding sensitive records, we set the site up conservatively and tell you where our knowledge stops. The plans are on the pricing page.