GDPR has a reputation for being complicated and frightening. For most small businesses it is neither. The principles are common sense: collect what you need, be honest about it, look after it and get rid of it when you are finished. The complications come from not knowing what your own website is doing with data.
This guide covers GDPR for small business websites in the UK: what UK GDPR and the Data Protection Act 2018 require, how the Privacy and Electronic Communications Regulations affect marketing and cookies, and what changed with the Data (Use and Access) Act 2025. It is written for business owners, not lawyers, and is general information rather than legal advice.
The UK rules in one paragraph
Since leaving the EU, the UK has its own version of GDPR, called UK GDPR, which works alongside the Data Protection Act 2018. The Privacy and Electronic Communications Regulations (PECR) add specific rules for cookies and electronic marketing. The Data (Use and Access) Act 2025 amended all three, with changes phased in through 2025 and 2026. The Information Commissioner’s Office (ICO) regulates all of it and publishes free guidance aimed at small organisations.
Where your website touches personal data
| Feature | Personal data involved | Usual lawful basis | What to get right |
|---|---|---|---|
| Contact or quote form | Name, contact details, message, sometimes address or photos | Steps before a contract, or legitimate interests | Ask only for what you need; link the privacy notice; store securely |
| Online booking | Contact details, appointment details, sometimes health notes | Contract | Check the booking provider’s terms; be careful with health information |
| Online shop | Names, addresses, order history, payment references | Contract; legal obligation for tax records | Use a reputable payment provider so you never hold full card numbers |
| Newsletter sign-up | Email address, sometimes name | Consent (PECR usually requires it) | Unticked opt-in box, easy unsubscribe, records of consent |
| Analytics | IP addresses, device identifiers | Consent or the new statistics exception for cookies | Configure to collect the minimum; match your cookie setup |
| Customer accounts | Login details, history, preferences | Contract | Strong password handling, account deletion on request |
| Reviews and testimonials | Names, sometimes photos | Consent or legitimate interests | Ask permission to publish names and photos |
Special category data: take extra care
Some information is treated as more sensitive under UK GDPR, including health data, racial or ethnic origin, religious beliefs, sexual orientation and biometric data. Clinics, therapists, personal trainers, beauty salons doing patch tests and some care businesses routinely handle health information, sometimes through a website form.
If that applies to you, you need both a lawful basis and an additional condition for processing, you should think carefully about whether the form really needs to ask, and you must protect it properly. A generic contact form emailing health details to a shared inbox is a risk. A secure booking or intake system designed for the purpose is better. The ICO’s guidance on special category data is worth reading in full.
Email marketing and PECR
Sending marketing emails or texts to individuals is covered by PECR as well as UK GDPR. The general rule is that you need consent, given by a clear positive action such as ticking an unticked box. There is an important exception, the “soft opt-in”: you can email existing customers about similar products or services if you collected their details during a sale or negotiation, gave them a chance to opt out at the time, and give them an opt-out in every message.
Sole traders and partnerships count as individuals under PECR, so the consent rules apply when marketing to them. Limited companies and other corporate bodies are treated differently, but you must still identify yourself and offer an opt-out. An enquiry through your website is not permission to add someone to a newsletter.
Your suppliers are part of your compliance
Your web host, form service, booking system, email provider and CRM all process personal data on your behalf. Under UK GDPR they are processors and you need a written contract with each that covers how they handle the data. For mainstream providers this is usually a data processing agreement built into their terms, but you should know where it is and check where they store data.
If data is stored outside the UK, the provider should rely on a recognised safeguard, such as a UK adequacy decision or approved contract clauses. Reputable providers publish this. If a provider cannot tell you where your customers’ data is kept, that is a warning sign.
Security, retention and deletion
- Serve the whole site over HTTPS so form data is encrypted in transit.
- Protect website, email and booking accounts with strong unique passwords and two-step verification.
- Limit who has access to enquiries and customer records, and remove old staff and contractor logins.
- Keep website software and plug-ins updated; out-of-date plug-ins are a common route for attackers.
- Decide how long you keep each kind of data, write it in your privacy notice, and actually delete it on schedule.
- Do not leave customer data sitting in form plug-in databases or inboxes indefinitely.
Data requests and breaches
Anyone can ask what personal data you hold about them, which is called a subject access request. You normally have one calendar month to respond, and usually cannot charge. People can also ask you to correct or delete data in some circumstances. Keep your data organised enough that you could find everything about one customer in an afternoon.
If personal data is lost, stolen, destroyed or accessed without permission, that is a personal data breach. If it is likely to result in a risk to people’s rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it, and tell the people affected if the risk is high. A hacked website that leaks enquiry data can be a reportable breach. Keep a simple record of any breaches, even ones you decide not to report.
The Data (Use and Access) Act 2025 also introduces a requirement for organisations to have a way for people to make data protection complaints to them, alongside the existing right to complain to the ICO. Check the ICO’s guidance for when each change applies.
Small business website GDPR checklist
Most of this is set once and then checked occasionally. On Nerdsharks sites, form submissions go into the client’s own inbox and CRM rather than into scattered plug-in tables, which makes retention and data requests far simpler to handle. However your site is built, knowing where the data lives is the first step.
- List every way your website collects personal data and where it goes.
- Collect only what you need on every form.
- Identify a lawful basis for each purpose.
- Publish an accurate privacy notice, linked from every form and page footer.
- Use unticked opt-in boxes for marketing, and honour unsubscribes.
- Check you have data processing terms with every supplier.
- Use HTTPS, strong passwords and two-step verification.
- Set and follow retention periods.
- Know how you would handle a data request and a breach.
- Pay the ICO data protection fee unless exempt.