The General Data Protection Regulation has now been adopted and will apply from 25 May 2018. For many UK businesses, that may sound comfortably distant, but digital marketing teams should not wait. Websites, enquiry forms, email lists, social media advertising, analytics, customer databases and domain administration all rely on personal data in one way or another. Good GDPR preparation is therefore not simply a legal exercise; it is an opportunity to build better systems, improve trust and make marketing activity more accountable.
For business owners planning a new website, a redesign, an SEO programme or a broader digital strategy, the next eighteen months provide a useful window. Organisations that start now will have time to review how data is collected, where it is stored, who can access it and whether marketing permissions are clear. Those that leave it until the final months may face rushed decisions, awkward website changes and poor-quality database clean-up work.
Why GDPR preparation matters for digital marketing
Marketing has become more data-driven over recent years. Even a relatively simple business website may collect names, email addresses, telephone numbers, IP addresses, cookie information, enquiry details and newsletter preferences. A more mature digital operation may also use remarketing lists, customer relationship management software, email marketing platforms, call tracking, downloadable guides, social media advertising audiences and web analytics.
GDPR is intended to strengthen individual rights and make organisations more accountable for the personal data they handle. While businesses should take proper legal advice for their specific obligations, marketing teams can already begin with a practical question: can we clearly explain what data we collect, why we collect it, how long we keep it and how someone can exercise their rights?
If the answer is not yet clear, that is not unusual. Many businesses have added forms, plugins, mailing list imports, tracking scripts and third-party tools over time. The issue is not always deliberate misuse; it is often a lack of documentation and ownership. GDPR preparation gives businesses a reason to tidy this up and create a more professional digital foundation.
There is also a commercial benefit. Cleaner marketing data usually performs better. A list of people who have knowingly chosen to hear from a business is more valuable than a large, uncertain database of old contacts. A website that explains privacy clearly can reassure visitors at the point of enquiry. A well-managed CRM can help sales and marketing teams work more efficiently. In short, compliance preparation and good marketing practice should support each other.
Start with a simple data audit
The first practical step is to understand what personal data your business handles online. This need not begin as a complicated document. A clear spreadsheet or internal register can be enough to start the conversation.
List each place where data is collected or processed. For example, your website contact form, newsletter sign-up, e-commerce checkout, event registration form, downloadable brochure form, live chat, analytics account, social media advertising account, email marketing platform, CRM, help desk system and domain registration account. For each one, record what data is collected, who owns the process internally, which supplier or platform is involved, and why the data is needed.
It is also worth recording whether the data is essential. A contact form may not need a postal address if replies are sent by email. A brochure download may not need a telephone number if the visitor is only requesting information. Collecting less data reduces risk and can improve conversion rates by making forms feel less intrusive.
During this audit, pay particular attention to legacy lists. Many businesses have old spreadsheets of contacts gathered from networking events, past enquiries, competitions, exhibitions or previous campaigns. GDPR preparation is a timely reason to review whether those records are accurate, relevant and supported by appropriate permission or a legitimate business reason. If your team cannot explain where a list came from, treat it with caution.
Design website forms with privacy in mind
Website design has an important role to play in GDPR preparation. Privacy should not be hidden away as an afterthought; it should be considered as part of the user journey. Every form should make sense to the person completing it.
Begin by reviewing all forms on your website. Check contact forms, callback requests, newsletter sign-ups, quote forms, account registrations and downloadable content forms. Ask whether each field is necessary. If it is not required to fulfil the user’s request, consider removing it or making it optional.
Where a form is used for more than one purpose, be especially careful. If someone asks for a quotation, that does not automatically mean they expect to be added to a general newsletter. If you want to send ongoing marketing emails, the sign-up wording should be clear and separate from the main enquiry. Pre-ticked boxes should be avoided; active choice is a stronger basis for demonstrating genuine consent.
Privacy notices should be easy to find and written in plain English. A short note beside a form can explain the immediate purpose, with a link to a fuller privacy policy. For example, a contact form might state that the details will be used to respond to the enquiry and will not be added to a mailing list unless the person chooses to subscribe. This approach can improve confidence without cluttering the page.
Website owners should also check how form submissions are handled. Are enquiries sent by email to a shared inbox? Are they stored in the website database? Does a plugin retain a copy? Are backups encrypted or access-controlled? If a website is rebuilt, will old data be exported, deleted or transferred? These technical details are easy to overlook during a redesign, but they are central to responsible data management.
Review email marketing permissions
Email remains one of the most effective digital marketing channels, but it depends on trust. GDPR preparation should include a careful review of how subscribers join your list and how their preferences are recorded.
In 2016, many UK businesses are already familiar with the Privacy and Electronic Communications Regulations, which sit alongside data protection law for electronic marketing. GDPR adds further emphasis on accountability and the ability to demonstrate how consent was obtained where consent is being relied upon.
Look at your subscription forms and records. Can you show when someone signed up, which form they used and what they were told at the time? Does your email marketing platform store the source of subscription? Is there a clear unsubscribe link in each campaign? Are unsubscribed contacts properly suppressed rather than re-imported later by mistake?
It is sensible to begin improving permission quality now. This may include refreshing website sign-up wording, segmenting contacts by source, removing inactive or uncertain records and planning a re-permission campaign where appropriate. A smaller, more engaged list is usually better for deliverability, reporting and brand reputation than a large list of people who do not recognise the sender.
Consider social media advertising and audience data
Social media marketing also involves personal data, even when much of the activity takes place within third-party platforms. Businesses may use social networks for competitions, lead generation forms, customer service, remarketing, uploaded customer audiences or direct messages. Each of these should be considered during GDPR preparation.
If you run social competitions, make the entry terms clear and avoid collecting more information than necessary. If you invite people to submit details through a social lead form, explain how those details will be used after the enquiry is received. If you upload customer data to create an advertising audience, document the source of that data and ensure the use is consistent with what customers would reasonably expect.
Social media teams should also think about account access. Who has administrator permissions? Are former employees or old agencies still connected to company accounts? Are passwords shared informally? Although GDPR is often discussed in relation to consent, security and access control are also important. A focused access review can reduce risk across marketing activity.
For businesses using remarketing, cookie notices and privacy policies should be reviewed. Visitors should be informed about the use of cookies and similar technologies, including advertising and analytics cookies. The wording should be understandable rather than filled with technical jargon.
Domain registration, ownership and contact details
Domain names are sometimes forgotten in data protection discussions, yet they are part of a business’s digital identity. A domain registration can include personal contact details, administrative email addresses and ownership information. It is important that these details are accurate, professional and controlled by the business.
Review who is listed as the registrant and administrative contact for your domains. Where a domain is used for business, avoid relying on an individual’s personal email address if that person may leave the organisation. Use an appropriate business-controlled contact route and make sure renewal notices reach the right people. Losing access to a domain can cause serious disruption to a website, email, SEO performance and brand credibility.
When registering new domains, keep a record of the purpose of each domain, who approved the registration, which email address is used for administration and where login details are stored. If an external supplier manages domain settings for you, confirm what level of access they hold and what process exists if the relationship ends. The aim is not to make domain management complicated, but to ensure the business remains in control of its own digital assets.
Domain privacy options and public registration details should also be considered in line with the nature of the domain and the relevant registry rules. The key point for GDPR preparation is to avoid unnecessary exposure of personal contact data while maintaining accurate records and reliable administration.
Technology, suppliers and security
Most digital marketing activity involves third-party technology. A website may be hosted by one supplier, maintained by another, connected to an email platform, integrated with analytics and supported by a CRM. GDPR places importance on understanding these relationships and ensuring personal data is handled responsibly.
Start by listing the suppliers and platforms that process customer or prospect data on your behalf. This may include web developers, hosting providers, email marketing systems, CRM platforms, analytics tools, payment processors, call tracking services, survey tools and digital agencies. For each, identify what data they can access and why.
Contracts and terms should be reviewed in good time. Businesses should understand where data is stored, what security measures are offered, how data can be exported or deleted, and what happens if there is a breach. Some suppliers will update their terms as 2018 approaches, but businesses should not wait passively. Asking the right questions now will make future decisions easier.
Security basics matter. Use strong, unique passwords for marketing platforms. Restrict administrator access to those who need it. Remove old users promptly. Keep website software, themes and plugins maintained. Use secure hosting and consider HTTPS, especially where forms or account areas are involved. HTTPS can also support user trust and has been a positive signal within search for some time.
Backups deserve attention too. A backup is still a copy of personal data. Make sure backups are stored securely and retained for a sensible period. If a person’s data is deleted from the live system, consider whether and how it remains in backups, and document your approach.
SEO, analytics and measurement
GDPR preparation should not be seen as a threat to search marketing. Good SEO is built on useful content, technical quality, trust and a clear understanding of users. Responsible data handling supports these aims.
Analytics should be configured thoughtfully. Businesses should know which analytics tools are installed, what they measure and who has access to reports. If old tracking scripts remain on a site after previous campaigns, remove them. If multiple agencies have historic access to analytics or search accounts, review and tidy permissions.
Search marketing teams should also be careful with landing pages. Lead generation pages often collect data in exchange for guides, consultations or downloads. The offer should be clear, the form should not ask for unnecessary information, and the follow-up marketing should match the permission given. Misleading forms may generate short-term leads, but they can damage trust and list quality.
Privacy pages can also contribute to credibility. They are not usually written for search rankings, but they are part of the overall trust signals a visitor encounters before making an enquiry. A clear privacy policy, accessible contact details and consistent business information all help present the organisation as professional and reliable.
Make GDPR preparation part of your digital roadmap
The most effective approach is to include GDPR preparation in planned digital projects rather than treat it as a last-minute separate task. If you are commissioning a new website, include privacy requirements in the brief. If you are changing CRM, map data fields and permissions before migration. If you are planning a content marketing campaign, decide how sign-ups will be recorded before launch.
A practical roadmap might include a data audit, form review, privacy notice update, email list clean-up, supplier review, access control check and staff awareness session. Each stage should have an owner and a sensible deadline. Smaller businesses do not need unnecessary bureaucracy, but they do need clarity.
It is also helpful to involve different departments. Marketing may collect the data, sales may use it, customer service may update it and management may rely on reports. GDPR preparation is stronger when these teams agree on shared processes. For example, everyone should know what to do when a contact asks to unsubscribe, update their details or understand what information is held about them.
A positive step for better digital business
GDPR will bring new responsibilities, but it also encourages better discipline. Businesses that understand their data can market more intelligently, design more effective websites and build stronger relationships with customers and prospects.
For UK business owners, the message is straightforward: start now, keep it practical and make improvements as part of your wider digital strategy. Review your forms, permissions, suppliers, domain administration, analytics and security. Remove what you do not need, explain what you do need and give people clear choices.
By treating GDPR preparation as a business improvement project rather than a box-ticking exercise, digital marketing teams can enter 2018 with cleaner data, better systems and a more trustworthy online presence.
