Why GDPR matters for San Marino sites
Any site that collects names or emails, or tracks visitors, processes personal data. In San Marino the GDPR is supplemented by San Marino data-protection law (Law No. 171/2018) (Law No. 171/2018), and the data-protection authority is the supervisory authority.
Cookies and tracking
Analytics and marketing cookies need consent before they load, and declining must be as easy as accepting. San Marino cookie rules (ePrivacy rules) also require clear information about what each cookie does.
- A consent banner with equal accept and decline buttons
- A tag manager that loads scripts only after consent
- A cookie list with purpose and retention time
- A privacy policy in plain language, in San Marino and English
Forms, data and processors
Every form should say why data is collected and how long it is kept. If you use an outside provider such as a newsletter or CRM tool, you need a data processing agreement with them.
If something goes wrong
A personal data breach must normally be reported to the data-protection authority within 72 hours. Keep a simple incident log, know who decides and test the process before you need it.