Website compliance checklists

1. Privacy notice

• Who you are and how to contact you (GDPR Art. 13(1)(a))
• Which processors or third parties receive the data, e.g. booking platform, payment provider, analytics, CRM (GDPR Art. 13(1)(e))
• Purposes of processing (GDPR Art. 13(1)(c))
• Legal basis for each purpose (GDPR Art. 13(1)(c))
• How long you keep data (GDPR Art. 13(2)(a))
• How individuals can access, correct, erase, object or withdraw consent (GDPR Arts. 15–21)
• International transfers (GDPR Art. 13(1)(f))
• A link to the notice from every page footer and next to every form
• An Arabic version if you serve Arabic-speaking customers (good practice)

2. Cookies and trackers

• An inventory of every cookie and third-party script, with its purpose
• Analytics and marketing tags blocked until opt-in (QFC DPO guidance; EU ePrivacy rules; PDPPL guidance as summarised by Chambers 2026)
• "Reject" as easy as "Accept"
• A way to change or withdraw consent later
• Consent records kept

3. Forms and marketing

• Collect only the fields you need (PDPPL)
• A separate, unticked opt-in for marketing (PDPPL)
• Every marketing email or SMS identifies the sender, says it is marketing, and has a working opt-out (PDPPL)
• Extra care with health or other special-nature details (PDPPL)
• Forms submitted over HTTPS only

4. Vendors and processors

• A list of vendors that touch personal data (PDPPL)
• Contracts that require security and prompt breach notice (QFC Art. 31(7); GDPR Art. 28)
• A review against NCSA's Personal Data Sharing Checklist (our guide)

5. Breach contacts

• A named person who decides on notification
• Contact routes for the regulators that apply to you: NCSA, the QFC DPO, an EU authority
• A tested template for notifying individuals
• Logs kept long enough to investigate (QFC DPO enforcement notice, 2024)
• See GCC breach notification: the 72-hour norm and its gaps