A business website can collect personal data in more places than its contact form. Analytics, advertising pixels, newsletter tools, embedded videos, live chat, online payments and security logs can all affect how information is handled. This website privacy checklist for Malta businesses helps owners, marketers and developers identify those touchpoints before launch and keep them under review afterwards.
This is a practical website-planning guide, not legal advice. The correct approach depends on the organisation, the people it serves and the data it processes. Where the position is uncertain, obtain advice from a qualified privacy professional.
1. Map every place where the website handles data
Start with an inventory, not a banner. Walk through the website as a visitor, customer, employee and administrator. Record what data enters the site, why it is needed, where it goes, who can access it and how long it remains available.
- Contact, quotation, booking and job application forms
- Email marketing and downloadable-resource sign-ups
- Analytics, heatmaps, advertising pixels and conversion tags
- Payment, ecommerce, membership and account systems
- Chat widgets, maps, videos, social feeds and other embeds
- Hosting logs, security tools, backups and spam protection
A plugin list alone is not enough. A theme, tag manager container or embedded service may also set identifiers or transmit information. Repeat the inventory on mobile and desktop, and while logged out.
2. Identify the organisation responsible
The website should make it clear which legal entity is responsible for deciding how personal data is used and how people can contact it about privacy. Check that the business name, address and privacy contact are consistent across the website, privacy notice, forms and customer communications.
3. Define a purpose and lawful basis for each activity
For each item in the inventory, document a specific purpose. “Marketing” or “business operations” is usually too vague to guide design decisions. A useful record distinguishes, for example, responding to an enquiry, sending a requested quotation, measuring site performance and creating an advertising audience.
Then identify the appropriate legal basis. Consent is not automatically the right answer for every activity. The European Commission explains that processing may rely on consent, a contract, a legal obligation, vital interests, a public task or legitimate interests, depending on the circumstances. The wording and website flow should reflect the basis actually being used.
4. Collect only what the task requires
Review every form field. If a visitor is asking for a callback, do you need a full postal address, date of birth or company registration details at that stage? Removing unnecessary fields supports data minimisation and can also make forms easier to complete.
- Make optional fields visibly optional.
- Avoid free-text boxes when a more limited choice will do.
- Do not request sensitive information through a general enquiry form.
- Set file-upload limits and explain what documents are appropriate.
- Test where submissions are stored as well as where notifications are emailed.
5. Make the privacy notice easy to find and understand
A privacy notice should reflect the website that actually exists, not a generic template copied before the analytics, forms and suppliers were chosen. It should explain who is responsible, what information is collected, why it is used, the legal basis, recipients, retention, transfers, individual rights and how to raise a concern.
Link to the notice from the footer and place concise, relevant information next to important collection points. A link below a form can help, but it should not hide an unexpected use of the submitted information.
List each cookie or comparable technology, its provider, purpose, duration and category. Test the site in a clean browser session before accepting anything. The Malta Information and Data Protection Commissioner publishes specific guidance on cookie consent requirements for websites and mobile applications.
Technologies that are not strictly necessary should not be treated as essential simply because a marketing or analytics plugin describes them as important. Configuration must follow what the technology actually does.
7. Build a genuine preference choice
Where consent is required, the interface should offer a real choice before optional technologies activate. Visitors should be able to refuse as readily as they can accept, understand the categories and change their preferences later. Avoid preselected optional categories, confusing button colours or wording designed to steer people toward acceptance.
Test the consent tool technically. Confirm that rejected tags remain blocked, accepted tags load correctly, the preference link remains available and the site still works when optional categories are refused. Also test after plugin, theme and tag-manager changes.
8. Review every external supplier
Hosting companies, form providers, email platforms, payment processors, analytics services and maintenance partners may receive or access personal data. Keep a register showing the service, role, location, agreement, security information and internal owner.
Do not assume that installing a popular plugin settles the relationship. Check the supplier’s terms, data-processing provisions and sub-processors. Make sure access can be removed when a contract or staff role ends.
9. Check international data transfers
A service can be easy to buy online while its data is hosted or supported outside the European Economic Area. Map those destinations and obtain appropriate advice on the transfer mechanism and safeguards. The European Data Protection Board provides guidance on international data transfers, including adequacy decisions and other safeguards.
10. Set retention and deletion rules
“Keep everything indefinitely” is not a useful retention policy. Define a period or review trigger for enquiries, abandoned form entries, customer accounts, analytics data, security logs and backups. Consider both operational needs and applicable legal requirements.
Deletion should cover hidden copies too. Check form-entry databases, mailboxes, customer systems, exported spreadsheets, cloud storage and backup cycles. Document any copies that cannot be deleted immediately and when they will expire.
11. Protect the website and limit access
Privacy depends on security. Use encrypted connections, individual administrator accounts, strong authentication, the minimum permissions required and a documented update process. Keep the WordPress core, theme and plugins maintained, remove unused extensions and restrict access to backups and form entries.
A website maintenance checklist helps turn these controls into recurring work rather than a one-off launch task. Security measures should be proportionate to the nature, volume and sensitivity of the information involved.
12. Prepare a rights-request workflow
Someone receiving a request needs to know where website-related data may be stored and who can retrieve it. Document how the organisation verifies identity, searches systems, involves suppliers, records decisions and responds securely. Test the process with a sample contact-form submission rather than waiting for a real request.
13. Escalate higher-risk processing early
Websites involving children, health information, financial information, employee monitoring, profiling or large-scale tracking need additional care. Raise these requirements during discovery, not after the site has been built. Privacy by design means considering safeguards, defaults and necessity while the service is being planned.
14. Test privacy requirements before launch
Add privacy checks to the acceptance process in the website development brief and contract. The website development contract checklist can help clarify ownership of accounts, content, testing and handover responsibilities.
- Submit every form and locate every resulting copy.
- Test consent choices in a clean browser and on a mobile device.
- Check privacy links, contact details and preference controls.
- Confirm optional tags do not load before the required choice.
- Verify user accounts, exports and deletion functions.
- Record the approved configuration and responsible owner.
Include these checks in the wider website testing checklist so they are not separated from usability, accessibility and technical quality.
15. Keep a simple privacy maintenance register
Record the date, area reviewed, change found, action needed, owner and completion date. Review the register when a new campaign, plugin, supplier, form or tracking tag is introduced. A consent banner that was accurate at launch can become inaccurate after a single marketing integration is added.
Common mistakes to avoid
- Publishing a privacy template that does not match the website
- Loading analytics or advertising tags before the required choice
- Using consent for every activity without assessing the correct basis
- Forgetting data stored in WordPress, email and backups
- Leaving former staff or suppliers with administrator access
- Treating launch approval as the end of privacy maintenance
Build privacy into the website project
A well-planned website makes privacy requirements visible in the brief, forms, integrations, testing and ongoing maintenance. If you are preparing a new site or redesign, our web design service can help translate business requirements into a practical build plan. Contact Digital Consulting Pros to discuss the website project and the specialists who may need to be involved.
Official guidance
