The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law. It has applied since May 25, 2018 and governs how organizations collect, store, use, and share the personal data of people in the EU. It is important to be clear up front: the GDPR is a privacy law, not an accessibility law. It does not contain technical accessibility standards the way the European Accessibility Act or EN 301 549 do. But for website owners, the two worlds overlap in practical ways — your privacy notices, cookie banners, and consent flows are part of your website, and they need to work for everyone, including people who use assistive technology.
If your business has customers or visitors in the EU, the GDPR almost certainly applies to you, even if your company is based elsewhere. It reaches any organization that offers goods or services to people in the EU or monitors their behavior — which includes something as common as running analytics or advertising cookies on a site with European traffic.
This guide explains what the GDPR requires of websites in plain terms, how it is enforced, and where accessibility fits into a sound privacy compliance program.
A privacy law with global reach
The GDPR protects people located in the EU, but it binds organizations anywhere in the world that process their personal data — including US and other non-EU businesses with EU visitors or customers.
Consent must be freely given and informed
Where you rely on consent — cookie banners are the classic example — it must be a genuine, informed choice. Pre-ticked boxes and buried opt-outs don't qualify, and a consent flow that assistive technology users cannot operate is hard to defend as a real choice.
Serious penalties
EU data protection authorities can impose fines of up to 20 million euros or 4% of a company's worldwide annual revenue, whichever is higher, for the most serious violations. Enforcement against everyday website practices like unlawful cookies is routine.
Privacy and accessibility intersect
The GDPR requires information about data processing to be provided in a concise, transparent, and easily accessible form. Accessible privacy notices and consent interfaces are the natural way to meet that transparency duty for all users.
What the GDPR is and why it exists
The GDPR replaced the EU's 1995 Data Protection Directive with a single regulation that applies directly across all EU member states (and, via the EEA Agreement, in Norway, Iceland, and Liechtenstein; the UK retains its own closely related version, the UK GDPR). Its purpose is to give individuals control over their personal data and to harmonize the rules businesses must follow when handling it.
"Personal data" is defined broadly: names and email addresses, obviously, but also IP addresses, device identifiers, location data, and cookie IDs that can single out an individual. If your website sets analytics cookies, runs a contact form, or maintains user accounts, you are processing personal data in the GDPR's sense.
Who must comply
The GDPR applies to organizations established in the EU, and to organizations outside the EU that either offer goods or services to people in the EU or monitor their behavior there. There is no revenue threshold and no minimum company size — a small e-commerce shop shipping to France is covered just as a multinational is, though some record-keeping obligations are lighter for small organizations.
The law distinguishes between controllers (who decide why and how data is processed — typically the website owner) and processors (who process data on a controller's behalf — hosting providers, email platforms, analytics vendors). Controllers carry the primary responsibility, including choosing processors carefully and putting data processing agreements in place.
Core requirements for websites
For a typical website or digital product, GDPR compliance centers on a handful of recurring obligations:
- Have a lawful basis for every processing activity — consent, contract, legitimate interests, or another basis recognized by the law — and document which one you rely on.
- Provide clear privacy information: who you are, what data you collect, why, how long you keep it, who you share it with, and what rights people have.
- Obtain valid consent for non-essential cookies and tracking. Consent must be specific, informed, and as easy to withdraw as it was to give.
- Honor individual rights: access, correction, deletion, portability, and objection. You generally have one month to respond to a request.
- Practice data minimization and privacy by design — collect only what you need, and build privacy into forms and features from the start.
- Secure the data you hold, and report qualifying personal data breaches to your supervisory authority within 72 hours of becoming aware of them.
- Take care with international transfers — sending EU personal data to servers or vendors outside the EU requires an approved safeguard, such as standard contractual clauses or an adequacy decision.
Enforcement and penalties
Each EU country has a data protection authority empowered to investigate complaints, audit organizations, order changes, and impose fines. The headline maximums — up to 20 million euros or 4% of global annual turnover for the most serious infringements, with a lower tier of 10 million euros or 2% for others — are reserved for severe cases, but authorities regularly issue smaller fines and corrective orders for everyday failures like invalid cookie consent or missing privacy notices.
Individuals can also lodge complaints directly and, in some cases, seek compensation. In practice, the bigger day-to-day risk for most small and mid-sized site owners is a complaint-driven investigation that forces rushed, disruptive fixes — which is why building compliant flows up front is cheaper than retrofitting them.
Where accessibility fits in
The GDPR's transparency principle requires that privacy information be provided in a "concise, transparent, intelligible and easily accessible form, using clear and plain language." While the regulation does not cite WCAG, a privacy notice or cookie banner that a screen reader user cannot read, or a consent dialog that cannot be operated by keyboard, undermines that requirement in an obvious way: consent is only meaningful if the person could actually understand and operate the choice.
There is also a converging legal backdrop. The European Accessibility Act's obligations for many digital products and services have applied since June 28, 2025, with EN 301 549 (which incorporates WCAG) as the relevant technical benchmark. For businesses serving EU users, it makes sense to treat privacy UX and accessibility as one workstream: the same cookie banner has to satisfy both regimes.
Practical points of overlap include making privacy policies readable and navigable with assistive technology, ensuring consent banners are keyboard-operable with proper focus management, labeling form fields in data subject request flows, and providing accessible ways to withdraw consent or exercise data rights. Tools like AccessWiser can help you find and address accessibility barriers in these flows, though no single tool — accessibility widget or consent platform — can by itself make a website GDPR compliant.
Practical steps toward compliance
A reasonable starting sequence for a website owner looks like this:
- Map your data: list every place your site collects or receives personal data, including third-party scripts and embedded tools.
- Audit your cookies and trackers, and implement a consent banner that blocks non-essential cookies until the visitor genuinely opts in.
- Publish a clear, current privacy policy and link it from every page and every data collection form.
- Set up a workflow for handling access and deletion requests within the one-month deadline.
- Put data processing agreements in place with vendors, and review where your data physically flows.
- Test your privacy notices, banners, and forms with keyboard navigation and a screen reader so the experience works for all users.
- Prepare a breach response plan so the 72-hour notification window doesn't catch you flat-footed.
Frequently asked questions
Is the GDPR an accessibility law?
No. The GDPR is a data protection and privacy law. It does not set accessibility standards like WCAG. However, its requirement that privacy information be transparent and easily accessible, combined with separate EU accessibility rules such as the European Accessibility Act, means accessible privacy notices and consent flows are part of doing both jobs well.
Does the GDPR apply to my US-based website?
It can. If you offer goods or services to people in the EU or monitor their behavior — for example, through targeted advertising or analytics aimed at EU visitors — the GDPR applies regardless of where your business is located.
Do I need a cookie banner?
If your site sets non-essential cookies or similar trackers for visitors in the EU — analytics, advertising, social media embeds — you generally need to obtain informed consent before setting them. Strictly necessary cookies, such as those for a shopping cart or login session, do not require consent. Make sure the banner itself is usable by keyboard and assistive technology.
What is the difference between GDPR and the European Accessibility Act?
The GDPR governs how you handle personal data; the EAA governs whether your digital products and services are accessible to people with disabilities, using EN 301 549 and WCAG as the technical benchmark. Many EU-facing websites need to comply with both, and their requirements meet in shared surfaces like consent dialogs and account forms.
Can an accessibility widget make my site GDPR compliant?
No single tool can. GDPR compliance involves legal bases, documentation, vendor contracts, and internal processes that go well beyond your website's interface. An accessibility solution helps with one important piece — making your privacy notices, banners, and forms usable by everyone — as part of a broader compliance program.
This article is provided for general information about accessibility regulations and standards. It is not legal advice — consult a qualified professional about your specific compliance obligations.