Does a small business website need a privacy policy? In the UK, if the site collects anything that identifies a person, a contact form, a booking, a newsletter sign-up, then yes: UK GDPR requires you to tell people what you do with their information at the moment you collect it, and a page on the website is the usual way to do that. Most sites have one. Far fewer have one that describes what that business actually does.
When a website needs one
The trigger is collecting personal data, meaning anything that identifies a living person: a name, a phone number, an email address, a photo of their house sent with a quote request. If your site does any of the following, it collects personal data:
- A contact or quote form.
- Online booking or appointments.
- A newsletter or mailing list sign-up.
- A shop or payments, even through a third party.
- Analytics or advertising tags that track individual visitors.
A site with none of these, a brochure page with a phone number on it, collects very little itself. It is still worth a short notice, because the host’s server logs and any embedded maps or videos may collect visitors’ data on your behalf. What you set on visitors’ devices is a separate question under a separate law, covered in do you need a cookie banner?.
What the notice has to say
The ICO’s guidance for small organisations and its checklist for the right to be informed set out the contents. For a small business collecting information directly from customers, it comes to this:
- Who you are and how to contact you about their data.
- What you collect. Be specific: name, phone, email, postcode, photos.
- Why you collect it, and your lawful basis for each purpose.
- Who else receives it. Your email provider, website host, booking system, accountant.
- Whether it leaves the UK, if any of those suppliers store it abroad.
- How long you keep it.
- People’s rights: to see their data, correct it, have it deleted in some cases, object, and withdraw consent where consent is your basis.
- How to complain, to you and to the ICO.
A data protection officer, profiling and automated decisions only need mentioning if they apply, and for most small firms they do not.
A template for a business with a contact form
This is a starting point, not a finished notice. Replace every bracket, delete what does not apply, and add anything your business does that is not here.
What we collect. When you send an enquiry through this website we receive your name, phone number, email address and postcode, the details of the job, and any photos you attach.
Why, and on what basis. We use them to reply to you, arrange a visit and give you a quote. Our lawful basis is that you have asked us to take these steps before entering into a contract. If you become a customer, we keep your details to carry out the work and to keep the financial records the law requires.
Who else sees them. Our email provider [name], our website host [name], and our accountant [name] for invoices. We do not sell your details or pass them to anyone for marketing.
How long we keep them. Enquiries that do not become jobs: [12 months] after our last contact. Customer records and invoices: [six years], because tax law requires us to keep financial records.
Your rights. You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it where we are not required to keep it. Email [address].
Complaints. If you are unhappy with how we have handled your information, tell us at [address] and we will reply. You can also complain to the Information Commissioner’s Office at ico.org.uk.
On the retention figure: gov.uk says the self-employed must keep records for at least five years after the 31 January submission deadline of the tax year, and limited companies for six years from the end of the financial year they relate to. Choose the period that fits you and say it.
If you would rather build the notice from questions, the ICO has a free privacy notice generator on the same small organisations pages.
The lawful basis most small businesses use
UK GDPR offers six lawful bases, and a small service business rarely needs more than two of them for its website.
-
Contract
Contract covers using someone’s details to do what they asked: reply to their quote request, book the job, do the work, send the invoice. It includes the steps before a contract exists.
-
Legal obligation
Legal obligation covers keeping invoices and records because tax law requires it.
-
Consent
Consent is for things the person did not need to agree to in order to get the job, newsletters being the usual one. It must be a clear opt-in, never a pre-ticked box.
Marketing emails have their own rules under PECR. The ICO’s guidance allows a “soft opt-in” for existing customers who bought, or negotiated to buy, something similar from you, provided you offered a simple way to opt out when you collected their details and in every message. It does not cover bought-in lists, or people who never bought or negotiated to buy anything from you.
What changed in June 2026
The Data (Use and Access) Act 2025 added a duty that took effect on 19 June 2026: every controller must give people a way to make a data protection complaint to it, acknowledge a complaint within 30 days, and keep the person informed until it is resolved. The ICO’s guidance says a separate form is not required, and that an existing channel such as an email address can be used, with an automatic acknowledgement enough for the first step.
For a small business that means one practical change: the notice should say people can complain to you, and how, before they go to the ICO. The template above already does.
Where it goes on the site
Two places. A link in the footer of every page, so it can always be found, and a short line beside the form’s send button: “We use these details to reply to your enquiry. [Privacy notice]”. The second matters more, because the law asks you to give the information at the point of collection, and the form is that point.
Ask only for what you use. Fellside, a demo we built for a roofer in Kendal, asks for a name, a phone number and a postcode, and makes email and photos optional. Every field you do not collect is a line you do not have to explain or protect.
A privacy policy copied from another site is usually wrong about yours. It names systems you do not use, purposes you do not have and retention periods you do not keep. A notice that is inaccurate fails the one thing it exists to do, which is tell people the truth about their data.
The ICO data protection fee
This is separate from the notice, and it catches people out. The data protection fee is an annual payment to the ICO that most organisations using personal information must make, sole traders included. In October 2026 the tiers are:
- Tier 1, £52 a year, for turnover up to £632,000 or no more than 10 staff.
- Tier 2, £78 a year, for turnover up to £36 million or no more than 250 staff.
- Tier 3, £3,763, for everyone larger.
Paying by direct debit takes £5 off. Some businesses are exempt: if the only things you use personal information for are staff administration, advertising and marketing your own business, and keeping accounts and records, the regulations do not require a fee. The ICO’s small business guidance says that using CCTV to protect business premises will usually mean paying it. The ICO’s self-assessment takes about ten minutes and gives a definite answer, and if you owe the fee and do not pay, the fixed penalty for a tier 1 business is £400.
One caveat, plainly: this is how the rules read, not legal advice. If you handle health information, children’s data or anything else sensitive, take proper advice.
If you want someone to check what your website actually collects, and whether the notice matches it, the free review covers that along with everything else.
Related: do you need a cookie banner? for the other half of a site’s privacy, and website not getting enquiries? for keeping the form short and working.
