The EU General Data Protection Regulation (GDPR, in German DSGVO) requires every website owner to inform users transparently and in plain language about the scope, purposes and legal bases of any data collection, including IP addresses and server logs.

Structure and key sections of the Datenschutzerklärung

The privacy policy must include the contact details of the controller (Verantwortlicher), the data subject's rights under Articles 15–21 GDPR (access, rectification, erasure, restriction of processing, data portability and objection), the right to lodge a complaint with a supervisory authority (for example the data protection commissioner of the federal state) and how to withdraw consent given previously.

Legal bases for processing (Article 6 GDPR)

Every processing activity on the website must rely on a specific point of Article 6(1) GDPR. Server logs and technically necessary cookies are based on the owner's legitimate interest (Article 6(1)(f): security and reliability). Processing enquiries through contact forms is based on pre-contractual measures (Article 6(1)(b)). Marketing trackers and pixels require prior explicit consent (Article 6(1)(a)).

Disclosing third-party services and transfers outside the EU

If the website uses Google Fonts, Google Maps, Google Analytics 4, payment providers such as Stripe or PayPal, or hosting on AWS or Cloudflare, each service must be described in detail. For transfers to servers in the USA, you must state whether the EU-US Data Privacy Framework or Standard Contractual Clauses (SCC) are used.

Local fonts and avoiding hidden data leaks

A 2022 ruling by the Munich Regional Court and the wave of claims that followed showed that dynamically loading external resources (such as fonts from Google's servers) without consent transmits the visitor's IP address and may violate their rights. It is safer to host fonts on your own server (self-hosted web fonts) and block analytics scripts until consent is given in the consent dialogue.

What to check

  • Place a permanent link to the Datenschutzerklärung next to the Impressum.
  • Describe all contact forms, server logs and data retention periods.
  • List all third-party providers (hosting, analytics, newsletters, payment processing).
  • Host web fonts locally to avoid direct requests to external CDNs.

Example situation

A company moves Google Fonts to its own server and blocks analytics scripts until consent is given in the banner, removing the most common grounds for complaints about passing data to third parties.

Next step

A sound GDPR privacy policy is built on a transparent website architecture and real control over all external network requests.

Official information on this topic

Checklists and examples are organisational recommendations. Requirements depend on the procedure, the city and your situation; check them with the relevant office before you act. Please discuss legal and tax questions with an authorised professional.

This article was prepared with the help of AI. The example illustrates the approach and does not describe a client case.