Joomla GDPR Compliance Checklist for European Businesses
If your Joomla website serves visitors in the European Union, GDPR compliance is not optional. This practical checklist covers everything your Joomla site must address — from cookie consent to data subject rights — to meet its obligations under EU data protection law.
Cookie Consent
- ☐ Cookie consent banner is implemented and displayed to all EU visitors
- ☐ Non-essential cookies (analytics, marketing, third-party) are actually blocked before consent — not just notified about
- ☐ Cookies are classified into clear categories: Necessary, Functional, Analytics, Marketing
- ☐ Visitors can accept or reject individual cookie categories
- ☐ The "reject" option is as easy to access as the "accept" option — no dark patterns
- ☐ Consent choices can be changed or withdrawn at any time
- ☐ Cookie consent choices are logged with timestamps for regulatory evidence
- ☐ Google Consent Mode v2 is configured (if using Google Analytics or Ads)
How to test: Clear all cookies, visit your site, and check your browser's developer tools (Application → Cookies) before clicking accept. If analytics or marketing cookies appear before you consent, your implementation is not compliant.
Privacy Policy
- ☐ Privacy policy is published and easily accessible from every page
- ☐ Policy accurately describes all personal data collected (forms, cookies, analytics, user registration)
- ☐ Legal basis for processing is stated for each type of data
- ☐ Data retention periods are specified
- ☐ Third parties receiving data are identified (Google Analytics, payment processors, email services)
- ☐ Data subject rights are explained (access, deletion, correction, portability, objection)
- ☐ Contact details for data protection enquiries are provided
- ☐ Policy is written in clear, understandable language — not legal jargon
Cookie Policy
- ☐ Separate cookie policy is published (or a comprehensive cookie section within the privacy policy)
- ☐ Every cookie used by the site is listed with its name, purpose, provider, and duration
- ☐ Cookies are categorised (necessary, functional, analytics, marketing)
- ☐ Instructions for managing cookies in browser settings are provided
Forms and Data Collection
- ☐ Every form collecting personal data includes a link to the privacy policy
- ☐ Consent checkboxes are unchecked by default — no pre-ticked boxes
- ☐ Only necessary data is collected — do not ask for information you do not need
- ☐ Contact form submissions are stored securely and retained only as long as necessary
- ☐ Newsletter sign-ups use double opt-in (confirmation email before adding to list)
User Registration (If Applicable)
- ☐ Registration process includes privacy policy acceptance
- ☐ Users can view, export, and delete their personal data
- ☐ Joomla's built-in privacy tools are configured (available in Joomla 3.9+, improved in 5/6)
- ☐ User data is not retained after account deletion
Data Subject Rights
- ☐ A clear process exists for handling data access requests
- ☐ A clear process exists for handling data deletion requests ("right to be forgotten")
- ☐ Requests can be responded to within 30 days (GDPR requirement)
- ☐ Contact information for submitting requests is published on the website
Technical Measures
- ☐ Website uses HTTPS (SSL/TLS) for all pages
- ☐ Joomla version is current and receiving security updates
- ☐ All extensions are updated to their latest versions
- ☐ Strong passwords and two-factor authentication are in use for administrator accounts
- ☐ Regular backups are in place
- ☐ Personal data is not transmitted to servers outside the EU without adequate safeguards
Third-Party Services
- ☐ Data processing agreements are in place with all third-party services handling personal data
- ☐ Third-party services are listed in your privacy policy
- ☐ Third-party scripts are blocked by your cookie consent mechanism until consent is given
- ☐ If using US-based services, EU-US Data Privacy Framework adequacy or Standard Contractual Clauses are in place
The Uncomfortable Truth About Joomla 3 and GDPR
If your website runs on Joomla 3 or any earlier version, achieving genuine GDPR compliance is fundamentally compromised. GDPR requires "appropriate technical measures" — running software without security updates since 2023 fails this test on its face.
You can install a cookie banner on Joomla 3. You can publish a privacy policy. But you cannot credibly claim your website implements appropriate technical measures when the core platform has known, unpatched security vulnerabilities. Upgrading to a supported Joomla version is the foundation upon which all other compliance measures must be built.
Need Help with GDPR Compliance?
We implement and monitor GDPR compliance specifically for Joomla websites. Our free site audit includes a GDPR assessment that checks your cookie handling, consent mechanism, and privacy policy against current requirements.
Joomla 4 End of Life: Why You Must Upgrade Now
Joomla 4 reached its official end of life on 14 October 2025. If your website still runs on Joomla 4, it is no longer receiving security patches from the Joomla Project. The window to upgrade safely is open — but it will not stay open indefinitely.
Unlike the Joomla 3 end of life, which caught many website owners unprepared, the Joomla 4 situation has a significant advantage: upgrading from Joomla 4 to Joomla 5 is the easiest migration path in the Joomla ecosystem.
What Has Changed Since October 2025
Since Joomla 4 reached end of life, security support has ended completely. Any vulnerability discovered in the Joomla codebase is patched in Joomla 5 and 6 only. The vulnerability details are published in the Joomla Security Centre — effectively creating a public roadmap for exploiting unpatched Joomla 4 installations.
Extension developers have shifted their primary focus to Joomla 5 and 6. While most Joomla 4 extensions continue to work, they are receiving less testing, fewer updates, and less attention. Some developers have already released their final Joomla 4 versions.
The Good News: Joomla 4 to 5 Is Simple
Joomla 4 and Joomla 5 share the same core architecture. Unlike the Joomla 3 to 4/5 migration — which required a complex, multi-step process with extension replacements and template rebuilds — the Joomla 4 to 5 upgrade uses the standard Joomla Update component. Your template will likely work. Most of your extensions will work. The upgrade process is measured in hours, not weeks.
However, "simple" does not mean "risk-free." Extensions can break if they relied on deprecated features. Custom code may need updating. Server requirements must be verified (Joomla 5 requires PHP 8.1+ and MySQL 8.0+). And your search rankings must be protected throughout the process.
Professional handling eliminates these risks. We test everything in a staging environment before touching your live site, and we include a 30-day post-upgrade warranty with every project.
Joomla 5 or Joomla 6?
When upgrading from Joomla 4, you can target either version:
Joomla 5 is the Long Term Support release — stable, proven, and with a mature extension ecosystem. This is the conservative, reliable choice. You can upgrade to Joomla 6 later at your own pace.
Joomla 6 is the current release — latest features, most modern codebase, longest runway before the next major upgrade. The path goes through Joomla 5.4 as a bridge. The Compatibility Plugin ensures most extensions work even before they receive native Joomla 6 updates.
We assess your specific extension configuration during our free audit and recommend the target version that best suits your installation.
Do Not Wait for a Problem to Force Your Hand
The Joomla 3 end of life taught us a lesson: many website owners waited until their sites were hacked, their hosting dropped PHP support, or Google flagged their site before taking action. Emergency migrations are always more expensive, more stressful, and more damaging than planned upgrades.
Joomla 4 to 5 is one of the fastest, lowest-risk upgrades available. Most projects start from €600 and are completed within one to two weeks. There is no good reason to delay.
Complete Guide: Migrating Joomla 3 to Joomla 6 in 2026
Migrating from Joomla 3 to Joomla 6 is the most comprehensive upgrade path in the Joomla ecosystem. It spans two architectural generations and requires careful planning, execution, and testing. This guide explains what the migration involves, why it cannot be done with a single click, and how the process works from start to finish.
Why This Is a Migration, Not an Update
When Joomla 4 was released, it introduced a completely rewritten framework. The legacy code that powered Joomla 3 — the MVC architecture, the Bootstrap 2 template system, the extension API — was replaced with modern, namespaced, PSR-compliant code using Bootstrap 5. This architectural break means Joomla 3 cannot simply be "updated" to a modern version the way you would apply a minor Joomla update.
Everything must be handled: the core CMS must migrate through intermediate versions, every extension must be updated or replaced with a modern equivalent, your template must be rebuilt for Bootstrap 5, and your URL structure must be mapped with redirects to preserve search engine rankings.
The Migration Path
Joomla 3 to Joomla 6 follows a four-stage path:
- Joomla 3.10.x — ensure you are on the latest Joomla 3 release
- Joomla 3 → Joomla 4 — the critical architecture bridge (most complex step)
- Joomla 4 → Joomla 5.4 — standard upgrade within the same architecture
- Joomla 5.4 → Joomla 6 — standard upgrade to the latest version
All four stages are performed on a staging environment. Your live Joomla 3 site continues operating normally until the completed, tested Joomla 6 site is ready for deployment.
What Transfers and What Does Not
Content Transfers Cleanly
Your articles, categories, tags, menu structures, user accounts, media files, and core configuration all transfer through the migration process. Content is the one area where you can expect a smooth transition — the Joomla core has handled content migration reliably across major versions for years.
Extensions Must Be Replaced or Updated
This is typically the most time-consuming aspect of a Joomla 3 migration. Every extension on your Joomla 3 site needs to be addressed individually. Well-maintained extensions like Akeeba Backup, HikaShop, AcyMailing, Kunena, and JCE Editor have Joomla 5/6 versions with migration paths for their data. Discontinued extensions must be replaced with modern alternatives. Custom-built components may need to be rewritten.
We conduct a complete extension compatibility assessment as part of every free site audit, so you know exactly what transfers, what needs replacement, and what requires custom work before any paid work begins.
Templates Must Be Rebuilt
Your Joomla 3 template will not work on Joomla 6 under any circumstances. The underlying framework (Bootstrap 2 vs Bootstrap 5), the template override system, and the module position architecture have all changed fundamentally. A new template must be built — either by customising a commercial Joomla 6 template, customising the Cassiopeia default template, or building a custom template from scratch.
Many clients use the migration as an opportunity to refresh their design. But if you want to preserve your existing look, we can recreate it faithfully in a modern Joomla 6 template.
SEO: The Hidden Risk
The aspect of Joomla 3 migration that receives the least attention but carries the most business impact is SEO preservation. If your website has established search engine rankings — and any site that has been live for several years almost certainly does — a botched migration can destroy those rankings overnight.
Every URL on your Joomla 3 site must be mapped to its corresponding URL on the Joomla 6 site, with 301 redirects configured to transfer the ranking signals. Metadata must be preserved. Canonical tags must be correct. The XML sitemap must be regenerated and submitted. Post-migration monitoring must watch for indexation issues.
We include comprehensive migration SEO as standard in every upgrade project — it is not an optional add-on. Learn more about our SEO approach →
How Long Does It Take?
A standard business website (10-20 extensions, commercial template, moderate content volume) typically takes two to three weeks from audit to live deployment. Complex sites — with custom components, e-commerce, multi-language content, or large content volumes — may require four to six weeks.
The timeline depends primarily on extension complexity and template requirements, not on the volume of content. A site with 10,000 articles but standard extensions migrates faster than a site with 50 articles and five custom components.
Can You Do It Yourself?
Technically, it is possible for an experienced Joomla administrator to perform a Joomla 3 to 6 migration. The Joomla documentation and community resources provide guidance on the process.
Practically, we advise against it for production websites. The multi-step migration process has many failure points. Extension data migration requires careful handling. Template rebuilding requires development skills. SEO preservation requires methodical redirect mapping. And testing must be thorough — a missed issue on a live site creates real business damage.
The cost of a professional migration is predictable and fixed. The cost of recovering from a failed DIY migration is unpredictable and often higher.
Next Steps
Every migration starts with understanding your current installation. Our free site audit examines your Joomla 3 website in detail and delivers a comprehensive report — extension compatibility, template assessment, SEO baseline, compliance status, and a clear migration plan with a fixed-price quotation.
Joomla 3 End of Life: Why Your Website Is at Risk in 2026
Joomla 3 reached its official end of life on 17 August 2023. If you are reading this in 2026, your Joomla 3 website has been running without security updates for nearly three years. This is not a theoretical risk — it is a documented, escalating danger to your business, your data, and your visitors.
This article explains exactly what end of life means for your Joomla 3 website, why the urgency increases every month, and what your options are.
What "End of Life" Actually Means
When the Joomla Project declares a version end of life, three things stop permanently:
No more security patches. Every vulnerability discovered after August 2023 that affects Joomla 3 will never be fixed for that version. The vulnerabilities are patched in Joomla 5 and 6, and the details of each fix are published openly in the Joomla Security Centre. This means that attackers can read exactly how to exploit your version — and they do.
No more bug fixes. Any functional issues, compatibility problems, or software defects in Joomla 3 will never be resolved. If something breaks, there is no official fix coming.
No more compatibility updates. As PHP evolves, as MySQL changes, as web standards advance — Joomla 3 will not be updated to work with them. The gap between what your hosting provider runs and what Joomla 3 supports is widening every month.
The Risks Are Not Theoretical
Known Vulnerabilities Are Public Knowledge
Since August 2023, multiple security vulnerabilities have been disclosed that affect Joomla 3. These include cross-site scripting (XSS) vulnerabilities across multiple core components, SQL injection vectors, and file upload vulnerabilities. Each vulnerability is documented in the Joomla Security Centre with enough detail for any competent attacker to develop an exploit.
Community efforts like the Joomla 3.10.999 project have provided unofficial patches for some of these issues, covering 55 files across 9 separate XSS vulnerabilities and other security fixes. However, applying these patches requires manual file editing on every site — and they only cover vulnerabilities discovered up to the point the patches were created. New vulnerabilities discovered after the patches are released remain unaddressed.
PHP Support Is Ending
Joomla 3 was built for PHP 5.6 through PHP 7.4. PHP 7.4 reached its end of life in November 2022. Hosting providers are removing PHP 7.4 from their servers — and when your provider does this, your Joomla 3 website will either stop working entirely or be forced onto a PHP version it was never tested against.
This is not a question of if, but when. Some providers have already made the change. Others are giving notice. When your provider moves, your site breaks — often without warning and without an easy fix.
Extensions Are Dying
Extension developers have moved on. The most popular Joomla extensions — Akeeba Backup, HikaShop, AcyMailing, Kunena, RSForm Pro — have all shifted their development focus to Joomla 5 and 6. Their Joomla 3 versions receive minimal maintenance at best, and many have already released their final Joomla 3 updates.
Every unpatched extension on your Joomla 3 site is an additional vulnerability. If you run 20 extensions and none of them receive security updates, you have 20 potential entry points for attackers — on top of the Joomla core vulnerabilities.
GDPR Liability
If your website collects any personal data — contact forms, user registrations, analytics, cookies — you are processing personal data under GDPR. The regulation requires "appropriate technical measures" to protect that data. Running a content management system that has not received a security update in nearly three years is extremely difficult to defend as an "appropriate technical measure" in any regulatory review.
If a breach occurs on your Joomla 3 site and is traced to an unpatched vulnerability, the regulatory consequences under GDPR can be severe — fines of up to €20 million or 4% of annual turnover.
Search Engine Consequences
Google may flag compromised websites in its search results with warnings like "This site may be hacked." These warnings destroy click-through rates and can take weeks to remove even after the underlying issue is resolved. Your years of SEO investment can be wiped out by a single security incident.
What You Should Do
Option 1: Upgrade to Joomla 5 or 6 (Recommended)
The only genuine long-term solution is migrating your website to a supported Joomla version. Joomla 5.4 is the current Long Term Support release — stable, proven, and fully supported. Joomla 6 is the latest release with the newest features and active development.
Migration from Joomla 3 is a structured process. It is not a one-click update — the architecture changed between Joomla 3 and 4, so the migration requires extension updates or replacements, template rebuilding, and careful data transfer. But the result is a modern, secure website on a supported platform with years of updates ahead of it.
Option 2: Apply Community Patches (Temporary)
If you cannot migrate immediately, applying the community-provided security patches (such as the 3.10.999 project) addresses some known vulnerabilities. This is a stopgap measure, not a solution — it buys time while you plan your migration, but it does not address future vulnerabilities and does not resolve the PHP compatibility issue.
Option 3: Do Nothing (Not Recommended)
Continuing to run an unpatched Joomla 3 website is a gamble that gets worse every month. The longer you wait, the more vulnerabilities accumulate, the fewer extension developers maintain Joomla 3 compatibility, and the harder it becomes for hosting providers to support the PHP versions Joomla 3 requires. Eventually, something will force your hand — and an emergency migration after a hack or a hosting failure is always more expensive and more stressful than a planned upgrade.
The Cost of Waiting vs The Cost of Upgrading
A professional Joomla 3 to 5 or 6 migration for a standard business website starts from €1,200 to €1,500. Complex sites with custom components, e-commerce, or multi-language content cost more, but the scope and cost are defined upfront through a free site audit.
Compare that to the cost of a security breach: emergency incident response, data breach notification to the Data Protection Authority, potential GDPR fines, lost business during downtime, damaged search rankings, and the reputation cost of informing customers that their data may have been compromised. The upgrade is always cheaper than the breach.
How We Can Help
We specialise in Joomla 3 migrations for European businesses. Our free site audit examines your Joomla 3 installation and delivers a detailed report within 24 hours — every extension checked for compatibility, every risk identified, and a clear migration plan with a fixed-price quotation.
No cost. No obligation. No sales pressure. Just a clear technical assessment from Joomla specialists who understand exactly what your site needs.
Page 3 of 3