Website security and GDPR: a 2026 checklist

A secure business website is not optional; it is a legal and commercial requirement. In 2026 customers expect HTTPS, a clear cookie policy and transparent information about what happens to data from contact forms.

The Nettivo checklist: (1) an SSL certificate with enforced HTTPS and security headers (HSTS); (2) up-to-date server software and plugins, no default passwords, two-factor login for admin panels; (3) server-side form validation and CSRF protection; (4) a privacy policy and cookie banner compliant with GDPR and the Norwegian Personal Data Act; (5) regular database and file backups, with restores actually tested.

Forms should collect only necessary data. Honeypots and rate limits reduce spam. Server logs should not store passwords or full message contents longer than needed to handle the lead. State your retention period in the privacy policy.

If you use Google Analytics, Meta Pixel or an AI chatbot, you need user consent for non-essential cookies and a data processing agreement (DPA) with the vendor. In Norway cookies are also governed by the Electronic Communications Act (ekomloven, supervised by Nkom) and personal data by Datatilsynet; in Poland the equivalent rules and UODO apply. GDPR fines can reach EUR 20 million or 4% of global annual turnover.

Run a security audit once a year or after any major change to the site. We offer a technical review with recommendations; often a few hours of work close the critical gaps. Write to us: nettivo.no/kontakt.