A Data Protection Day Checklist for B2B Websites
Every year on 28 January, the data protection community marks Data Protection Day. It has been running since 2006 and commemorates the signing of Council of Europe Convention 108 in 1981, the world’s first binding international treaty on personal data. Find out more about the campaign and this year’s theme at the official Data Protection Day site.
Privacy is easy to treat as a compliance job that belongs with Legal. For B2B marketers it is much more than that. The forms that capture leads, the cookies that power tracking, the CRM fields that hold prospect data, the newsletters that go out each month. Every one of them is a data protection touchpoint, and every one of them is an opportunity to do things properly or to cut a corner that will come back to bite you.
Where B2B websites most often slip
When we audit websites ahead of new builds, three patterns keep coming up.
The first is forms that collect more than they need. A “contact us” form that asks for name, email and message is doing its job. A “contact us” form that asks for job title, company size, annual budget and phone number is asking for information the visitor has no reason to provide yet. Data minimisation is both a principle of the UK GDPR and a conversion-rate win.
The second is cookie banners that pretend to ask but do not listen. If “Accept” and “Reject” are not equally prominent, if the banner pre-ticks non-essential categories, or if trackers fire before the visitor has had a chance to choose, you have a consent problem. The UK ICO’s guidance on cookies is direct about what freely given consent actually looks like.
The third is stale privacy content. Policies that still name your 2020 CRM, list an email address nobody monitors, or reference legislation that has moved on. Privacy policies get read when something goes wrong. Make sure yours reflects the tools you actually use today.
A practical refresh for Data Protection Day
- Walk through every public form as if you were a suspicious buyer. Do the fields match the stated purpose? Is there a clear privacy statement near the submit button?
- Audit your cookie categories against what is actually firing on the page. Misalignment between what consent says and what scripts do is the biggest source of enforcement action.
- Read your privacy policy and cookie policy out loud. Anything you would not say to a prospect on a call probably does not belong there.
- Review your retention periods. How long do contact records sit in the CRM after a deal goes cold? Twelve months? Forever? Decide, write it down, and enforce it.
- Check your third-party processors. Every SaaS tool that handles personal data should be covered by a data processing agreement. The list should be short enough to remember and long enough to be honest.
None of this requires a legal qualification. It does require an afternoon, ideally spent alongside whoever looks after your website’s technical infrastructure.
Where marketing and IT should meet
Marketing decides which tools go on the website. IT decides how those tools are configured, hosted and protected. Data Protection Day is a good excuse to put the two teams in a room and walk through the stack together. That usually surfaces scripts nobody remembers adding, forms nobody owns, and vendors that expired two renewal cycles ago.
Website security and privacy are not the same thing, but they overlap in obvious ways. A brief on improving WordPress security covers the hygiene steps that reduce the chance of a breach reaching your CRM in the first place.
For regulated sectors, the rules bite harder. Healthcare, finance and public sector websites all carry additional obligations on top of the UK GDPR baseline. Our notes on GDPR for healthcare websites run through the extra ground those sectors need to cover.
A final nudge
Data Protection Day is a calendar reminder rather than a deadline. Nothing changes at midnight on 28 January. What changes is whether you took the moment or let it drift past again. An hour spent on forms, cookies and retention beats a week spent explaining an incident that could have been avoided.
If a full technical review feels like more than you can take on this month, a technical checklist for B2B organisations is a good starting point. Work through it, fix the small things, and you will be a long way ahead of most B2B sites by the end of the afternoon.
For the official position, bookmark the Information Commissioner’s Office, keep an eye on enforcement notices, and remember that the Data Protection Act 2018 is still where the UK GDPR lives in law.
