Website security and GDPR: what is checked?

Technology and privacy belong to the same website audit

The GDPR concerns both technical protection and the way the website collects and uses personal data. The fixed audit therefore assesses not only transport, access, storage, logging and recovery, but also the website-related purposes, legal bases and accountability information.

Fixed privacy controls for each website

We inventory which personal data the website processes, why that happens, which external services collaborate, where data ends up, and how long it is retained. Each check receives a demonstrable outcome.

• Are processing purposes and legal bases clearly documented?
• Do privacy statement, forms and actual data flows align?
• Are non-essential cookies and trackers loaded only after valid consent?
• Can retention periods, deletion and data subject rights be put into practice?
• Are processors, transfers, and possible DPIA triggers mapped?
• Are accounts, sessions, secrets, and sensitive fields appropriately protected?

Documentation and technology are tested together

The website-specific privacy audit combines technical verification with the relevant statements, contract information, and processes. This links legal bases, processors, international transfers, rights procedures, and data breach preparation to what the website actually does.

Regular testing demonstrably maintains security

Article 32 mentions protection and a process for regularly testing and assessing the effectiveness of measures. The Charter Nine website security certificate is valid for one year. After eleven calendar months, the owner receives one reminder; a new audit requires a new engagement. The owner remains responsible for security during the validity period.