What "DSGVO-safe" actually means
DSGVO is the German name for the GDPR - the EU data protection regulation. "DSGVO-safe" is not a certificate or a badge you buy. There is no official seal that makes a website compliant. It describes a state: your site handles personal data the way the law expects.
In plain terms, that state rests on a few principles:
- Lawful basis - you have a valid reason to process each piece of personal data (consent, a contract, or a legitimate interest).
- Data minimisation - you collect only what you genuinely need, and keep it only as long as you need it.
- Transparency - people can see what you collect and why, in a privacy policy that reflects what the site actually does.
- Control - visitors can decline optional tracking, and later change or withdraw that choice.
- Security - data travels and is stored safely (HTTPS, EU hosting, access limited to who needs it).
Note that a personal data is broader than most people assume. An IP address counts. So does an email in a contact form, a name in a booking, or a cookie ID that follows someone around.
What it does not mean
Most trouble comes from treating one piece as if it were the whole thing. "DSGVO-safe" is not:
- "We have a cookie banner" - a banner that only offers "Accept" is often the problem, not the fix.
- "We host in Germany" - EU hosting helps, but a single US tracker loading in the background undoes it.
- "We have a privacy policy" - a generic template that does not match your forms and tools can be worse than none.
- "We did it once at launch" - it is an ongoing state. New plugins, embeds and tools quietly change your exposure.
Why it is risky to get wrong
In Germany the practical risk is rarely a giant regulator fine for a small business. It is the Abmahnung: a formal cease-and-desist letter, usually from a lawyer or a competitor, demanding you fix the issue, sign a penalty-backed declaration, and pay their legal fees. They are cheap to send at scale and land on ordinary local businesses. On top of that sit individual damages claims and, for bigger or repeated cases, supervisory-authority fines. Here are the ones that actually catch people out.
Google Fonts loaded from Google's servers
A Munich court ruled in 2022 that embedding Google Fonts the default way - which sends each visitor's IP address to Google in the US - violated the visitor's rights, and awarded damages. It triggered a wave of automated warning letters to thousands of German sites. The fix costs nothing: self-host the same fonts so no IP leaves your server.
Google Analytics firing before consent
Austrian and French authorities have found standard Google Analytics use unlawful because it transfers data to the US. If your analytics script runs the moment the page loads - before anyone clicks "Accept" - you are processing data with no legal basis. Analytics has to stay switched off until the visitor opts in.
Embeds that load before you ask
A YouTube video, a Google Map, a Meta or LinkedIn pixel, a chat widget - each of these contacts a third-party server and can set cookies the instant the page opens. That is tracking without consent. Embeds need a "click to load" placeholder or a consent gate in front of them.
A cookie banner that nudges people to "Accept"
Consent has to be as easy to refuse as to give. Banners with a bright "Accept all" and a hidden or greyed-out decline, pre-ticked boxes, or "keep scrolling to agree" do not produce valid consent - and are themselves a documented source of complaints and warnings.
Forms and contracts behind the scenes
A contact or booking form sent over plain HTTP, form data emailed around unencrypted, a newsletter with no double opt-in, or using a hosting and tool stack without a data processing agreement (AVV) in place - all are common findings. They are invisible to visitors but easy for a checker, or a disgruntled ex-customer, to spot.
What getting it wrong can cost
A single Abmahnung typically bundles legal fees in the few-hundred to low-four-figure euro range, plus a signed declaration that makes any repeat far more expensive. Individual damages claims for something like the Google Fonts case have been in the low hundreds each - trivial alone, serious when one letter goes to hundreds of sites. And the time and stress of responding is its own cost. The point of being DSGVO-safe is not fear of a headline fine; it is closing the cheap, well-known gaps that make you an easy target.
How to minimise your exposure
You will not achieve mathematical certainty, and anyone promising that is selling something. But most real-world exposure comes from a short list of known issues, and almost all of them are cheap to fix. Work through these.
Hosting and assets
- Host the site in the EU.
- Self-host fonts, icons and scripts instead of loading them from US servers.
- Serve everything over HTTPS.
Consent and tracking
- Only essential cookies run by default; analytics and marketing tools stay off until opt-in.
- The banner lets people decline as easily as accept, with no pre-ticked boxes.
- The choice is remembered and can be changed or withdrawn later.
- Put a click-to-load gate in front of YouTube, Maps, pixels and chat widgets.
Forms and data
- Collect only the fields you need to answer the enquiry.
- Send and store form data over encrypted connections.
- Use double opt-in for any newsletter.
- Delete data you no longer have a reason to keep.
Paperwork and legal pages
- An accurate Impressum and a Datenschutzerklärung that matches what the site really does.
- A data processing agreement (AVV) with every provider that handles data for you - hosting, email, booking, analytics.
- A short internal note of what you collect, where it lives and why.
Keep it current
- Re-check whenever you add a plugin, embed, form or new tool - that is when exposure quietly creeps back in.
- Have your final wording confirmed by your own advisor. A template is a starting point, not legal advice.
None of this is exotic. It is a build discipline: privacy-first defaults, decided once and kept in place. Do that and the common Abmahnung triggers simply are not present on your site.