Website privacy policy in the UK: what it must say and where it goes

Do I need a privacy policy on my website?

“do i need a privacy policy on my website” is searched 90 times a month in the UK, and “website privacy policy” 390 times. The short answer: yes, as soon as the site handles personal data, and almost every business site does. GOV.UK puts the rule simply: when you collect someone’s personal data, you must tell them who you are and how you’ll use their information, including if it’s being shared with other organisations.

On a typical small business website, personal data comes in through:

• A contact or quote form: name, email address, phone number, the message itself.
• An email link or a click-to-call number, when you then keep the enquiry.
• Analytics: a tool such as Google Analytics reads an identifier from the visitor’s browser.
• Embedded content: a Google map, a YouTube video, a booking widget or a chat window loaded from another company’s servers.
• A newsletter sign-up, an online booking, an order or a customer account.

A site with none of this (no form, no analytics, no embeds, nothing stored in the browser) is rare. If yours is one, a short notice saying so still answers the visitor who looks for it, and it is ready the day you add a form.

What a privacy policy must say: UK GDPR Article 13, point by point

When you collect the data from the visitor directly (a form, an account), Article 13 of the UK GDPR lists what you must tell them at the time when personal data are obtained:

• Who you are: the identity and the contact details of the controller. Your business name, postal address and an email address that someone actually reads.
• The contact details of your data protection officer, only if you have one.
• The purposes of the processing for which the personal data are intended as well as the legal basis for the processing. One line per use: answering an enquiry, sending a quote, measuring visits, sending a newsletter. On a website the basis is often consent, steps before a contract (a quote request) or legitimate interests.
• Where you rely on legitimate interests, what those interests are (for example, measuring which pages bring enquiries).
• Who receives the data: your web host, your email provider, your form or booking tool, your analytics provider.
• Whether the data leaves the UK (a tool run from abroad), and the safeguards relied on.
• The period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period. For example: enquiries that did not become jobs are deleted after a set period you choose and state.
• The visitor’s rights: access, rectification, erasure, restriction, objection and data portability, and, where you rely on consent, the right to withdraw it at any time.
• The right to make a complaint to the controller under section 164A of the 2018 Act: visitors can complain to you first.
• The right to make a complaint to the Commission under section 165 of the 2018 Act. The regulator is now called the Information Commission.
• Whether giving the data is required (for example, a phone number to book a visit) and what happens if they do not give it.
• Any automated decision-making, which a typical small business site does not have.

Article 13 is not the only rule. If you hold data you did not get from the person (a list bought or received from a partner), Article 14 adds the categories of data and from which source the personal data originate, and if applicable, whether it came from publicly accessible sources, and you must give the information within a reasonable period after obtaining the personal data, but at the latest within one month.

How to write it and where to put it

Article 12 sets the standard for the text itself: the information must be given in a concise, transparent, intelligible and easily accessible form, using clear and plain language. A notice copied from a generator that lists tools you do not use, or legal paragraphs nobody can follow, does not meet it.

1. 1
   List what the site really does first: every form, every script, every embed. Your web designer or the plugin list of your CMS will tell you.
2. 2
   Write one short section per use (enquiries, analytics, newsletter, bookings) with its purpose, legal basis, recipients and how long you keep the data.
3. 3
   Publish it on its own page, at an address that does not change (/privacy-policy or /privacy), linked from the footer of every page.
4. 4
   Add a one-line note under each form, with a link: “We use your details to answer your enquiry. See our privacy policy.”
5. 5
   Date it, and update it the day you add a tool: a new chat widget or booking system means a new recipient to name.

Cookies: when you need consent under PECR

Cookies follow a separate law, the Privacy and Electronic Communications Regulations (PECR), rewritten in 2026 by the Data (Use and Access) Act 2025. The rule: you may store or read information on a visitor’s device only if the visitor is provided with clear and comprehensive information about the purpose of the storage or access, and gives consent to the storage or access, unless one of the exceptions in Schedule A1 applies. The ones that matter for a business website:

• Strictly necessary: storage or access strictly necessary for the provision of an information society service requested by the subscriber or user, for example maintaining a record of selections made on a website, or information put into a website, by the subscriber or user (a basket, a form being filled in). No consent and no objection option needed.
• Statistics: storage or access whose sole purpose is to collect information for statistical purposes about how a website by means of which the service is provided is used with a view to making improvements to the website. Only if the information is not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website, the visitor is told the purpose, and the visitor is given a simple means of objecting, free of charge, to the storage or access and does not object.
• Appearance: storage or access whose sole purpose is to enable the way the website appears or functions when displayed on, or accessed by, the terminal equipment to adapt to the preferences of the subscriber or user (a language or text size choice), with the same information and objection conditions.

Advertising and tracking tags (a Meta pixel, Google Ads remarketing) are not in any of the exceptions of Schedule A1: they need consent before they run. The same goes for an analytics tool whose provider uses the data for its own purposes, because the statistics exception requires that the data is not shared beyond helping you improve your site. Check your analytics provider’s terms against that condition; if you cannot show it fits, ask for consent.

In practice: a banner that blocks non-essential tags until the visitor accepts, a reject option as easy to use as accept, and a cookie section in the privacy policy (or a separate cookie page linked from it) that lists each cookie, its purpose and who sets it.

A small business example: what the notice covers

Take a plumber whose site has a quote form, Google Analytics, an embedded Google map and a click-to-call number. Their privacy policy has these sections, each in a few plain sentences:

1. 1
   Who we are: trading name, address, email for privacy questions.
2. 2
   Your enquiries: what the form collects, used to reply and quote (legal basis: steps before a contract), stored in the email account and the job software, deleted after the period chosen if no job follows.
3. 3
   Website statistics: which tool, what it measures, whether it relies on consent or on the statistics exception and how to object.
4. 4
   The map: loading it sends data to Google; say so, and load it only after consent if it sets non-essential cookies.
5. 5
   Who receives your data: host, email provider, analytics provider, accounting software once you are a customer.
6. 6
   Transfers outside the UK, if any of those providers is abroad, and the safeguard relied on.
7. 7
   Your rights, how to complain to us, and your right to complain to the Information Commission.

What happens if your website has no privacy policy

Article 83(5) of the UK GDPR covers breaches of the data subjects’ rights pursuant to Articles 12 to 21, which include the information duty: fines can reach £17,500,000 or, for a business, 4% of total worldwide annual turnover, whichever is higher. That is a ceiling, not a typical amount: the same article lists what is weighed in each case, starting with the nature, gravity and duration of the infringement.

For a small business, the everyday cost is trust: a visitor who wants to know what happens to their details and finds no answer has a reason not to send the form.

Our take

Write the privacy policy from your own list of tools, not from a template: a notice that names the form, the analytics and the map your site really runs is shorter, clearer and closer to what the law asks than a generic page five times its length. Start by removing what you do not need, an unused tracking pixel or a map that could be a link, because every tool you drop is one less recipient to declare and one less cookie to ask consent for. The trap we would avoid is the cookie banner that looks compliant while advertising tags load before anyone clicks.

The FindMyCompany team