PIPELINEGuide
Landing page and privacy: what GDPR requires
As soon as a landing page processes personal data, clear obligations apply. What these are specifically, what is almost always missing in practice, and what is actually sufficient.
As soon as a landing page processes personal data, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with each service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for a landing page: a data processing agreement with each service provider involved, checking where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
When can you evaluate a test?
As a rule of thumb, a variant test needs several hundred visitors per variant and at least 25 to 30 conversions, otherwise you're measuring chance. With small numbers, it's more honest to decide based on arguments rather than pseudo-statistics.
What if the landing page doesn't convert?
Then we look at the drop-off points before we rebuild anything. Usually it's a single section, not the whole page — you find it through measurement, not guessing.
Why not simply advertise the homepage?
Because the homepage is there for everyone and therefore concrete for no one. Anyone who clicks on an ad about a specific topic expects exactly that topic — not a menu with eight options.
Does the landing page have to match the website?
Visually yes, structurally no. It may be significantly leaner — often without main navigation, so there's only one way forward.
Can you also run the ads for it?
That's a separate service that we also offer. Landing page and ad should match in content, but technically they are two separate work steps.
How many do we need?
One per offer and target group that is advertised separately. If you sell three services to two target groups, six make sense — provided each gets enough traffic to be assessable.
What definitely belongs on it?
What you offer, for whom, what it costs or at least in what range, who you are, and a single clear next step. Price information scares away less than its absence.
05 — Next
Related pages
- Landing page — Overview
- Landing page — Small businesses
- Landing page — DIY
- Landing page — Common mistakes
- Landing page — Introduction
- Landing page — Cost-effectiveness
- Landing page — 2026 state
- Landing page — Measuring success
- Have a website created
- Google Ads
- SEO
- All guides
Landing page by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.