Data protection law for company sites: what is actually required
The cookie banner is only the visible part. The larger duties sit behind it.
Law 27/2022 is often summarised as "add a cookie banner". The banner is required, but it is the easy part — and a site that has only the banner creates evidence that consent was requested and then ignored.
Three things are missed more often: withdrawing consent must be as easy as giving it, form data must not be kept forever without a reason, and access to personal data must be logged. None of the three is visible on screen, which is exactly why they are forgotten until someone asks.
In the CMS we build, all three are built in: a cookie settings link sits in every footer, form submissions are purged automatically after twenty-four months, and every view of personal data lands in the activity log.
