Your company has published a new privacy policy, launched a cookie banner, and updated its privacy notices. The implementation report says the GDPR work is complete. Then someone opens your online store in a clean browser session and finds that one tool named in the policy is not on the website, while three others are running but appear in neither the policy nor the record of processing activities.
This pattern regularly emerges several weeks after implementation. Management believes the documentation is complete, but the website keeps changing: marketing installs plugins, a provider updates integrations, and no one tells the person responsible for data protection.
A post-implementation website audit compares what the documents say with what the website actually does. For a business operating in Poland, it should address both the GDPR and the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, or PKE). This article explains how to run that comparison, identify gaps, and assign the resulting work before the President of Poland’s Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, or UODO) raises the questions.
The documents and mechanisms you need to check
| Term | What it means for your website |
|---|---|
| Post-implementation audit | A technical and documentation review conducted several weeks after GDPR recommendations have been implemented. It tests whether the changes work and whether new discrepancies have appeared. |
| Record of processing activities (Article 30 GDPR) | The controller’s record of operations involving personal data, including their purposes, legal bases, data categories, and recipients. The approved approach addressed here treats this as an obligation for every controller, regardless of company size. |
| Consent mode | The technical configuration of analytics and advertising tools that determines whether their scripts run before or after a user gives consent. |
| Consent management mechanism, or cookie banner | The interface through which users give or refuse cookie consent. The source identifies Article 7(3) GDPR and Article 399 PKE as relevant requirements. |
| Privacy notice (Article 13 GDPR) | Information given when personal data is collected, including the controller’s identity, processing purpose and legal basis, retention period, and the individual’s rights. |
| Data processing agreement (Article 28 GDPR) | The agreement governing a provider that processes personal data on the controller’s behalf, including the scope, purpose, and conditions of that processing. |
The privacy policy is only one part of this picture. It cannot establish what a plugin does, whether a script fires before consent, or whether a provider has changed an integration.
Why implementation is a starting point, not the finish line
Publishing a privacy policy, enabling a cookie banner, and updating notices establish a starting position. The accountability principle in Article 5(2) GDPR requires the controller to be able to demonstrate compliance over time, not just on publication day.
A website often changes faster than its documentation. Marketing adds a tracking pixel. Accounting connects an invoicing tool. A website provider updates a review plugin that, by default, automatically emails customers after a purchase. Each change can introduce a processing activity with its own purpose and legal basis. Email communications may also raise a consent requirement under Article 398 PKE.
Discrepancies run in both directions
| What the audit finds | Why it matters | Provisions identified in the source |
|---|---|---|
| A tool is described in the policy but is not operating on the website. | The company declares processing it does not carry out, potentially misleading users about how their data is handled. | Article 5(1)(a) GDPR (fairness) and Article 12(1) GDPR (transparency). |
| A tool operates on the website but is absent from the policy and processing record. | The processing has no documented legal basis, and the controller cannot demonstrate how it has addressed it. | Article 6 GDPR (legal basis), Article 13 GDPR (information), Article 30 GDPR (record entry), and Article 24 GDPR (accountability). |
Reading the policy alone will not reveal either discrepancy. You must examine the live website and compare the findings with the documents.
Where the gaps commonly come from
- Default plugin settings. A post-purchase review plugin may start emailing review invitations as soon as it is installed, before anyone deliberately approves that function. The emails are a separate processing activity and, as the source explains, also engage Article 398 PKE.
- Integrations added by other teams. An accounting or invoicing connection, analytics tool, or marketing pixel may process personal data without being added to the processing record or policy. Check the provider’s role and whether a data processing agreement is needed.
- The consent management provider itself. A tool installed for compliance can be left out of the policy and processing record because no one thinks to review the “compliance tool” as a data-handling service.
If you want an independent check for these gaps, contact us.
How to audit the website, step by step
The initial review does not require specialist software. It does require a consistent sequence: observe the website before consent, test the banner, identify tools, and only then assess the documents against the facts.
1. Start with a clean browser session
- Open a private browsing session or clear the site’s cookies, cache, and local data.
- Visit the website and do not interact with the cookie banner.
- Open the browser’s developer tools—F12 in many browsers.
- Under Application → Storage → Cookies, list cookies stored before any banner interaction.
- Under Network, identify requests to analytics, advertising, and other third-party domains.
- Classify each cookie and request: is it technical and necessary for the site to operate, or does it require consent?
Analytics or advertising cookies, or requests to advertising-provider domains before consent, are warning signs. They do not automatically establish a violation. Investigate the legal basis for the activity and whether users have been informed.
2. Check the default consent mode settings
Look for these parameters in the site’s consent mode configuration:
| Parameter | Default before consent |
|---|---|
analytics_storage |
denied |
ad_storage |
denied |
ad_user_data |
denied |
ad_personalization |
denied |
Under the configuration described in the source, a default of granted for any of these parameters means analytics or advertising tools run before the user consents.
3. Review the first layer of the cookie banner
Check the choices available on the first screen, without requiring the user to open settings.
| Element | What to look for | Warning sign |
|---|---|---|
| “Allow all” | Present. | — |
| “Reject all” | Present and visually equivalent to “Allow all.” | Missing or available only in a second layer. |
| “Customize” or “Settings” | Optional. | Offered as a substitute for “Reject all.” |
The source identifies a “Customize / Allow all” first layer without an equivalent rejection option as a pattern described as unlawful in EDPB Guidelines 03/2022. Article 7(3) GDPR requires withdrawing consent to be as easy as giving it. In C‑673/17, Planet49, the Court of Justice of the European Union confirmed that consent requires an active, specific act; in C‑61/19, Orange România, it addressed the absence of freely given consent where a user must actively object to processing. See also the list of decisions of the President of UODO.
A missing button may be fixable in the provider’s configuration rather than through a new website project.
4. Compare the live tools with the policy and processing record
Prepare two lists:
- Described but not found: tools named in the policy that you did not find operating on the website.
- Found but not described: tools operating on the website that are absent from the policy and the record of processing activities.
Keep both lists. An inventory containing only tools confirmed as active will miss inaccurate statements in the policy. Recording “not found” is useful because it makes the next review accountable for what the documents claim, not merely what is currently installed.
5. Check notices beneath every form
Review contact, newsletter, registration, and other forms that collect personal data.
- Have the controller’s details been filled in, or is placeholder text still visible?
- Does the notice provide the information identified under Article 13 GDPR, including the controller’s identity, purpose, legal basis, retention period, and individual rights?
- Does a newsletter form distinguish consent for the electronic communication channel under Article 398 PKE from the GDPR legal basis for processing personal data?
A placeholder can survive several reviews simply because no one rereads a notice they pasted into the form.
6. Read the privacy policy last
Compare the policy with the facts you have established, rather than assuming the policy describes the live site. Check whether:
- It is still labeled “draft.” A policy published to users is presented to them even if the controller describes it as unfinished.
- Its publication date is complete.
- It cites repealed Article 173 of Poland’s Telecommunications Law instead of Article 399 PKE—a sign that the text is outdated.
- It claims that documents exist when they have not been prepared, such as a Transfer Impact Assessment (TIA), risk assessment, or Data Protection Impact Assessment (DPIA).
A TIA and a DPIA address different questions. A TIA assesses the effectiveness of transfer safeguards in light of a recipient country’s law and practice; a DPIA assesses processing impacts under Article 35 GDPR. If the policy says both have been prepared, verify both.
Prioritize the findings—and state what remains unknown
Reviews of e-commerce websites often produce a similar worklist.
| Priority | Finding | Main owner | Typical action |
|---|---|---|---|
| Urgent | No visually equivalent rejection button on the banner’s first layer. | Website provider | Change the configuration. |
| Urgent | Controller-details placeholder remains below a form. | Website provider | Complete the notice. |
| Urgent | Policy is labeled “draft” and has no publication date. | Provider / company | Remove the label and add the date. |
| Urgent | Policy cites Article 173 of the repealed Telecommunications Law rather than Article 399 PKE. | Legal adviser | Update the policy. |
| Urgent | Policy refers to a TIA, risk assessment, or DPIA that does not exist. | Company and legal adviser | Prepare the documents or remove the references. |
| Medium | Active tools are missing from the policy and processing record. | Company and legal adviser | Add the record entry and update the policy. |
| Medium | A tool is described in the policy but not found on the site. | Company and legal adviser | Correct the policy or implement the tool. |
| To be determined | A review plugin may automatically send invitations, but its setting is unknown. | Company | Check the configuration. |
| To be determined | Encryption of data at rest, backup tests, and access-rights reviews are unconfirmed. | Company IT team | Confirm what has been implemented. |
An external inspection of the website cannot establish whether data at rest is encrypted or backups are tested. Ask IT to confirm those controls and make the review’s limits explicit. “To be determined” should not become a permanent status.
Many urgent findings are simple changes for the website provider. A list of issues does not necessarily mean a new project or budget. Missing assessments and unverified IT controls may require substantially more work.
Keep a systems register that connects findings to documents
A one-off audit creates a snapshot. A register of the systems and tools used on the website gives the next review a starting point. Keep it alongside, rather than confuse it with, the GDPR record of processing activities.
At minimum, record the tool and provider, its website function, the provider’s legal role and data categories, and its status:
| Tool or component | Function | Provider role and data | Status and follow-up |
|---|---|---|---|
| Consent management tool; provider X, Germany | Collects and manages cookie choices. | Processor; cookie identifiers, IP addresses, user choices. | Assessed as compliant; data processing agreement required. |
| Analytics tool; provider Y, United States | Analyzes website traffic. | Independent or joint controller; identifiers and activity data. | Assessed as compliant; transfer relies on Decision (EU) 2023/1795 if the importer is certified. |
| Marketing pixel; provider Z, United States | Remarketing and conversions. | Independent controller; identifiers and activity data. | Not found on the website—retain as a negative entry. |
| Accounting and invoicing integration; provider W, Poland | Generates invoices and synchronizes customer data. | Processor; name, address, Polish tax identification number (NIP), transaction data. | Active but absent from the policy; update the processing record and policy. |
A negative entry is deliberate: it preserves evidence that a policy claim was checked. Even an item assessed as compliant should carry a maintenance note, so a later reviewer knows it was examined and what remains to be maintained.
Check transfers outside the EEA
For a tool whose provider is established outside the European Economic Area, check the basis for any data transfer.
As stated in the approved source at its publication, Commission Implementing Decision (EU) 2023/1795, concerning the EU-US Data Privacy Framework (DPF), remained formally in force. It covers only US organizations certified under the DPF. The source also notes proceedings challenging the decision before the EU courts and states that no final judgment annulling it had been issued by that publication date.
The contingency approach described in the source is Standard Contractual Clauses (SCCs) under Article 46 GDPR, together with a TIA assessing the recipient country’s law and practice and supplementary technical measures such as encryption or pseudonymization. SCCs may be included in a wider agreement with additional terms, provided those terms do not conflict with them; the SCCs themselves must not be modified.
Put change control into the website provider agreement
A website provider responsible for hosting, maintenance, or development may act as a processor under Article 28 GDPR. It may also be the party installing plugins, updating integrations, and configuring consent management. If those changes happen without the controller’s knowledge, the controller loses visibility over its own processing.
Use the data processing agreement to make the controls operational:
| Control | Source provision | Contract term to consider |
|---|---|---|
| Documented instructions | Article 28(3)(a) GDPR | No new tool, plugin, or integration without written notice to the controller and its approval. |
| Audits and inspections | Article 28(3)(h) GDPR | A right to review at least once per calendar year, with notice of the scope, date, and authorized participants. |
| Subprocessors | Article 28(2) GDPR | Prior written consent for each subprocessor. |
| Remediation deadlines | Article 5(2) GDPR (accountability) | Defined deadlines after an audit—for example, five working days for urgent findings and ten for others. |
| Assistance with controller obligations | Article 28(3)(e)–(f) GDPR | Cooperation with data subject rights requests and breach notifications. |
If you want a contractual penalty for failure to meet these obligations, agree it separately. The GDPR does not create one automatically.
Set a repeatable review schedule
The GDPR does not set one fixed frequency for website reviews. Article 24(1) calls for measures to be reviewed and updated “where necessary,” and Article 32(1)(d) requires regular testing and evaluation of their effectiveness. The approved source recommends checking processors at least annually and links to Guidelines 05/2020 on consent hosted by UODO.
| Review | Timing | Scope |
|---|---|---|
| Post-implementation | Several weeks after recommendations are implemented. | Confirm the changes work and identify new discrepancies. |
| Annual | Every 12 months. | Repeat the full website–documentation comparison; update the systems register; review provider agreements and transfers. |
| Change-triggered | After a new plugin, integration, provider change, or other website change. | Assess the new element and update the relevant documents. |
For every unresolved finding, name an owner, set a response deadline proportionate to the risk, and define when it will be escalated. Silence is not acceptance of risk; it leaves the controller unable to account for what happened.
Support and next steps
A useful post-implementation review combines a technical check of the site, a comparison with the documents, and an assessment of the applicable Polish and GDPR requirements. Our work with e-commerce, SaaS, and IT companies can be structured at three levels:
- Operational minimum: a one-off review, urgent-findings list, policy–website comparison, and prioritized recommendations with named recipients.
- Solid foundation: the review plus a systems and tools register, with updates to the privacy policy and notices.
- Comprehensive protection: an annual program covering legal developments, transfer and subprocessor registers, recurring reviews, and an outsourced Data Protection Officer function provided by our law firm.
A privacy policy is a document; compliance requires continuing verification. Each plugin, integration, or provider change can create a new processing activity and a new documentation gap. If your company has completed a GDPR implementation and wants to know whether its Polish website still matches it, contact us.
Frequently asked questions
We paid for implementation six months ago. Why review the same website again?
Implementation records a position at a point in time. Since then, teams may have added tools and the provider may have updated plugins. A post-implementation review checks whether the policy still reflects what happens on the site. Article 5(2) GDPR requires the controller to be able to demonstrate compliance beyond the implementation date.
Does a findings list mean another IT project?
Not necessarily. Common urgent items—adding a rejection option to a banner, completing a notice, or removing a “draft” label—may be provider configuration or content changes. Missing TIAs, DPIAs, or risk assessments, and work such as encryption or backup testing, can require more substantial effort.
What can we check on the cookie banner in five minutes?
Open the site in a clean browser session and do not touch the banner. Check whether its first layer has visually equivalent “Allow all” and “Reject all” options. Then use developer tools to see whether analytics or advertising cookies were stored before you interacted with it. A missing rejection option or pre-consent cookies call for investigation.
Do automatic post-purchase review emails require separate consent?
The source treats automated review invitations as a separate processing activity requiring its own purpose and legal basis. It also identifies Article 398 PKE as requiring consent for unsolicited commercial information sent electronically. Check whether the review plugin enables invitations by default and whether your company deliberately activated them.
Does a privacy policy labeled “draft,” with no date, matter if it is already published?
Yes. The approved source treats a published policy as binding in relation to data subjects regardless of its label. A “draft” label and blank date can support the argument that the controller published a document it considered unfinished. Remove the label and complete the publication date.
Can the website provider audit its own work?
The provider can supply technical information and implement fixes, but it should not be the sole assessor of its own compliance. Have someone independent of the provider—such as an internal Data Protection Officer, external adviser, or law firm—conduct the review.
