The General Data Protection Regulation (GDPR) has been mandatory for all European Union organisations for several years now, but public sector institutions still often fail to meet all the requirements. A GDPR website is not just a privacy policy page, but an entire system of technical and organisational measures ensuring the protection of personal data. In this article we will discuss in detail which GDPR requirements public-sector websites in Lithuania must meet and how to implement them in practice.
Why is the GDPR especially important for the public sector?
Public sector institutions — municipalities, schools, libraries, museums, healthcare institutions — process highly sensitive residents’ data. This includes:
- Personal identification data (first name, surname, personal identification number).
- Contact data (address, telephone number, e-mail).
- Health data (in healthcare institutions).
- Children’s data (in education institutions).
- Financial data (in the area of taxes, social benefits).
A GDPR website in the public sector must meet the highest standards, because any data leak can have serious consequences for thousands of people. In addition, public sector institutions face higher fines and closer scrutiny from supervisory authorities.
Main GDPR requirements for websites
1. Cookie consent management
Every GDPR website must have a cookie consent mechanism that:
- Informs visitors about the cookies used before they are installed.
- Allows choice — the visitor must be able to accept or reject cookies of different categories (necessary, analytical, marketing).
- Does not install cookies without consent — no analytical or marketing cookies may be activated until the visitor gives explicit consent.
- Allows consent to be withdrawn — the visitor must be able to change their cookie settings at any time.
- Stores consent records — the institution must be able to prove that consent was obtained.
A common mistake is to use a cookie banner that only informs but does not actually block cookies. This does not meet GDPR requirements.
2. Privacy policy
Every GDPR website must have a detailed privacy policy page stating:
- Data controller — the institution’s full name, address, contact details.
- Data protection officer (DPO) — contact details (for public sector institutions, a DPO is mandatory).
- Categories of data processed — what personal data is collected through the website.
- Purposes of data processing — why the data is collected (e.g. for submitting an enquiry, sending a newsletter).
- Legal basis — what legal basis is used to process the data (consent, legitimate interest, legal obligation, etc.).
- Data retention periods — how long the data is stored.
- Data subject rights — the right to access, rectify, erase, restrict processing, and data portability.
- Third parties — to whom the data is transferred (e.g. cloud service providers, analytics platforms).
3. Contact forms and data collection
Contact forms are one of the most common data collection tools on websites. A GDPR website must ensure:
- Minimal data collection — collect only the data that is truly necessary (data minimisation principle). If e-mail and message text are enough, a telephone number or address should not be required.
- Clear consent — the form must include a checkbox with a link to the privacy policy. The box must not be pre-ticked.
- Encrypted transfer — the form must be sent over HTTPS (SSL certificate).
- Secure storage — the data received must be stored securely and accessible only to authorised persons.
4. SSL certificate (HTTPS)
All public sector websites must use an SSL certificate. HTTPS ensures that data transferred between the visitor’s browser and the server is encrypted. Without an SSL certificate, browsers show a “Not secure” label, which harms both security and trust.
5. Data processing agreements with service providers
If website development or maintenance is carried out by an external provider, it is necessary to sign a data processing agreement (DPA). It must define:
- Which data the provider may access.
- For what purposes the data is processed.
- What security measures the provider applies.
- What happens to the data when the contract ends.
- The provider’s liability in the event of a data leak.
This is especially relevant when using cloud hosting services where website data is physically stored on third-party servers.
Practical GDPR compliance checklist
Use this checklist to check whether your GDPR website meets all requirements:
Technical requirements
- ☐ SSL certificate installed and working (HTTPS).
- ☐ Cookie consent mechanism installed and properly blocking cookies.
- ☐ Contact forms include consent checkboxes.
- ☐ Data is transferred through an encrypted channel.
- ☐ The website is regularly updated (CMS, plugins, themes).
- ☐ Regular backups are performed.
- ☐ Access to the admin dashboard is protected by strong passwords and two-factor authentication.
Content requirements
- ☐ Privacy policy page prepared and updated.
- ☐ Cookie policy page prepared.
- ☐ Data protection officer contact information provided.
- ☐ Information on data subject rights provided.
- ☐ Data retention period stated.
Organisational requirements
- ☐ Data protection officer appointed.
- ☐ Data processing agreements signed with suppliers.
- ☐ Data breach management plan prepared.
- ☐ Employees trained in GDPR requirements.
- ☐ Regular compliance audit carried out.
Most common types of GDPR breaches on websites
The State Data Protection Inspectorate (VDAI) regularly checks public sector websites. The following problems are most often identified:
- Improper cookie management — analytical cookies are installed without consent.
- Outdated privacy policy — does not reflect actual data processing practice.
- Too much data collected — unnecessary data is requested in contact forms.
- Missing DPA with suppliers — website hosting or maintenance is carried out without a data processing agreement.
- Data security not ensured — outdated CMS versions, weak passwords.
Fines for GDPR breaches
For public sector institutions, fines under the GDPR can reach up to €20 million or 4% of annual turnover (whichever is higher). Although fines in Lithuania are usually lower, they can still reach tens of thousands of euro, not to mention reputational damage.
In 2025–2026 VDAI is particularly actively checking public sector websites, so ensuring compliance is not an option but a necessity.
How to ensure GDPR compliance when creating a website?
The best approach is to integrate GDPR requirements from the very start of website development — this is the so-called “privacy by design” principle. The main steps are:
- Carry out a data processing audit — identify which personal data will be processed through the website.
- Implement a cookie management system — choose a professional solution (e.g. CookieYes, Complianz).
- Prepare privacy documents — privacy policy, cookie policy, data processing rules.
- Sign DPAs with suppliers — website developers, hosting service providers.
- Audit regularly — review and update all GDPR processes at least once a year.
If you are planning to create a new public-sector website or update an existing one, it is important to choose a provider that understands GDPR requirements. We invite you to ознакомиться with our website development services, where GDPR compliance is a standard part of the project.
Conclusions
A GDPR website in the public sector is not a formality, but a necessity that protects both residents and the institution itself. By investing in proper data protection, you will not only avoid fines, but also increase residents’ trust in your institution.
Do you have questions about GDPR compliance on your website? Contact us — we will help assess the current situation and offer concrete solutions.