# Privacy policy for a small business website: what UK law requires

> What a UK small business website privacy policy must include under UK GDPR, a section-by-section structure, why copied templates cause problems and how to keep it accurate.

- Source: https://nerdsharks.com/blog/privacy-policy-for-small-business-website
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** If your website collects personal data through forms, bookings, sign-ups or analytics, UK GDPR requires a privacy notice. It must say who you are and how to contact you, what data you collect and why, your lawful basis, who you share it with, whether it leaves the UK, how long you keep it, people’s rights and their right to complain to the ICO.

Published 2026-09-26. 9 min read. Category: Website advice.

Most small business websites have a privacy policy. A surprising number of them describe a different business. They were copied from a template or another website, mention services the business does not offer, and say nothing about the booking system or contact form the site actually uses. That is worse than useless, because a privacy notice that is wrong does not meet the legal requirement.

This guide explains what a privacy policy for a website in the UK has to include, how to write one that matches what your site really does, and how to keep it accurate. It applies whether you are a sole trader with a contact form or a larger company with online accounts. It is general information, not legal advice; the ICO’s guidance on the right to be informed is the authoritative source.

## Why you need one

Under Articles 13 and 14 of UK GDPR, people have the right to be told how their personal data is used. If your website collects names, emails, phone numbers, addresses, booking details, IP addresses through analytics or anything else that can identify a person, you are processing personal data and must provide that information at the time you collect it. The privacy notice is how websites do this.

“Privacy policy” and “privacy notice” are used interchangeably on websites. Strictly, the notice is what you tell the public; a policy is your internal rules. What matters is the content.

## What a privacy notice must include

**Required contents of a UK GDPR privacy notice**

| Item | What to write | Small business example |
|---|---|---|
| Who you are | Business name and contact details; DPO if you have one | Smith Joinery Ltd, 4 Mill Lane, Taunton, hello@ address |
| What you collect | The categories of personal data | Name, phone, email, address, photos of the job, messages |
| Why you collect it | The purposes | To reply to enquiries, quote, carry out work, invoice |
| Lawful basis | The basis for each purpose | Contract for quotes and jobs; legal obligation for tax records; legitimate interests for follow-ups |
| Legitimate interests | What they are, if you rely on them | Keeping records to deal with warranty claims |
| Who you share it with | Recipients or categories of recipient | Website host, email provider, accounting software, accountant |
| International transfers | Whether data leaves the UK and how it is protected | Some software providers store data in the US under approved safeguards |
| How long you keep it | Retention periods or the criteria used | Enquiries that do not become jobs deleted after 12 months; invoices kept for tax |
| People’s rights | Access, rectification, erasure, restriction, objection, portability, withdrawing consent | How to ask, and that it is free in most cases |
| Right to complain | That people can complain to the ICO | With a link to ico.org.uk |
| Whether they have to provide it | If data is needed for a contract, and what happens if not | We need an address to quote for work at your property |
| Automated decisions | Any automated decision-making with significant effects | Usually “we do not do this” |

## Start with an honest data map

You cannot write an accurate notice until you know what your website and business actually do with data. Spend twenty minutes listing every way personal information comes in and where it goes. For a typical small business site that includes:

- The contact or quote form, and where submissions are stored and emailed.
- Any booking system, including the third-party company that runs it.
- Newsletter or email marketing sign-ups, and the mailing service used.
- Analytics and any advertising pixels, and what they collect.
- Payment providers, if you take payments online.
- Live chat, WhatsApp links, review widgets or embedded maps.
- Your email provider, CRM, accounting software and anyone you share job details with, such as subcontractors.

> If a tool on your website collects data and it is not in your privacy notice, the notice is incomplete.

## Write it in plain English

The law requires the information to be concise, transparent, intelligible and in clear and plain language. Walls of legal text copied from a large corporation fail that test for a small business. Short sections with headings, written the way you would explain it to a customer, are both more compliant and more reassuring.

A layered approach works well: a one-line summary near each form (“We use these details only to reply to your enquiry. See our privacy notice.”) with the full notice linked from the footer of every page.

## Why copied templates cause problems

Templates from reputable sources, including the ICO’s own privacy notice generator for small organisations, are a good starting point, provided you edit every section to match your data map.

- They list lawful bases, data and recipients that do not apply to you, which makes the notice inaccurate.
- They miss the tools you actually use, such as a specific booking or payment system.
- They name another company or jurisdiction, sometimes a US state law that does not apply in the UK.
- They include commitments you do not keep, such as retention periods you have never enforced.
- Copying another business’s text can also infringe their copyright.

## Cookies, the ICO fee and related pages

Your privacy notice should mention cookies and analytics, but the detail usually lives in a separate cookie policy linked from it and from your cookie banner or notice. Cookies are governed by PECR as well as UK GDPR, and the exceptions changed in February 2026.

Most organisations that process personal data must also pay the ICO data protection fee each year, unless exempt. At the time of writing the lowest tier, for most micro businesses, is £52 a year. The ICO’s online self-assessment tells you whether you need to pay. Your privacy notice does not need to mention the fee, but paying it is part of the same set of obligations.

## Keeping it accurate

A privacy notice is a living document. Review it whenever you add a feature that touches personal data: a new booking system, a newsletter, online payments, a chat widget, a new analytics tool. Put a “last updated” date at the top so you and your customers can see it is current. A yearly review is a sensible minimum even if nothing seems to have changed.

## Privacy notice checklist

When Nerdsharks builds a site, the privacy notice is written from the actual features it launches with, then updated when features change, because an accurate notice is part of a working website rather than an afterthought.

- Business name and contact details for privacy questions.
- Every type of personal data your site and business collect.
- A purpose and lawful basis for each use.
- Every processor and recipient, named or described by category.
- International transfers and safeguards.
- Retention periods you actually follow.
- People’s rights and how to use them.
- The right to complain to the ICO, with a link.
- A link from every form and from the footer of every page.
- A “last updated” date.

## Questions

### Can I copy a privacy policy from another website?

You should not copy another website’s privacy policy. It will describe their data, tools and lawful bases rather than yours, so it will not meet UK GDPR, and copying their text may infringe copyright. Use a reputable template, such as the ICO’s generator, and edit every section to match what you actually do.

### Does a website with no contact form need a privacy policy?

Even without a contact form, most websites collect some personal data, for example through analytics, embedded content or server logs that record IP addresses. If your site processes any personal data, you need to tell visitors how. A very simple site may only need a short notice.

### Where should a privacy policy go on a website?

A privacy notice should be linked from the footer of every page and from, or right next to, every form that collects personal data. People should be able to find it at the moment they hand over their details, not only by searching for it.

### How often should I update my website privacy policy?

Update your privacy notice whenever you change how you collect or use personal data, such as adding a booking system, newsletter or analytics tool, and review it at least once a year. Include a “last updated” date so readers can see it is current.

### Is a privacy policy the same as terms and conditions?

No. A privacy notice explains how you handle personal data and is required under UK GDPR if you collect any. Terms and conditions set out the contract between you and your customers. Many websites need both, but they do different jobs and should be separate pages.

## Sources

- The right to be informed, Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
- Data protection fee, Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/data-protection-fee/
- Guidance on the use of storage and access technologies (cookies), Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/