PIPELINEGuide
SEO and privacy: what GDPR requires
As soon as SEO processes personal data, clear obligations apply. What those are specifically, what's almost always missing in practice, and what actually suffices.
As soon as SEO processes personal data, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every involved service provider. In practice, the same three points are almost always missing: the deletion period, the notice at the collection point, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practical terms for SEO, that means: a data processing agreement with every involved service provider, verification of where processing occurs, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
What's the difference between SEO and Local SEO?
SEO covers a website's entire visibility, Local SEO is the subset for location-based searches with map display. For regional businesses, both overlap significantly, which is why we often tackle them together.
Which is more important, technology or content?
Technology is the prerequisite, content is the lever. A technically perfect site with no answers won't rank. A content-strong site with technical flaws often ranks anyway — just worse than it could.
What does SEO cost monthly?
That depends heavily on competition in your market — a regionally active business needs noticeably less ongoing effort than a provider in a contested field. For very small budgets, a one-time project plus self-maintenance is often the more honest recommendation than ongoing support. What makes sense in your case, we'll discuss in the initial consultation.
How long does SEO take?
With an existing domain, initial movement is visible after eight to sixteen weeks, reliable results after six to twelve months. With a new domain, longer. Anyone promising faster results either means paid ads or search terms that no one is searching for.
How often do we get a report?
Monthly, with the metrics that are relevant to you — positions for your most important search terms, visibility trends, and the next steps derived from them, not just a graveyard of numbers.
Is SEO dead because of AI answers in search?
The share of searches without a click is rising, that's true. What's increasing is the value of concrete, well-structured content — because that's exactly what gets cited in AI answers. What no longer works are thin texts that just repeat search terms. This is a shift, not an end.
Can you guarantee first place?
No, and nobody can do that credibly. What we can promise is the work: analysis, implementation, measurement — and an honest assessment of which search terms are actually achievable in your competitive environment.
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.