Is my website GDPR compliant?
Every website owner in the EU asks this question at some point – and the answer is rarely a simple yes or no. GDPR compliance is the sum of several checked areas: consent, privacy policy, forms, tracking, third parties, and not least where your site is hosted. This self-check walks you through each area – and shows which checks you can automate with Mira Checks.
A self-check, not legal advice. Working through this checklist – even with a completely clean result – does not guarantee that your website is GDPR compliant in the legal sense. For binding obligations, have a data protection officer or lawyer review your setup.
What GDPR compliance means for a website
The goal: a website that collects personal data only with a legal basis, informs visitors transparently, enables the rights of data subjects, and doesn't send data abroad unnecessarily. These eight areas belong in every GDPR compliance check:
Consent only via opt-in, clearly separated from page choice, and revocable at any time.
Complete, up to date, and accurate for the services you actually run.
Every processing with a legal basis: contract, consent, legitimate interest, legal obligation.
Consent texts, required-field notices, and a working, encrypted transmission.
Started only with consent, without data leaking to third countries or provider chains.
Maps, videos, chat widgets, payment embeds: who loads what, when – and where does data go?
Access, erasure, rectification, objection: a reachable process for GDPR requests.
Who processes data where? EU hosting avoids third-country transfers and simplifies processor agreements.
The self-check, step by step
Go through the nine steps in order. In each step: if you can't answer a question, that is already a finding. In the end you'll know where your website stands – and where you need to act.
-
Record processing activities
List which personal data your website collects: form inputs, accounts, cookies, tracking, logs. What isn't recorded cannot be checked.
-
Check legal bases
Assign every processing a legal basis (Art. 6 GDPR): contract for bookings, consent for tracking, legitimate interest only with a balancing test.
-
Check the cookie banner & consent
Do tracking and marketing scripts load only after a click on "Accept"? Is rejecting just as easy as accepting? Revocation and re-selection must remain possible at any time.
-
Check the privacy policy
Does it name all services that actually run, including provider, purpose, data, and retention? A policy that diverges from the reality of your site is itself a compliance risk.
-
Check contact forms & form data
Do all forms include the required consent text and privacy notices? And do they work: does a submission actually arrive encrypted? A form that silently swallows data is also a privacy problem.
-
Check tracking & analytics
Do analytics scripts start only after consent? Is data shared with third parties outside the EU? Is there a solution without personal reference, like EU-based, hashed, or server-side tracking?
-
Check embedded third parties
Do maps, videos, chat, and payment widgets already load data before the visitor consents? Check which requests a page sends to foreign domains before consent.
-
Check data subject rights & GDPR requests
Is the process for access, erasure, and objection documented and reachable – by email, form, or postal address? Check whether a test request actually gets answered.
-
Check hosting & server location
Where are your servers, and where are those of your service providers? Check your tools too: a monitoring or testing service that transfers data to the US creates a third-country transfer of its own.
Audit areas – and which automated check helps
Many items on the self-check are one-off legal assessments. Others – above all whether your website actually works and isn't silently passing data to foreign services – can be automated and monitored on an ongoing basis with Mira Checks:
| Audit area | The automated check |
|---|---|
| Broken pages and forms after a deployment – the consent and data-entry paths still work | Post-deploy check: contact, lead, and newsletter forms are submitted end to end, confirmations and data storage are verified, and key pages are checked for load errors. A form that swallows data or a page that breaks catches your attention immediately. |
| Requests to foreign domains and failed scripts | Request check: the HTTP status of every loaded resource is recorded. Broken third-party scripts and unexpected provider calls can be detected. |
| JavaScript errors that break consent and form logic | Console check: JavaScript errors are captured on every page load. This reveals when the consent manager or a consent solution doesn't load properly or throws errors. |
| Availability: key pages reachable when customers need them | Uptime monitoring: availability checks along real customer paths, EU-hosted. A reachable homepage can still hide broken forms – uptime monitoring covers the pages that matter, not just the server. |
| Data flow over time – nothing changes silently | Monitoring: planned, recurring checks along real customer journeys. Detects when something suddenly deviates after a deployment or a third-party change. |
| Coverage: all relevant pages are actually checked | Automatic page discovery: Mira finds pages and forms itself and ensures the check covers your whole website – not just the three pages everyone knows manually. |
These are concrete signals, not a compliance verdict. A clean Mira Checks report shows that the checked paths work – it does not certify GDPR compliance. Legal assessment remains your data protection officer's or lawyer's job.
GDPR-safe monitoring: EU hosting, no training
Even if you run your website cleanly, one thoughtless tool can bring a compliance problem into the house. A monitoring or testing service processes page content, form data, and screenshots – in other words, personal data. So check your tools by the same criteria:
EU-hosted
Mira runs on servers in the EU. Page content, screenshots, and test data never leave European infrastructure.
No training with your data
Mira doesn't train AI models with your website data – neither its own nor anyone else's. Your data stays your data.
No external AI providers
Mira runs its AI on its own servers in the EU. There is no provider chain your data could silently flow into.
Related guides for your audit area
Depending on which area of the self-check is open for you, one of these pages goes deeper:
Ist meine Website DSGVO-konform?
Die deutsche Version dieses Selbst-Checks – Bereiche, Schritte und FAQ auf Deutsch.
Deutsche Version lesenGDPR-compliant website testing
Test forms, journeys, and customer paths after every change – without third-country transfers.
Read moreGDPR-compliant website monitoring
Ongoing checks along real customer journeys – GDPR-compliant, EU-hosted, and scheduled.
Read moreFrequently asked questions
- How do I check whether my website is GDPR compliant?
- Work through the relevant areas systematically: record data processing and legal bases, check your consent banner and privacy policy, review contact forms, tracking and embedded third parties, offer a process for data subject rights, and verify the hosting location. Our self-check list walks you through every area step by step.
- Do I need to watch for servers in the EU when using GDPR-compliant monitoring?
- Yes. The hosting location of your monitoring provider is one of the central questions: which data is processed, where does it flow, and who can access it? With providers running servers in the EU, no third-country transfers occur and processing stays within the scope of the GDPR. Details on the GDPR-compliant monitoring page.
- Does Mira Checks make my website GDPR compliant?
- No – and Mira doesn't claim to. Working through a checklist, even with a clean automated report, is not a legal guarantee of GDPR compliance. Mira helps you check concrete signals: forms are tested end to end, failed requests and console errors are detected, and key pages are monitored continuously. Writing your privacy policy and legally assessing your setup is the job of a data protection officer or lawyer.
- Does Mira Checks train AI with data from my website?
- No. Your page content and test data are never used to train AI models. Mira is hosted in the EU, runs its AI on its own servers, and uses GDPR-compliant infrastructure. More on the GDPR-compliant website testing page.
- What is the difference between GDPR-compliant testing, monitoring, and server monitoring?
- GDPR-compliant website testing verifies that your website works after changes. GDPR-compliant monitoring runs the same checks on a planned, recurring schedule along real customer journeys. GDPR-compliant server monitoring checks availability, response behaviour, and content changes. All three process data in the EU.
Automate your GDPR compliance checks
Mira is live. Let autonomous website QA keep testing your forms, journeys, and pages – EU-hosted and without training on your data. Also interesting: test your website after deployment.
German version: Ist meine Website DSGVO-konform?.
Try Mira