PIPELINEGuide
Accessible Website and Privacy: what GDPR requires
As soon as personal data is processed on an accessible website, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed on an accessible website, you need a legal basis, purpose limitation, defined retention periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the retention period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for an accessible website: a data processing agreement with every service provider involved, checking where processing takes place, a documented retention period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined retention period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Is an accessibility overlay sufficient?
No. These overlays do not fix the underlying problems and are largely rejected by disability advocacy groups. They can even create additional barriers. Accessibility is created in the markup, not in a layer on top.
How long does a complete audit take?
For a medium-sized website, one to two weeks, depending on the number of different page types and interactive elements such as forms or filters.
What is the most common error?
Forms without linked labels and controls that cannot be reached with the keyboard. Both go unnoticed by anyone working with a mouse — and make the site unusable for others.
Does this also apply to PDF documents on the website?
Yes, if they contain essential information — such as price lists or downloadable forms. PDFs must also be structured with alternative texts.
Are we affected by the Barrierefreiheitsgesetz?
The Austrian Accessibility Act has been in force since June 28, 2025, and primarily applies to online services in the consumer sector: online shops, bookings, e-ticketing, banking services. Microenterprises with fewer than ten employees and less than two million euros in revenue are exempt for services — but not for the sale of products. A purely informational site without sales is generally not covered.
How much work is involved for an existing site?
It varies widely. A well-built site often only needs contrast corrections, alternative texts, and focus indicators. A site with custom-built controls without keyboard support can be more work than building from scratch.
Can we implement this step by step?
Yes, by priority: first the defects that completely block usage, then those that make it difficult. This can be spread across several stages without taking the site offline in the meantime.
05 — Next
Related pages
- Accessible Website — Overview
- Accessible Website — Provider Comparison
- Accessible Website — Common Errors
- Accessible Website — Duration
- Accessible Website — Funding
- Accessible Website — Where to Start
- Accessible Website — Costs
- Accessible Website — Small Businesses
- Have a website created
- Web design
- Website relaunch
- All guides
Accessible Website by Region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.