Why GDPR Compliance Matters for Nonprofit Websites

GDPR applies to any organisation that processes personal data of people in the UK or EU, and that includes your website. Every time someone fills in a contact form, makes a donation, signs up for a newsletter, or even visits a page that sets cookies, your website is processing personal data.

For nonprofits, GDPR compliance is both a legal obligation and a credibility signal. Institutional funders conducting due diligence check whether your website handles data responsibly. A privacy policy that hasn’t been updated since 2018, a cookie banner that doesn’t actually block tracking scripts, or contact forms that don’t explain how data will be used: these are governance failures that undermine the trust you’re trying to build.

This checklist covers the specific GDPR obligations that apply to nonprofit websites on Webflow, what to check, and what to fix.

Section 1: Privacy Policy

Checklist

  • Privacy policy exists and is accessible from every page (typically in the footer)
  • Privacy policy is written in clear, plain English, not legal boilerplate copied from another site (Article 12(1))
  • Policy identifies the data controller (your organisation name, registered address, contact details) (Article 13(1)(a))
  • Policy specifies what personal data is collected through the website: contact form submissions, donation data, newsletter sign-ups, cookies and analytics data, any other data collection points
  • Policy explains the legal basis for each type of data processing (consent, legitimate interest, contractual necessity), as listed in Article 6
  • Policy explains how long data is retained and when it is deleted
  • Policy explains data subject rights: access, rectification, erasure, restriction, portability, objection (Chapter III)
  • Policy includes contact details for data protection enquiries (email address, not just a generic contact form)
  • Policy states whether data is shared with third parties and, if so, which ones (donation platforms, email marketing services, analytics providers)
  • Policy includes the date it was last reviewed or updated

Common Failures

The most common privacy policy failures on nonprofit websites: the policy exists but hasn’t been updated since GDPR came into effect in 2018, it was copied from a template and doesn’t reflect what the site actually does, it doesn’t mention third-party services that the site clearly uses, or it’s buried in a page that’s not linked from the main navigation or footer.

Checklist

  • Cookie consent banner appears on first visit
  • Banner offers genuine choice: Accept, Reject, and Customise options (not just “Accept” with a hidden reject option). The ICO says it must be as easy to refuse as to accept
  • No tracking or analytics cookies fire before consent is given (PECR regulation 6); verify this in browser developer tools
  • Cookie preferences can be changed after initial choice (usually via a link in the footer)
  • Cookie consent integrates with Google Consent Mode v2 if you use Google Analytics or Google Ads
  • Cookie categories are clearly explained: Necessary, Analytics, Marketing, Preferences
  • Cookie consent settings persist correctly across page navigation and return visits

Two things changed on 5 February 2026: the ICO's maximum penalty for a serious PECR breach rose to £17.5 million or 4% of global annual turnover, and a new statistical-purposes exception permits analytics without consent only where the output is aggregate data that is not personal data, visitors can object simply and free of charge, and any provider acts solely on your behalf.

How to Check

Open your site in an incognito/private browser window. Before clicking anything on the cookie banner, open the browser’s developer tools, go to the Application tab, and check what cookies have been set. If you see Google Analytics cookies (_ga, _gid) or any marketing cookies before you’ve given consent, your implementation is broken.

For implementation guidance, see my full walkthrough on CookieYes and Google Consent Mode v2 setup.

Section 3: Contact Forms and Data Collection

Checklist

  • Every form that collects personal data includes a link to the privacy policy
  • Forms include a clear statement of what will happen to the data (“We’ll use this to respond to your enquiry and won’t share your details with third parties”)
  • Newsletter sign-up forms use explicit opt-in (not pre-ticked checkboxes, which the ICO's consent guidance says do not constitute consent)
  • Form data is transmitted securely (HTTPS; verify SSL is active)
  • Form submissions are stored securely and accessible only to authorised staff
  • There is a defined process for handling data subject access requests received through the website

Webflow-Specific Notes

Webflow native forms store submissions in the Webflow dashboard. These are accessible to anyone with site access, so ensure your Webflow workspace permissions are appropriately restricted. If you use third-party form embeds (HubSpot, Mailchimp), the data goes to those platforms, so ensure your privacy policy names them as data processors.

For related guidance, see Setting up Webflow forms.

Section 4: Donation Processing

Checklist

  • Donation platform (Fundraise Up, Donorbox, Enthuse, etc.) is named in the privacy policy as a data processor
  • Donation page explains that payment data is handled by the third-party platform, not stored on the Webflow site
  • Donation confirmation includes or links to privacy information
  • Gift Aid declarations (if applicable) include appropriate data handling notices (HMRC requires the donor's name and home address)
  • Recurring donation terms include information about how to cancel and how data is managed after cancellation

Section 5: Analytics and Tracking

Checklist

  • Google Analytics 4 (or equivalent) is configured to respect cookie consent, so it does not fire until consent is granted
  • IP addresses: GA4 does not log or store them for UK, EU and Swiss traffic, so there is nothing to switch on; verify any other analytics tool
  • Data retention settings in GA4 are set deliberately (standard properties offer 2 or 14 months; you may want 14 for reporting purposes)
  • Any additional tracking scripts (Meta Pixel, LinkedIn Insight Tag, Hotjar, etc.) are blocked until marketing consent is granted
  • Google Tag Manager is configured with consent mode integration

For GTM setup guidance, see Analytics and consent on Webflow: GTM, GA4 and Consent Mode V2.

Section 6: Third-Party Services

Checklist

  • All third-party services that process personal data through the website are identified and listed
  • Each service is named in the privacy policy with a description of what data it processes
  • Data Processing Agreements (DPAs) are in place with all third-party processors, as Article 28(3) requires
  • Third-party services store data in jurisdictions covered by UK adequacy regulations, or with appropriate safeguards where not

Common Third-Party Services on Nonprofit Webflow Sites

Google Analytics 4, Google Tag Manager, CookieYes, donation platform (Fundraise Up, Donorbox, Enthuse), email marketing (Mailchimp, Campaign Monitor, HubSpot), CRM (HubSpot, Salesforce), embedded video (YouTube, Vimeo), social media embeds (Twitter/X, Instagram).

What the ICO Expects From Charities

The Information Commissioner’s Office (ICO) regulates charities as it does any other data controller. Key expectations:

  • Charities that process personal data pay the ICO's data protection fee unless exempt: a charity is tier 1 whatever its size, £52 a year since 17 February 2025. The not-for-profit exemption is narrow (membership, support and member activities only); the ICO's self-assessment settles it
  • A Data Protection Officer is mandatory only in the Article 37 cases: public authorities, large-scale monitoring, or large-scale special-category data. Otherwise the ICO expects sufficient staff and resources and a clearly identified person responsible
  • Fundraising communications must comply with both GDPR and PECR. Regulation 22 requires consent for marketing email; since 5 February 2026 charities have a soft opt-in for people who expressed interest or offered support, with a simple, free way to refuse when details are collected and in every message. This affects newsletter sign-ups and donation follow-up
  • The ICO has fined charities for data handling failures: in December 2016 and April 2017 it fined thirteen charities for wealth screening donors, tracing lapsed donors and trading donor data

Annual GDPR Review Checklist

GDPR compliance is not a one-off task. Schedule an annual review covering:

  • Privacy policy accuracy: does it still reflect what the website actually does?
  • Cookie consent functionality: does the banner still work correctly after any site updates?
  • Third-party service audit: have you added or removed any services that process personal data?
  • Data retention: are you deleting data that has passed its retention period?
  • ICO fee: is it paid up?
  • Staff awareness: does the team know how to handle data subject access requests?
  • Breach procedure: if personal data were lost or exposed, does the team know who decides and who reports? Article 33 requires a reportable breach to be notified to the ICO “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, and where the risk to people is high the ICO expects those affected to be told directly and without undue delay. The clock starts when you become aware, not when the investigation finishes

This review should be documented and included in your website governance records. For the governance framework, see How to Create a Website Governance Policy.

For a comprehensive assessment of your site’s GDPR compliance alongside accessibility, content, and governance, the Blueprint Audit covers all of these areas as an integrated review.

Further Reading