Privacy compliance for websites: consent, cookies and data handling

What laws are likely to apply?

Territorial scope follows the user, not the server. An Indian company with European visitors is generally within GDPR's reach. This article is engineering guidance — take actual legal advice for your circumstances.

What does valid consent look like?

Freely given, specific, informed and unambiguous — an affirmative action, with refusal as easy as acceptance.

1. 1No pre-ticked boxes and no implied consent from continued browsing.
2. 2'Reject all' presented with equal prominence to 'Accept all' at the same level.
3. 3Granular categories: analytics, marketing and personalisation as separate choices.
4. 4No non-essential scripts fire before a choice is made.
5. 5Consent is logged with a timestamp and version, and is withdrawable as easily as it was given.
6. 6Re-ask when purposes change materially, not on a fixed schedule.

What does a website typically collect?

• Contact form submissions — name, email, phone, message.
• Analytics — IP address, device, pages viewed, referrer.
• Marketing tags and advertising identifiers.
• Session and authentication cookies for logged-in areas.
• Server logs containing IP addresses and user agents.
• Error tracking payloads, which can contain personal data if you are not careful.

Write this inventory down. You cannot answer a deletion request, complete a vendor assessment, or write an accurate privacy notice without knowing what you hold and where.

What must you build to honour rights?

1. 1Access: export everything you hold about an individual in a portable format.
2. 2Deletion: remove or anonymise it, including in backups per your documented policy.
3. 3Correction: let users update inaccurate data.
4. 4Objection and opt-out: honour it and record that you did.
5. 5A route to make requests — an email address is sufficient for most small sites.
6. 6A defined response time, typically 30 days under GDPR.

The practical engineering task is knowing every place a user's data lives: the database, the CRM, the email platform, the analytics tool, error tracking, backups and logs. Build the export and deletion path early; retrofitting it across eight systems is painful.

What about retention and processors?

• Define a retention period per data category and automate deletion — indefinite retention is not a policy.
• Server logs with IP addresses: typically 30 to 90 days.
• Contact enquiries: as long as the business relationship plus a defined tail.
• Have a data processing agreement with every vendor touching personal data.
• Document international transfers and their safeguards.
• Reassess when you add a vendor — every new tag is a new processor.