You don’t need a permit to launch a website, but as soon as the site earns money, collects personal data or sells products, several laws apply to it. Most of the rules come from the EU: the General Data Protection Regulation (GDPR), the ePrivacy rules on cookies, the Directive on electronic commerce and the Consumer Rights Directive impose similar obligations in every member state. National laws build on them and lay down the details, the notifications and the competent authorities.

For each topic, this checklist first sums up the basic EU rule and then what national law typically adds, which you need to check for your own country. It gives an overview, not legal advice: it’s worth having a lawyer and an accountant look at your own situation, especially if you’re launching an online shop.

Who can launch a website? The business background

Under the EU Directive on electronic commerce (2000/31/EC), launching an online service cannot be made subject to a separate authorisation merely because it operates on the internet. So anyone can launch a website; licences that apply to the activity itself (for example, selling medicines or hazardous substances) still apply. The scope of your legal obligations depends on what you do on the site: a purely private hobby blog without advertising is subject to far fewer rules than a business website or an online shop. It counts as an economic activity if you sell products or services, place advertising (for example, Google AdSense) or affiliate links, or if the site promotes your business.

National rules: business form and tax

Which legal forms can run a website commercially (private individual, sole trader, company) and when you need to register a business are set by national law. Regular, income-generating activity usually requires a registered business, and the activities you have registered (your activity codes) should cover what you do on the site. Advertising or affiliate income from a blog run as a private individual is generally taxable as well; an accountant can tell you how it is taxed in your particular situation.

The domain should also belong to the operator of the website: for a business site, the business should be the registrant, with accurate and up-to-date details. Registry rules require genuine details too, for example the rules of .hu domain registration.

National rules: registering a trading activity

Simply launching a website generally does not have to be notified to any authority. Selling goods on it, however, is a trading activity, and some countries require you to notify a local authority before you start (in Hungary, for example, the town clerk of the local council). Check with your local authority, your chamber of commerce or your accountant whether this applies in your country. Selling certain products may also need a separate licence or be subject to conditions.

Your tax obligations (VAT, invoicing, distance sales to private buyers in other EU countries) depend on your business form and your turnover; discuss them with your accountant before you launch.

Mandatory information: imprint and terms and conditions

The Directive on electronic commerce requires every online service provider to make its basic details easily, directly and permanently accessible: its name, its geographic address, its contact details (including its email address), its trade register number or other registration number, its VAT number and, if its activity is subject to authorisation, the supervisory authority. For regulated professions (for example, lawyers or doctors), the professional body and the professional rules belong here too. This page is called the imprint (legal notice). The obligation applies not only to online shops but to every website with a commercial purpose.

If contracts can be concluded on the site, you must make the contract terms (terms and conditions) available in a way that lets the visitor save them and open them again later.

The imprint under national law

Each member state transposes the directive into its own law, and many national laws spell out exactly what the imprint must contain. A typical imprint includes:

• The provider’s name and registered office (and place of business, if there is one).
• Contact details, including at least one email address in regular use.
• Trade register number or sole trader registration number, and the authority that keeps the register.
• Tax or VAT number.
• In some countries: the name, address and email address of the hosting provider.

The last point is a national requirement: the EU directive does not require it, but Hungarian law, for example, does, so check the list for your country. If your web hosting is with aWh, you’ll find our company details on our About us page.

Online shop: information, right of withdrawal, terms and conditions

The EU Consumer Rights Directive (2011/83/EU) sets out what an online shop must tell the buyer before they place an order:

• Pre-contractual information: the trader’s name, address, phone number and email address; the main characteristics of the product; the total price including taxes and delivery costs; the payment and delivery arrangements and deadlines; the conditions of the right of withdrawal, with the model withdrawal form; the legal guarantee of conformity and the complaints handling procedure.
• Order button: the order button must make it clear that placing the order involves an obligation to pay (for example, “Order with obligation to pay”).
• 14-day right of withdrawal: the buyer may withdraw within 14 days of receiving the goods without giving a reason; the purchase price and the standard delivery cost must be refunded within 14 days. If you fail to inform the buyer of the right of withdrawal, the period is extended by up to 12 months. The buyer is liable for any loss in value of the goods only if they handled them more than necessary and you informed them of this in advance.
• Withdrawal function: since 19 June 2026 (under Directive (EU) 2023/2673), contracts concluded online must also offer a clearly visible withdrawal function (a button), continuously available throughout the withdrawal period, and the buyer must be sent an acknowledgement of the withdrawal without undue delay on a durable medium (for example, by email).
• Legal guarantee: under EU rules, the trader is liable for at least two years for the goods being in conformity with the contract.
• Online dispute resolution: the EU online dispute resolution (ODR) platform was closed in July 2025, so you no longer need to display a link to it.
• Accessibility: since 28 June 2025, the European Accessibility Act also applies to e-commerce services; microenterprises (fewer than 10 employees and an annual turnover or balance sheet total of no more than 2 million euros) are exempt.

National law transposes these rules, usually in consumer protection and civil law, and may add requirements of its own, for example on guarantees, or an obligation to name the competent out-of-court dispute resolution body alongside your complaints procedure. You usually set all this out in your terms and conditions and the related information notices. Don’t piece together an online shop’s terms and conditions from a template: for wording tailored to your products and processes, it’s worth consulting a lawyer experienced in consumer protection.

GDPR and data protection: handling visitors’ data

The GDPR applies directly in every EU member state, so the same basic rules apply to websites everywhere. If you process personal data, you must publish a privacy notice that describes who you are; for what purpose and on what legal basis you process the data in each process (purchases, newsletter, contact); how long you keep it; who receives it (for example, the hosting provider or the newsletter service); whether it is transferred outside the EU; what rights the data subjects have; and that they can lodge a complaint with the data protection authority.

With providers that process data on your behalf (hosting, newsletter sending, analytics), you need a data processing agreement under Article 28 of the GDPR; this is often part of the provider’s terms. Article 32 of the GDPR also requires appropriate technical and organisational security measures, such as encryption. We go into more detail in our guide to data protection and hosting.

When do you become a data controller? (Even a contact form counts!)

Many people think only online shops process personal data. In fact, as soon as your website offers a contact form, comments, registration or a newsletter sign-up, or measures visitors with an analytics tool, you become a data controller. Personal data is a broad category: besides names and email addresses, it includes online identifiers, and according to the Court of Justice of the European Union, in certain cases even an IP address. The GDPR exempts only purely personal or household activities; a website open to everyone is generally covered. If you want to know more about the basics, read what the GDPR is and how it affects websites.

Cookies and trackers

Under the ePrivacy Directive, only cookies that are strictly necessary for the site to work (for example, session, shopping basket, remembering the cookie settings) may be stored on the visitor’s device without consent; statistics and marketing cookies, and similar trackers, require prior consent under the conditions of the GDPR:

• Active consent: no pre-ticked boxes, and scrolling or continuing to browse does not count as acceptance.
• A real choice: rejecting must be as easy as accepting, and access to the content must not depend on accepting cookies.
• Separate purposes: visitors must be able to consent to statistics and marketing cookies separately.
• Withdrawable: withdrawing consent must be as easy as giving it (for example, via a cookie settings link in the footer).
• Provable: you must be able to prove that the visitor consented, so it’s worth logging consents.

Newsletters and direct marketing

Under EU rules, you may as a general rule send marketing emails only with prior consent, and every email must offer a free way to unsubscribe. Double opt-in is not mandatory, but it is the simplest way to prove that the subscriber really entered their email address themselves.

National rules: the supervisory authority and marketing law

Every member state has its own data protection supervisory authority (in Hungary, for example, the National Authority for Data Protection and Freedom of Information (NAIH)), which can investigate following a complaint or on its own initiative and can impose fines within the framework of the GDPR. National data protection laws supplement the GDPR, and the authorities’ websites publish guidance and decisions. National marketing or e-commerce law may also set its own consent requirements for direct marketing (Hungarian law, for example, requires prior, unambiguous and express consent), so check the rules in your country.

Technical requirements from a legal perspective: domain, SSL and hosting

Technical decisions have legal consequences too: a domain similar to someone else’s trade mark can lead to a domain dispute, and unencrypted data transfer is a data protection risk. Responsibility is shared between you and the provider. The hosting provider is responsible for the physical protection of the infrastructure and for server-side security, but updating and securely configuring the software you install (for example, WordPress or a custom-built online shop) is your job.

Domain registration and brand protection

Choosing the name is the first legal trap: if the domain resembles an existing brand or a registered trade mark, the trade mark owner can take action against it. Before you decide, look the name up in the EU’s TMview database (which searches EU and most national trade marks at once) and with your national trade mark office. Most endings have a fast dispute resolution procedure (the UDRP for .com and the other generic endings; country-code endings have their own, such as the alternative dispute resolution under the Domain Registration Rules for .hu), which can end with the domain being transferred. We describe the steps of registration in our domain registration guide.

HTTPS and encryption

No rule imposes a separate fine for not having an SSL certificate. However, if the site has a form, a login or a checkout, unencrypted data transfer may be regarded as a lack of appropriate security measures under Article 32 of the GDPR. Modern browsers also mark sites without HTTPS as “not secure”, which undermines visitors’ trust. An SSL certificate encrypts the communication between the visitor and the server; every aWh hosting plan comes with a free Let’s Encrypt certificate. We explain in detail why it’s indispensable in this article.

Hosting and data processing

Under the GDPR, the hosting provider is a data processor, because it stores your visitors’ data on its servers. If the servers are in the European Union, the rules on data transfers outside the EU do not apply to the hosting, which simplifies your privacy notice. Bear in mind, though, that the other services built into your site (analytics, fonts, chat, newsletter sending) may also transfer data outside the EU. aWh’s hosting plans run in EU data centres, with automatic backups on the paid plans.

Checklist: step by step to launch

The list below helps make sure no important step is missed before you launch. The first part applies in every EU member state; the second lists the national to-dos to check for your country.

EU rules:

• Imprint: the operator’s name, address, email address, registration number and VAT number are easy to find on the website.
• Privacy notice: the purpose, legal basis and duration of every data processing activity are described, and the notice can be reached from every page.
• Data processors: you have a data processing agreement or arrangement with your hosting, newsletter and analytics providers.
• Cookies: non-essential cookies load only after consent, and rejecting is as easy as accepting.
• HTTPS: the SSL certificate is active, and every address of the site redirects to HTTPS.
• Domain: the name does not infringe a trade mark, and the registrant’s details are accurate.
• Online shop: pre-contractual information, a clear order button, a 14-day right of withdrawal with the model form, a withdrawal function with automatic acknowledgement, information on the legal guarantee.

National to-dos:

• Business: your business form and registered activities cover what you do on the site; you have discussed tax with your accountant.
• Notification: if you sell goods, you have checked whether your trading activity must be notified to a local authority, and done so where required.
• Imprint under national law: it contains every detail your country’s law requires (in some countries, the hosting provider’s name, address and email address too).
• Consumer protection: your terms and conditions comply with your national consumer protection and civil law and, where required, name the competent dispute resolution body.
• Newsletter: sign-up meets the consent requirements of your national marketing law.

Final check before going live

Before you make the site public, test it thoroughly. Make sure the imprint, the terms and conditions and the privacy notice can be reached from the footer of every page. For an online shop, try a complete purchase: does the automatic confirmation arrive, and does it contain the required information? Does the withdrawal function work, and does it send an acknowledgement? Open the site in a private browser window and check whether any marketing or statistics cookie loads before you give consent. Finally, make a full backup of the launch state, so you have something to go back to after later changes.

Build on solid foundations

Legal compliance doesn’t end with preparing the documents: the technical background, SSL encryption and the location of the servers matter just as much. If you choose accuracy and transparency at launch, you not only avoid proceedings by the authorities but also win your visitors’ trust.

We can help with the technical side: aWh hosting runs in EU data centres, every plan comes with a free SSL certificate, and the paid plans also include automatic backups, and each member of our team has 20 years of professional experience. If you get stuck, our expert support is available around the clock by chat, support ticket and email.

Launch your website on aWh web hosting!

Frequently Asked Questions

Do I need terms and conditions if I don’t sell anything on my website?

No, you need terms and conditions when contracts are concluded on the website, for example in an online shop or for a service that requires registration. An imprint, however, is mandatory on every website with a commercial purpose, and you need a privacy notice if you process personal data, even if only through a contact form.

Can I be fined if my website has no SSL certificate?

There is no fine for the lack of an SSL certificate in itself. However, if the site has a form, a login or a checkout, unencrypted data transfer may amount to a breach of the security obligation under the GDPR, which the data protection authority may take into account in an investigation. Since a free Let’s Encrypt certificate easily avoids this risk, there is no reason to run a site without HTTPS.

Can I use template terms and conditions from the internet?

It’s risky. Old templates don’t follow the changes (for example, the withdrawal function mandatory since June 2026 or the closure of the ODR platform), and they don’t fit your products or your delivery and payment methods. For an online shop, it’s worth having a lawyer draft, or at least review, your terms and conditions and information notices.

What details must I include in the imprint as a sole trader?

Your name, the address of your registered office, an email address you use regularly, your sole trader registration number and the authority that keeps the register, and your tax or VAT number; some countries also require the name, address and email address of your hosting provider. If you run an online shop, your phone number must also appear in the pre-purchase information.

Do I need to notify an authority separately when I launch a website?

Not for the website itself. If you sell goods on it, however, that is a trading activity, and in some countries it must be notified to a local authority before you start (in Hungary, for example, to the town clerk of the local council, and only for selling goods, not services). Check the rules that apply in your country.

What happens if my website doesn’t comply with the GDPR?

The data protection authority of your country can issue a warning, order the infringement to be ended, the data to be erased or the processing to be restricted, and can impose a fine. Under the GDPR, the fine can reach 20 million euros or 4% of annual worldwide turnover in the most serious cases; fines imposed on small businesses are much lower, but the damage to your reputation counts too.

Do I need to appoint a data protection officer (DPO)?

Most small businesses don’t. Under Article 37 of the GDPR, a data protection officer is mandatory if you are a public authority, or if your core activities consist of regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data (for example, health data) or of data relating to criminal convictions and offences. An average online shop or business website doesn’t need one, but the other obligations of the GDPR apply to you just the same.

How can I check that my hosting provider complies with the GDPR?

Check that you have a data processing agreement with the provider under Article 28 of the GDPR (often part of the terms of service), and where its servers are. If the data centre is in the European Union, you don’t need to deal with data transfers outside the EU for your hosting. aWh’s servers run in EU data centres.

• legislation
• data protection
• building a website
• business
• guides
• for beginners