The website operator is primarily liable for a website’s GDPR compliance in their capacity as the data controller. Neither the contracted web agency nor the data protection officer automatically assumes this liability, even though both play an important supporting role. The following sections explain who bears which obligations, when several parties are jointly liable, and how you can systematically check your website’s GDPR compliance.
Who is the data controller for a website under the GDPR?
Under the GDPR, the data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. For a website, this is usually the business, association or organisation that operates the website and determines its content and technical design.
The decisive factor here is not who built the website technically, but who exercises control over its commercial aspects and content. An online shop operator, for example, decides which tracking tools are used, what data is collected and for what purpose it is processed. It is precisely this decision-making authority that establishes responsibility under data protection law in accordance with Article 4(7) of the GDPR.
In practical terms, this means: Even if an external agency implements the website technically or a service provider handles the hosting, the operator remains responsible for compliance with data protection requirements. They must ensure that the website complies with the requirements of the GDPR at the time of operation and cannot rely on third parties in the event of infringements before supervisory authorities.
Is the web agency also liable if the website is not GDPR-compliant?
In principle, a web agency is not directly liable to the data protection supervisory authority for data protection breaches on a client’s website. External liability under data protection law rests with the operator as the controller. However, the agency may be held liable under civil law in relation to the client if it has breached its contractual obligations.
The decisive factor here is the contractual basis. If an agency has expressly undertaken to deliver a GDPR-compliant solution, and the website, for example, sets cookies without consent or does not contain a privacy policy, the client may assert claims for damages. Conversely, the agency bears no responsibility for decisions that the client has made independently after handover, such as the subsequent integration of a new tracking tool without consultation.
The issue of data processing on behalf of a controller is particularly relevant: if an agency accesses the personal data of website visitors during day-to-day operations – for example, during hosting or maintenance work – a Data Processing Agreement (DPA) must be concluded in accordance with Article 28 of the GDPR. The absence of such an agreement in itself constitutes a data protection breach for which the operator is responsible.
What are the data protection officer’s obligations in relation to the website?
The data protection officer (DPO) has advisory and supervisory obligations in relation to a website, but bears no liability of their own under data protection law. Their duties are set out in Article 39 of the GDPR and include, amongst other things, providing information and advice to the controller and monitoring compliance with the GDPR.
In practical terms, this means for websites that the DPO should regularly check which cookies and trackers are being used, whether a legally valid consent management system is in place, whether the privacy policy is complete and up to date, and whether transfers to third countries are properly safeguarded. This review is not a one-off task, as websites are constantly changing due to updates, new plugins or changes in service providers.
It is important to understand that the DPO can and may make recommendations to the data controller, but is not authorised to make decisions or implement measures independently. If the data controller fails to comply with a recommendation made by the DPO, this relieves the DPO of joint responsibility, provided that they have documented their concerns. External data protection officers working for several clients face the challenge of regularly monitoring numerous websites without spending a disproportionate amount of time doing so.
What happens if several parties are jointly responsible for a website?
If two or more parties jointly determine the purposes and means of data processing on a website, this constitutes joint controllership within the meaning of Article 26 of the GDPR. In this case, all joint controllers are liable to the data subjects, and a transparent agreement must be reached regarding their respective responsibilities.
A typical example is the integration of social media plugins such as the Facebook Pixel or ‘Like’ buttons. The European Court of Justice has confirmed in several judgements that, in such scenarios, website operators and the respective platform operators may be regarded as joint controllers. Similar questions arise when using Google Analytics or other services where the provider also uses the data for its own purposes.
The agreement under Article 26 of the GDPR must specify who fulfils which information obligations towards data subjects and who is responsible for responding to requests for access. Data subjects may exercise their rights against any of the joint controllers, regardless of how internal responsibilities are organised.
What fines and consequences can be incurred for GDPR infringements on websites?
GDPR breaches on websites can have significant consequences. Depending on the severity of the breach, the GDPR provides for fines of up to 20 million euros or four per cent of global annual turnover, whichever is higher. In addition, there is a risk of warnings from competitors or consumer protection organisations, as well as civil claims for damages by data subjects.
In practice, supervisory authorities in the DACH region are showing increasing interest in ensuring that websites are designed in compliance with data protection regulations. Common issues raised include the setting of cookies without prior consent, missing or incomplete privacy policies, the integration of US-based services without a sufficient legal basis, and the absence of data processing agreements with service providers.
In addition to fines, supervisory authorities may also issue orders to cease certain processing activities or to implement technical measures. For businesses that rely on their website, such an order can have immediate commercial consequences. Preventive measures are therefore advisable not only from a legal perspective, but also from an economic one.
How can a website’s GDPR compliance be systematically assessed?
The systematic assessment of a website’s GDPR compliance covers several areas that should be examined regularly and in a structured manner. A comprehensive GDPR compliance assessment includes at least the following areas of review:
- Cookies and trackers: Which cookies are set, when are they set, and are technically non-essential cookies only set after valid consent has been given?
- Consent management: Is there a legally valid consent banner that offers a genuine choice and does not contain any pre-selected consents?
- Privacy policy: Is the privacy policy complete, up to date and easy to find? Are all services used and transfers to third countries communicated transparently?
- Transfers to third countries: Is data transferred to providers in countries outside the EU, and is there an appropriate legal basis for this?
- Data processing: Have data processing agreements been concluded with all relevant service providers?
- Subpages: Have not only the homepage but also all relevant subpages been checked, as different pages may integrate different services?
A manual review of these areas is time-consuming and prone to errors, particularly where websites are updated regularly or comprise many subpages. Websites often change more quickly than a manual review can keep up with, due to CMS updates, new plugins or changes to embedded content. It is therefore advisable to use a combination of structured manual review and automated support to identify gaps at an early stage.
For external data protection officers who manage many client websites, a scalable audit method is particularly important. The drafting of an up-to-date privacy policy should always be based on an actual analysis of the services used, rather than on standard templates that may not reflect the website’s actual state.
How decareto supports you with the GDPR audit of your website
We developed decareto to address precisely the challenges that data protection officers, agencies and compliance teams face on a daily basis when carrying out systematic website audits: too little time, too many websites and high demands for accuracy and traceability.
- Automated GDPR website scan: Our platform scans websites, including subpages, in minutes, detects cookies, trackers, external services and consent banners, and assesses them against GDPR and TDDDG criteria. The scan typically identifies the most relevant compliance vulnerabilities without the need for a manual review of every single subpage.
- Continuous monitoring: We monitor your websites on an ongoing basis and automatically notify you if relevant changes occur, for example if a new external service is integrated or the consent banner is no longer functioning correctly.
- AI-powered analysis: Our AI-powered analysis delivers consistent results and specific recommendations for action, which can be viewed directly in the report without the need for extensive technical prior knowledge.
- Privacy Policy Generator: Based on the scan results, our integrated generator creates tailor-made privacy policies in up to 24 languages, which can be easily updated should changes be required.
- Client reports and white labelling: Reports can be shared directly with clients or delivered under your own logo, which significantly simplifies communication with customers.
decareto is not a substitute for legal advice and does not guarantee full GDPR compliance, but it helps you to identify, document and specifically address vulnerabilities in a structured manner. Find out how many websites you could check automatically in the time it takes to carry out a manual audit: Get started for free now.
