Most small business websites have a privacy policy. A surprising number of them describe a different business. They were copied from a template or another website, mention services the business does not offer, and say nothing about the booking system or contact form the site actually uses. That is worse than useless, because a privacy notice that is wrong does not meet the legal requirement.
This guide explains what a privacy policy for a website in the UK has to include, how to write one that matches what your site really does, and how to keep it accurate. It applies whether you are a sole trader with a contact form or a larger company with online accounts. It is general information, not legal advice; the ICO’s guidance on the right to be informed is the authoritative source.
Why you need one
Under Articles 13 and 14 of UK GDPR, people have the right to be told how their personal data is used. If your website collects names, emails, phone numbers, addresses, booking details, IP addresses through analytics or anything else that can identify a person, you are processing personal data and must provide that information at the time you collect it. The privacy notice is how websites do this.
“Privacy policy” and “privacy notice” are used interchangeably on websites. Strictly, the notice is what you tell the public; a policy is your internal rules. What matters is the content.
What a privacy notice must include
| Item | What to write | Small business example |
|---|---|---|
| Who you are | Business name and contact details; DPO if you have one | Smith Joinery Ltd, 4 Mill Lane, Taunton, hello@ address |
| What you collect | The categories of personal data | Name, phone, email, address, photos of the job, messages |
| Why you collect it | The purposes | To reply to enquiries, quote, carry out work, invoice |
| Lawful basis | The basis for each purpose | Contract for quotes and jobs; legal obligation for tax records; legitimate interests for follow-ups |
| Legitimate interests | What they are, if you rely on them | Keeping records to deal with warranty claims |
| Who you share it with | Recipients or categories of recipient | Website host, email provider, accounting software, accountant |
| International transfers | Whether data leaves the UK and how it is protected | Some software providers store data in the US under approved safeguards |
| How long you keep it | Retention periods or the criteria used | Enquiries that do not become jobs deleted after 12 months; invoices kept for tax |
| People’s rights | Access, rectification, erasure, restriction, objection, portability, withdrawing consent | How to ask, and that it is free in most cases |
| Right to complain | That people can complain to the ICO | With a link to ico.org.uk |
| Whether they have to provide it | If data is needed for a contract, and what happens if not | We need an address to quote for work at your property |
| Automated decisions | Any automated decision-making with significant effects | Usually “we do not do this” |
Start with an honest data map
You cannot write an accurate notice until you know what your website and business actually do with data. Spend twenty minutes listing every way personal information comes in and where it goes. For a typical small business site that includes:
- The contact or quote form, and where submissions are stored and emailed.
- Any booking system, including the third-party company that runs it.
- Newsletter or email marketing sign-ups, and the mailing service used.
- Analytics and any advertising pixels, and what they collect.
- Payment providers, if you take payments online.
- Live chat, WhatsApp links, review widgets or embedded maps.
- Your email provider, CRM, accounting software and anyone you share job details with, such as subcontractors.
Write it in plain English
The law requires the information to be concise, transparent, intelligible and in clear and plain language. Walls of legal text copied from a large corporation fail that test for a small business. Short sections with headings, written the way you would explain it to a customer, are both more compliant and more reassuring.
A layered approach works well: a one-line summary near each form (“We use these details only to reply to your enquiry. See our privacy notice.”) with the full notice linked from the footer of every page.
Why copied templates cause problems
Templates from reputable sources, including the ICO’s own privacy notice generator for small organisations, are a good starting point, provided you edit every section to match your data map.
- They list lawful bases, data and recipients that do not apply to you, which makes the notice inaccurate.
- They miss the tools you actually use, such as a specific booking or payment system.
- They name another company or jurisdiction, sometimes a US state law that does not apply in the UK.
- They include commitments you do not keep, such as retention periods you have never enforced.
- Copying another business’s text can also infringe their copyright.
Cookies, the ICO fee and related pages
Your privacy notice should mention cookies and analytics, but the detail usually lives in a separate cookie policy linked from it and from your cookie banner or notice. Cookies are governed by PECR as well as UK GDPR, and the exceptions changed in February 2026.
Most organisations that process personal data must also pay the ICO data protection fee each year, unless exempt. At the time of writing the lowest tier, for most micro businesses, is £52 a year. The ICO’s online self-assessment tells you whether you need to pay. Your privacy notice does not need to mention the fee, but paying it is part of the same set of obligations.
Keeping it accurate
A privacy notice is a living document. Review it whenever you add a feature that touches personal data: a new booking system, a newsletter, online payments, a chat widget, a new analytics tool. Put a “last updated” date at the top so you and your customers can see it is current. A yearly review is a sensible minimum even if nothing seems to have changed.
Privacy notice checklist
When Nerdsharks builds a site, the privacy notice is written from the actual features it launches with, then updated when features change, because an accurate notice is part of a working website rather than an afterthought.
- Business name and contact details for privacy questions.
- Every type of personal data your site and business collect.
- A purpose and lawful basis for each use.
- Every processor and recipient, named or described by category.
- International transfers and safeguards.
- Retention periods you actually follow.
- People’s rights and how to use them.
- The right to complain to the ICO, with a link.
- A link from every form and from the footer of every page.
- A “last updated” date.