Public-Facing Website & Privacy Notice Review
Prepared for: Example Dental Practice (fictional)
Prepared by: AuditSeals — Aditya Lakhera
Audit scope: Public website content, cookie consent mechanism, privacy notice, enquiry form
1. Executive Summary
This sample shows the format of an AuditSeals report. It reviews the public website of a fictional dental practice against the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive. Eight areas were reviewed: website and privacy notices, cookies and tracking, consent banner, enquiry form, third-party services, data retention, documentation, and information for patients.
The review produced 5 findings: 1 high, 3 medium and 1 low. Three priority actions cover all of them.
| Risk rating | Findings |
|---|---|
| High (1) | F-01 |
| Medium (3) | F-02, F-03, F-04 |
| Low (1) | F-05 |
2. Scope & Methodology
The review covers the practice's publicly visible website: its pages, cookie banner, privacy notice and enquiry form, as a first-time visitor sees them. It compares what is observed with the principles in GDPR Article 5 and the obligations in Articles 7, 12 and 13, and with ePrivacy Directive Article 5(3).
The review does not include penetration testing, access to internal systems or patient records, or interviews with staff. It is a practical compliance review, not legal advice.
3. Detailed Findings
Findings are ordered by risk rating, from high to low. Each one states what was observed, the compliance risk, and a recommended action.
Risk rating: High · Relevant provision: GDPR Art. 4(11), 7; ePrivacy Directive Art. 5(3)
Analytics cookies are set as soon as the page loads. The banner offers a prominent “Accept all” button, while rejecting requires opening a second settings layer.
Consent is not freely given or unambiguous if non-essential cookies are set before a choice, or if refusing is harder than accepting. Consent collected this way may be invalid.
Block all non-essential cookies until the visitor actively opts in. Show “Accept” and “Reject” with equal prominence, and keep a record of each consent choice.
Risk rating: Medium · Relevant provision: GDPR Art. 13(1)(e)–(f), Chapter V; ePrivacy Directive Art. 5(3)
Web fonts and an embedded map load from US providers when the page opens, before any consent choice. The privacy notice does not name these recipients or say that data may leave the EEA.
Visitors' IP addresses reach third parties without their knowledge, and the practice cannot show a transfer safeguard.
Host fonts on the practice's own server. Load the map only after the visitor clicks to enable it. List each recipient and the transfer safeguard in the privacy notice.
Risk rating: Medium · Relevant provision: GDPR Art. 12(1), 13
The privacy notice is linked only from the page footer, in small type. The enquiry form, where data is collected, does not link to it.
Information must be easily accessible at the point of collection. Visitors filling in the form may not see how their data will be used.
Link the privacy notice next to the form button and in the main navigation, and use plain language for the summary at the top.
Risk rating: Medium · Relevant provision: GDPR Art. 5(1)(e), 13(2)(a)
The notice says data is kept “for as long as necessary” without giving periods for enquiries, appointments or patient communications.
Vague retention wording makes storage limitation impossible to demonstrate and leaves visitors uninformed.
State a retention period, or the criteria used to set it, for each category of data, and confirm the legal basis for any longer period.
Risk rating: Low · Relevant provision: GDPR Art. 5(1)(c), 9
The enquiry form asks for date of birth, which is not needed to answer an enquiry, and its free-text box has no warning against entering health details.
Collecting more than is needed breaks data minimisation, and health details typed into a general enquiry form are special-category data collected without a documented basis.
Remove the date-of-birth field, and add a short note asking visitors not to enter health information, with a separate secure route for clinical questions.
4. Remediation Roadmap
| Priority | Action | Findings addressed |
|---|---|---|
| 1 | Rebuild the consent banner as a genuine opt-in, block non-essential cookies and third-party loads until consent, and self-host fonts | F-01, F-02 |
| 2 | Complete the privacy notice: name recipients and safeguards, add retention periods, and link it where data is collected | F-02, F-03, F-04 |
| 3 | Tighten the enquiry form: remove unneeded fields and add a health-data notice | F-05 |
5. Closing Notes
This sample reflects a fictional website and is provided only to show the structure of a report. Real reports are based on the client's publicly visible content and any documents the client provides, and do not constitute legal advice or a guarantee of compliance. Findings should be validated with qualified legal counsel where legal interpretation is needed.
AuditSeals
Aditya Lakhera
aditya@auditseals.eu