A plumber in Leeds with a five page website and a "request a quote" form is collecting personal data. So is a florist in Bristol running Google Analytics, and a yoga teacher in Brighton with a Mailchimp signup box. Each of them owes visitors a clear explanation of what happens to that data. This guide covers what UK law requires, what the notice must say, and the mistakes that turn up again and again on small business sites.
Does my website need a privacy policy in the UK?
Strictly, the legal duty is to provide "privacy information", not to publish a document called a privacy policy. A web page is the most practical way to do it. Business size is not the test. A sole trader with one form has the same transparency duty as a national retailer, though the notice itself can be much shorter.
The rare exception is a purely static page with no forms, no analytics, no embedded maps or videos, and no third party scripts. Even then your hosting provider probably logs IP addresses. Publishing a short, accurate notice takes an hour or so and removes the question.
What does UK law actually require a privacy notice to say?
According to the ICO's guidance on what privacy information to provide, the core items are:
- your organisation's name and contact details
- the purposes of the processing, with each purpose stated separately
- the lawful basis for each purpose
- retention periods, or the criteria you use to set them
- the individual's rights
- the right to complain to a supervisory authority, which for UK firms means the ICO
The conditional items cover recipients of the data, transfers outside the UK, the legitimate interests you rely on, the right to withdraw consent, whether giving the data is a statutory or contractual requirement, and any automated decision making. The ICO is specific on one point: the right to object must be brought to people's attention "clearly and separately from any other information". The ICO has been updating its guidance following the Data (Use and Access) Act, so check the page again at your next annual review.
Which lawful basis should a small business website use?
A quote form is a good example. Replying to someone who asked for a quote usually fits legitimate interests, or steps taken before entering a contract. Adding that person to a monthly newsletter is a different purpose and normally needs consent, apart from the narrow "soft opt-in" for marketing similar products to existing customers. Your notice should show each purpose and its basis separately. If you send follow-up sequences such as abandoned basket emails, check which basis you are relying on before you switch them on, not after. Cookie consent is a separate question under PECR, covered below.
How long should my website keep personal data?
Work through each data flow in turn. Form submissions often sit in three places at once: the website database, the notification email inbox and a CRM. Your retention promise has to hold true in all three. Customer records tied to invoices usually need to be kept longer for tax purposes, so say that and give the reason. Then set a calendar reminder to actually delete things, because a retention period that never triggers is a promise you are quietly breaking.
Do cookies need a separate policy or banner?
The rules changed this year. A summary of the Data (Use and Access) Act changes on JD Supra reports that most of the Act's provisions came into force in early 2026. These include consent exemptions for cookies that collect statistical information about how a site is used and for cookies that adapt a site to a visitor's preferences, provided visitors are told and can easily object. Advertising and cross-site tracking cookies are not covered by those exemptions, so a site running Meta or Google ads pixels still needs a working consent banner that blocks those scripts until someone agrees.
The same summary notes the maximum PECR fine has risen from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. A small firm is unlikely to face that ceiling, but it shows how seriously Parliament now treats cookie and marketing compliance.
Where should the privacy policy appear on my website?
A one line note under a form works well: "We use these details to reply to your enquiry. See our privacy notice." That short statement plus a full notice one click away is what the ICO calls a layered approach. It is also easier to read on a phone. If you embed third party tools such as review widgets or an AI chat assistant, add a line where the widget appears, because those suppliers often receive visitor data directly.
What are the most common privacy policy mistakes on UK small business sites?
Other problems turn up often enough to check for:
- EU references such as "GDPR" and an EU regulator, with no mention of UK GDPR or the ICO
- a US template citing California law and nothing relevant to the UK
- contact details for a web designer rather than the business itself
- no mention of international transfers, despite using US email or CRM tools
- a "last updated" date several years old
Each of these signals a notice nobody has checked against the real site. If you use AI tools to handle enquiries or customer data, this AI data protection checklist for UK businesses covers the extra disclosures those tools need.
Is a privacy policy all I need to be compliant?
The fee is the step most often missed. The ICO's small business fee guidance says most companies will only need to pay £52 or £78 a year, that large organisations pay £3,763, and that paying by Direct Debit deducts £5. It also warns that if you need to pay and do not, you could be fined. The ICO's self assessment takes a few minutes and tells you which tier applies or whether you are exempt.
How often should I review my website privacy policy?
A simple routine works. Keep a one page list of every tool that touches customer data. When something is added or removed, update the list and the notice together, then change the "last updated" date. Pair the annual review with your ICO fee renewal so both happen in the same week. For a site rebuild, treat the privacy notice as part of the launch checklist alongside forms, tracking and page speed. A broader website build or redesign is the natural moment to do this properly rather than carrying an old notice forward.
Website Privacy Policy UK — FAQ
Does a small UK business website legally need a privacy policy?
If the site collects any personal data, yes. A contact form, a booking widget, a newsletter signup, an order checkout or a tracking cookie all count. UK GDPR gives people the right to be told who is collecting their data, why, on what lawful basis, how long it is kept and how to complain. On a website, the usual way to meet that duty is a privacy notice linked from every page and shown wherever data is collected. The only site that might not need one is a static brochure page with no forms, no analytics and no third party embeds. Even then most hosts log IP addresses, so the safe course is to publish a short, accurate notice.
What must a UK website privacy policy include?
The ICO lists the information you must give when you collect data directly from people. Some items always apply: your organisation's name and contact details, the purposes of processing, the lawful basis for each purpose, retention periods or the criteria for setting them, people's rights, and the right to complain to the ICO. Others apply only if relevant, such as recipients of the data, transfers outside the UK, the legitimate interests you rely on, the right to withdraw consent, and any automated decision making. The right to object must be flagged clearly and separately from everything else.
Can I copy a privacy policy template from another website?
You can start from a template, but copying another firm's policy word for word nearly always produces an inaccurate notice. Their tools, suppliers, retention periods and purposes will differ from yours. An inaccurate notice fails the transparency duty just as a missing one does, and it also creates a written record of promises you are not keeping. Use a template for structure only, then rewrite every section against an honest list of the forms, plugins, payment providers, email tools and analytics your site actually runs.
Is a cookie banner the same as a privacy policy?
No. They are separate duties under separate rules. The privacy policy comes from UK GDPR and explains how you handle personal data. Cookie consent comes from PECR and controls whether you can set non-essential cookies on someone's device at all. Changes brought in by the Data (Use and Access) Act 2025 mean some cookies, including certain statistical analytics and preference cookies, can now be exempt from consent, provided visitors are told about them and given a simple way to object. You still need to explain them, usually in a cookie section of your privacy notice or a separate cookie policy.
Do I need to pay the ICO as well as having a privacy policy?
Probably. The data protection fee is a separate obligation from the privacy notice, and many small businesses that use personal data must pay it unless they are exempt. The ICO says most companies will pay £52 or £78 a year, with large organisations paying £3,763, and setting up a Direct Debit takes £5 off. The ICO also warns that if you need to pay and do not, you could be fined. Its online self assessment tells you in a few minutes whether you owe it.
