GDPR Checklist
GDPR compliance for web & marketing agencies
Agencies handle data on behalf of many clients, making you a processor (and sometimes controller) across dozens of sites.
Common risks
- • Shipping client sites with no consent banner or privacy policy
- • No DPA between you and your clients
- • Reusing trackers across client sites without disclosure
- • No standard compliance baseline across projects
Your checklist
- Sign a DPA with every client defining roles and instructions (Art. 28)
- Ship a consent banner + privacy policy as a project default
- Keep a per-client list of installed trackers and their purposes
- Standardise a pre-launch GDPR checklist for every site
- Offer compliance as a recurring retainer service
FAQs
Am I a controller or processor?
Usually a processor when acting on client instructions, but you can be a joint controller for your own analytics. Define this in the DPA.
Can I sell GDPR audits to clients?
Yes — running a scan per client and delivering a white-label report is a strong recurring revenue add-on.
See how your web & marketing agencie scores
Run a free GDPR + security audit in ~30 seconds.
Run a free audit