--- title: "Website Technology Audits and the GDPR | Pitch" description: "What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks." url: https://www.pitch.law/academy/website-technology-audits-and-gdpr --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # Website Technology Audits and the GDPR What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework A website is a processing operation. Whenever a visitor loads a page, their IP address reaches your server and, usually, servers of third parties whose scripts, fonts, maps, video players or analytics are embedded. The legal duties that follow are spread over several rules. - **Transparency (Articles 12 to 14 GDPR).** Visitors must be told who is responsible, why data is processed, on what basis, who receives it, where it goes and how long it is kept. The privacy notice must describe what the site actually does. - **Lawfulness (Article 6).** Each purpose needs a legal basis. For tracking, that is generally consent, which the ePrivacy rules require anyway for storing or reading information on the device (Article 5(3) of the ePrivacy Directive). - **Controller roles (Articles 26 and 28).** The Court of Justice held in _Fashion ID_ (Case C-40/17) that a website operator that embeds a third-party plug-in can be a joint controller for the collection and transmission of the visitor's data to that third party. A processing agreement is needed for providers acting as processors. - **Transfers (Chapter V).** Many embedded services send data to servers outside the EEA, which needs a transfer basis. See [international data transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii). - **Security and privacy by design (Articles 25 and 32).** Encrypted connections, access controls, form handling and defaults that collect no more than necessary. - **Accountability (Article 5(2)).** You must be able to show the above, which includes the [record of processing](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know). ### What an audit examines A technology audit compares the privacy notice and the consent banner with what the website really does. It typically covers: - all cookies, pixels, local storage and scripts loaded, before and after consent, with the party behind each; - the behaviour of the consent banner: whether tags are blocked until consent, whether rejection works, whether the consent is recorded; - third-party requests, such as fonts, maps, video, chat widgets, tag managers, and the countries of the servers receiving them; - forms: what is collected, with which legal basis, where it goes (CRM, email tool, spreadsheets) and for how long it is kept; - the privacy notice and cookie policy against these findings; - security basics such as HTTPS, headers and the handling of data in forms. The result is a list of findings by risk, with the legal rule, the evidence and the fix. ## In practice A Limburg manufacturer relaunches its website with an agency. Its privacy notice, drafted two years ago, mentions a single analytics tool. The audit finds seven: the analytics tool, an advertising pixel, a heat-map tool, a chat widget, an embedded video player that sets cookies, a font service loaded from a US server and a form plug-in that stores submissions on a third-party server. Four of them load before the visitor makes a choice in the banner. The audit leads to concrete decisions. The heat-map tool is removed, since the manufacturer cannot justify it. The video player is switched to a mode that sets no cookies until playback. Fonts are hosted locally. The tag manager is configured to wait for consent. The form data now goes to the manufacturer's own CRM, with a processing agreement with the CRM provider. The privacy notice and cookie policy are rewritten to match, and the register has new entries for each tool. ### Why repeat it Websites change constantly: a marketing team adds a tag, a plug-in updates, an agency swaps a supplier. A one-off audit becomes stale. Run it again after major changes and at a fixed interval, and assign an owner for tag approvals. ## Frequently asked questions ### Is a cookie banner enough? No. The banner is one part. The tags must really be blocked until consent, the notice must be accurate and the third-party relationships must be documented. ### Does a purely informational website have to comply? Yes. A static site that loads an analytics script, a map or a font service processes visitors' personal data. A site that loads nothing from third parties and keeps minimal server logs has a much lighter footprint. ### Who is liable, the agency or the website owner? The owner is responsible as controller. The agency can be liable to the owner under their contract, so the contract should say who must deliver a compliant configuration. ### Do we need a DPIA for tracking on our website? Not always. Extensive profiling, tracking across sites or processing of sensitive data may call for one. The screening of the [DPIA function](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) helps decide. ## How this connects Website audits feed directly into [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service): findings become register entries in the [privacy register](https://www.pitch.law/technologies/privacy-register) and tasks that your team and the DPO follow in the [client portal](https://www.pitch.law/technologies/client-portal). Consent design is covered in [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management). ## In short - What an audit examines - Why notices and reality drift apart - Duties for embedded third-party tools ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) ## Technology we use - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/client-portal) ### [Client Portal](https://www.pitch.law/technologies/client-portal) [A secure place where you follow your matters, instruct us on deadlines, work on registers with us and see your IP portfolio, in the same environment as our work.](https://www.pitch.law/technologies/client-portal) ## More in Privacy & Data Protection - ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)