Does your website pass a GDPR check?
Scan your site in about 30 seconds to see what loads before a visitor agrees to cookies, then answer the rest of up to 41 yes/no checks. Every “No” shows what it risks and the fixed-price service that fixes it.
No sign-up · Progress saved in your browser · References to GDPR articles
Two quick questions, then start
This cuts the list down to what applies to you.
What this check can’t see
A regulator also asks for things that are not visible from outside your website. Passing every check above is a good sign, not a compliance certificate.
- Records of Processing (RoPA)The register of what personal data you process and why.€359 · 5 business days
- Processor contracts and SCCsWritten agreements with every vendor that handles your customers' data.€449 · 7 business days
- DPIAA documented risk assessment for high-risk processing such as profiling.€449 · 7 business days
- Ongoing complianceQuarterly reviews so the documents stay true as your site changes.€729/month · Ongoing monthly
Frequently Asked Questions
Is this a GDPR audit?
No. It covers what anyone can see from outside your website. Internal obligations such as records of processing, processor contracts and DPIAs need a document review. The GDPR Technical Compliance Audit covers both.
Do I need technical skills?
Sections 1, 3, 4 and 5 need only a browser. Sections 2 and 6 use the browser's developer tools; each check has step-by-step instructions. If you can't check something, answer “Not sure”.
Is my data stored?
Your answers stay in your own browser (localStorage) so you can come back later. We receive your answers, email and website only if you submit the form. If you accept analytics cookies, we also see anonymous usage statistics, such as which checks people fail most often, with nothing that identifies you or your site.
Does it apply to websites outside the EU?
Yes, if you offer goods or services to people in the EU or monitor their behaviour (GDPR Art. 3(2)). Moldova's Law 195/2024 follows the same model, so the same checks apply to Moldovan sites.
What do the fixes cost?
Each fix is a fixed-price service with a published price. The fix plan adds them up for you, excluding VAT.
Do you certify that my site is compliant?
No. Preparation and documentation only. Optimum Web is not a certification body and does not perform audits.
What does the website scan do to my website?
It opens your page once in a headless browser, the way a first-time visitor in Europe would, and clicks nothing. It records which cookies are set and which third-party services are contacted before any consent, whether a cookie banner appears, and your security headers and email records (SPF, DMARC). It sends no consent, fills no forms and does not crawl other pages, so it looks like one ordinary visit in your logs. The visit identifies itself in the user agent as OptimumGDPRCheck, so you can recognise it.
Can I scan any website?
Scan only websites you own or are allowed to check. The scan reads only what any visitor can see, and it refuses private or internal addresses. If a site shows a bot check we can't pass, the scan stops and you can answer the checklist yourself.
How long do you keep scan reports?
90 days, then they are deleted. A report holds the scanned address (without query strings), the technical findings, a screenshot and the time of the scan. Anyone with the report link can open it, so share it with care. We don't store your IP address with a report.
Prefer an engineer to check it?
We check all of this on your real site and hand you a prioritised fix plan.