Every tool you plug into your website (hosting, analytics, payments, email, chat, fonts, maps, video) may receive your visitors' personal data. Under the GDPR you stay responsible for choosing them, contracting with them and knowing where the data goes.
Controllers, processors and contracts
A provider that handles personal data on your behalf and on your instructions is a processor. You may only use processors that provide sufficient guarantees, and you must sign a data processing agreement covering the points in GDPR Article 28: subject matter, duration, instructions, confidentiality, security, sub-processors, assistance with rights requests and breaches, and deletion or return of data at the end.
Some providers act as independent controllers for part of their processing, for example advertising networks using data for their own purposes. That needs its own legal basis and usually your visitors' consent.
Transfers outside the EU (Chapter V)
- Adequacy decisions: transfers to countries the European Commission considers adequate need no extra safeguard. For the United States, this covers companies certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).
- Standard contractual clauses: the Commission's 2021 clauses (Decision (EU) 2021/914) are the usual tool for other transfers, with a transfer impact assessment.
- Schrems II: since the Court of Justice judgment of July 2020 (C-311/18), you must check that the law of the destination country does not undermine the clauses.
Audit your website's third parties
- Open your site with the browser's developer tools and list every external domain it contacts.
- For each, record who the provider is, what data it receives, where it is processed, and the contract or transfer safeguard.
- Remove what you no longer use. Unused tags still collect data.
- Self-host files where you can (fonts, scripts) so visitors' IP addresses are not sent to third parties.
- Load anything that tracks only after consent.
- List processors and transfers in your privacy policy and your records of processing.
Processors must tell you about breaches without undue delay, and you remain responsible for notifying the authority within 72 hours. Our story on the Odoo Cloud breach email and the poisoned Java library show how supplier incidents reach customers.
This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.