Most compliance failures on small business sites are drift rather than decisions: a policy naming a tool you dropped, a claim nobody re-checked, a form storing data with no retention. An annual pass catches them.

Why drift is the problem

Almost nothing on this list goes wrong because somebody decided badly. It goes wrong because the business changed and the website did not.

A tool is replaced and the privacy policy still names the old one. A price rises and an old page still shows the old figure. A service is dropped and its page still sells it.

Each is a representation that has quietly become inaccurate, and inaccuracy is the substance of most of these obligations.

An hour a year, at a fixed point, catches nearly all of it.

The pass

Business identification

Legal name, address, contact details and any registration or licence numbers, matching what is registered and what appears on invoices.

Check the footer, the contact page, the terms and the invoice template say the same thing.

Claims

Read the site for anything asserting a result, a comparison, a ranking or a superlative. For each, ask what you would produce to support it.

Anything unsupportable gets rewritten as a description. Anything supported by a document should have that document findable.

Prices and offers

Every published price current, every mandatory fee included, and any comparison to a former price genuinely reflecting one that was charged.

Expired promotions removed rather than left running.

The privacy statement

Does it describe what actually happens now. Does it name the tools in use rather than ones you dropped. Is the contact route live.

This is the document most likely to have drifted, because tools change more often than policies get read.

What the site collects

Every form, what it asks for, where the submissions go, how long they are kept, and whether anything is being collected that nobody uses.

Retention periods set and actually enforced rather than intended.

Consent records

For any marketing list, whether you can show when and how each address or number was obtained.

Unsubscribes actioned, and the mechanism tested by using it.

Third parties

What scripts and embeds are running, what they collect, and whether each is still in use. Which vendors hold customer data, and whether any relationship has ended without access being removed.

Accessibility

The keyboard test, the zoom test, and a look for images carrying information with no alternative text.

Anything added during the year is the likely regression.

Terms and policies

Refund, cancellation, delivery and warranty terms matching what you actually do now, and reachable from where a customer decides.

The three that expire without warning

Worth a diary entry rather than a review item, because the failure is immediate.

Insurance, where a lapse is discovered at the worst possible moment.

Licences and certifications, including anything named on the site. A licence number published after it lapsed is a misrepresentation.

The domain and the certificate, which take the whole site down rather than degrading it.

Writing it down

The output should be a page, not a feeling.

What you checked, what you found, what you changed, and what you decided not to change and why. Dated.

That record does two things. It makes next year's pass faster, since you are comparing rather than starting. And where a question is ever raised about whether you took an obligation seriously, a dated record of having looked is worth considerably more than a recollection.

When to do it

Attach it to something already in the calendar rather than choosing a date.

Year end alongside the accounts, the insurance renewal, or the start of your quiet season all work. What matters is that it recurs without anybody remembering to schedule it.

An hour, once a year, on a list you already have. That is the whole practice, and it is considerably cheaper than the alternative, which is finding out from somebody else.

The starting point, if you have never mapped it, is knowing what you hold and where, as covered in knowing what customer data you actually hold.

Frequently asked questions

Why do compliance problems appear without a decision?

Because the business changes and the website does not. A dropped tool still named in the policy, an old price, a discontinued service still being sold.

Which document drifts most?

The privacy statement, because tools get replaced more often than policies get read. Check it names what is actually in use now.

How should claims be reviewed?

Read the site for anything asserting a result, comparison or superlative, and for each ask what you would produce to support it. Rewrite the rest as description.

What should be checked about forms?

What each collects, where submissions go, how long they are kept, whether anything collected is unused, and whether retention is enforced rather than intended.

Which items need a diary entry instead?

Insurance, licences and certifications named on the site, and the domain and certificate, since each fails immediately rather than gradually.

What is the output?

A dated page recording what you checked, what changed, and what you decided not to change and why. It speeds up next year and evidences that you looked.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Privacy policy naming a tool you stopped using in 2023?

We run the annual pass and give you the dated record, which is the part that makes next year quick.

Start a Conversation