PIPELINEGuide
Website relaunch and data protection: what the GDPR requires
As soon as personal data is processed during a website relaunch, clear obligations apply. Which ones specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed during a website relaunch, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practical terms, this means for a website relaunch: a data processing agreement with every service provider involved, verification of where processing takes place, a documented deletion period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Should we carry over all content?
No. Pages that bring neither visitors nor serve a purpose are removed — that makes the site clearer and the remaining pages stronger. What brings visitors is carried over and improved.
What happens to our existing Google Business Profile?
It remains untouched as long as the website address doesn't change. If the domain changes, the link stored in the profile needs to be updated — we take care of that.
Will we lose Google rankings with a relaunch?
Only if you do it wrong. Short-term fluctuation over two to four weeks is normal, a lasting drop is not. The cause is almost always the same: missing or incorrect redirects. We create the list before the move and check it afterward.
Do we have to go offline during the relaunch?
No, the old site stays online until the switchover day. The change happens on a set date, usually outside business hours, and typically takes only a few minutes.
Is a relaunch worth it if we're renaming soon anyway?
Not in that order. Clarify the renaming first, then relaunch — otherwise you build a site that needs adjustment again shortly after.
What happens to our email addresses?
They remain untouched as long as the domain stays the same. We still check the settings before the move, because an incorrectly set record can stop mail delivery.
Can we switch over gradually?
For larger sites, yes — section by section. It takes longer but spreads the risk and cost.
05 — Next
Related pages
- Website relaunch — Overview
- Website Relaunch — Small Businesses
- Website relaunch — practical examples
- Website relaunch — Checklist
- Website relaunch — Funding
- Website Relaunch — Requirements
- Website Relaunch — Integration
- Website Relaunch — Costs
- Have a website created
- SEO
- Web design
- All guides
Website relaunch by region
Next step
Send us a few sentences about your project.
We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.