Website Compliance Monitoring: GDPR, Cookies, and Accessibility Basics

Most small business websites weren't audited for compliance when they launched, and nobody re-checks them as the site changes. That gap is where most of the real risk sits -- not in some obscure edge case, but in a handful of common, easy-to-miss issues that a one-time review won't catch once the site has been edited a dozen times since.

The gaps that show up most often

• No lawful basis stated -- a privacy policy that describes what data is collected but never says why you're allowed to process it.
• Missing data subject rights -- no mention of the right to access, correct, or request erasure of personal data.
• Cookie banners that don't actually block anything -- a banner that displays but sets tracking cookies regardless of the visitor's choice.
• No stated retention period -- data collection described with no indication of how long it's kept.
• Accessibility basics -- missing alt text, insufficient colour contrast, and form fields with no associated labels, all of which overlap with the broader web accessibility standards under WCAG.

Why this drifts even when nobody changes it on purpose

A site rarely fails compliance on day one and stays that way -- it drifts. A new analytics script gets added without updating the cookie banner. A page gets redesigned and the privacy policy link moves somewhere less visible. A new signup form collects an extra field nobody added to the retention policy. None of these are deliberate, and none of them show up unless someone -- or something -- actually re-checks.

What automated scanning can and can't do

An automated compliance scan is good at flagging structural, checkable issues: is there a cookie banner, does the privacy policy mention specific rights, are cookies being set before consent. It is not a substitute for legal advice, and it can't judge whether your lawful basis is actually correct for your specific processing activity -- only whether one is stated at all. Treat it as a first pass that catches drift between real reviews, not a replacement for one. For the UK specifically, the Information Commissioner's Office guidance for small organisations is a solid starting point for understanding what's actually required.

How this fits alongside performance and uptime checks

Compliance issues share the same underlying problem as performance regressions and outages: they're invisible unless something is checking on a schedule. Running all three checks together -- uptime, performance, and compliance -- on the same cadence means you find out about drift from your own monitoring, not from a visitor complaint or a regulator's letter.

See our compliance check disclosures for exactly what SREmonitor's automated scan does and doesn't cover.

A short checklist

1. Confirm your cookie banner actually blocks non-essential cookies until consent is given.
2. Check that your privacy policy states a lawful basis and mentions data subject rights.
3. Check retention periods are stated somewhere, even briefly.
4. Run an accessibility pass -- alt text, contrast, and form labels catch a large share of common issues.
5. Re-check after every content or tooling change, not just once a year.