Legal pages and GDPR obligations for your new WordPress site

The pages nobody writes until someone complains

AI builders often generate a privacy page automatically, which creates a false sense of being covered. After moving to WordPress you are the data controller of your own hosting, your own plugins and your own analytics, and the legal paperwork must reflect that reality. I am an IT expert, not a lawyer, so treat this as the technical checklist I hand to clients alongside the advice to have a legal professional review the final texts.

The good news: for a typical small business site the obligations are very manageable. A handful of pages, a consent mechanism, some contracts with suppliers, and a few habits. The bad news: doing nothing is not neutral. Complaints from visitors or competitors can trigger investigations, and 'the AI builder did it before' is not a defence.

The privacy policy that matches reality

Your privacy policy must describe what your site actually does, not what a template thinks it does. Walk through your own site and list every place personal data appears: the contact form (name, email, message), comments, analytics, embedded videos, font services, the newsletter tool, the shop checkout, server logs with IP addresses. For each item the policy should state what is collected, why, on which legal basis, how long it is kept and who receives it.

The most common gap I find in audits is third-party embeds. A YouTube video, a Google Map or a social share button phones home to that company before the visitor consents to anything. Either embed them in a privacy-friendly two-click mode, load them only after consent, or remove them. Check this again after every redesign, because embeds sneak back in.

Cookie consent that actually works

If your site sets non-essential cookies or uses tracking scripts, European law requires prior consent: the banner must block those scripts until the visitor agrees. Many banner plugins only show a message while the tracking loads anyway, which is compliance theatre. Test it properly: open your site in a private window, do not click anything, and check in the browser's developer tools which cookies and requests appear. Anything non-essential that fires before consent is a violation.

Also make 'refuse' as easy as 'accept', record consents so you can prove them, and provide a way to change the choice later, usually a small link in the footer. And remember that anonymised, self-hosted analytics can often run without a banner at all, which is why I suggest them to clients who hate banners.

Contracts with your suppliers

Under GDPR you need a data processing agreement with every supplier that processes personal data for you: the hosting company, the email service, the newsletter tool, the analytics provider, the backup service. Most established providers offer a standard agreement you can accept in their dashboard. Keep a simple list: supplier, what data, where their servers are, and where the agreement lives.

Transfers outside the EU deserve one extra look. If a supplier processes data in the United States, check that they are covered by the current EU-US data framework or use standard contractual clauses. This is precisely the kind of boring administrative task that is easy now and painful during a complaint.

Practical rights and habits

Visitors have the right to see, correct and delete their data. Prepare for the rare request: know how to export a contact form entry and a user account, and how to delete them. Breaches that expose personal data must be reported to the authority within 72 hours, which is one more reason for good backups, updates and strong passwords. If a service like Convert2WP handled your migration, ask them which of these items were already set up during the move so you only fill the remaining gaps.