In this guide
Short answer: if your UK website collects any personal information, through a contact form, a newsletter sign-up, analytics or marketing tools, you should have a clear privacy notice. If it uses cookies that are not strictly necessary, you usually need to get consent before they are set. This is general information, not legal advice, so check the Information Commissioner’s Office (ICO) guidance for your situation.
Many small business owners assume privacy rules are for large companies. They are not. If you collect a name and email address through a form, you are handling personal data, and UK law expects you to be open about what you do with it.
The rules in plain English
Three pieces of law matter most:
- UK GDPR and the Data Protection Act 2018 set the rules for how personal data is collected, used and kept.
- The Privacy and Electronic Communications Regulations (PECR) cover cookies and similar technologies, and electronic marketing.
- The ICO is the regulator, and publishes practical guidance for small organisations.
What a privacy notice should say
| Topic | What to explain |
|---|---|
| Who you are | Your business name and contact details |
| What you collect | For example name, email, phone, enquiry details |
| Why you use it | To reply to enquiries, provide a quote, send invoices |
| Legal basis | For example consent, contract or legitimate interests |
| Who you share it with | Hosting, email and accounting providers |
| How long you keep it | A clear retention period |
| People’s rights | Access, correction, deletion and how to complain to the ICO |
Cookies: what needs consent?
Cookies and similar technologies that are strictly necessary to provide the service a visitor asked for, such as remembering items in a basket, do not need consent. Others, such as marketing and many analytics tools, generally do under current guidance. The rules in this area are being updated, so check the ICO’s latest position rather than relying on old advice.
What a good cookie banner does
- Explains clearly which cookies are used, and why.
- Gives equal weight to accepting and rejecting, with no pre-ticked boxes.
- Does not load non-essential scripts until the visitor agrees.
- Lets people change their mind later.
Contact forms and enquiries
- Put a short notice near the form saying how you will use the details.
- Only ask for what you need.
- Store enquiries securely, and delete them when you no longer need them.
- Use spam protection that does not track visitors unnecessarily.
Do not forget the ICO fee
Many organisations that handle personal data must pay a small data protection fee to the ICO, unless they are exempt. The ICO has a short online check that tells you whether it applies to you.
A practical checklist
- List what personal data your website collects, including forms, analytics and any embedded tools.
- Write a privacy notice that matches what you actually do.
- Add a cookie banner only if you use non-essential cookies, and set it up properly.
- Link the notice from every form and the footer.
- Review it whenever you add a new tool or plugin.
Where this fits with the rest of your online setup
Compliance is one part of a professional online presence. The others are a good domain, covered in .co.uk versus .com, and properly authenticated email, covered in why business emails go to spam and business email versus Gmail.
HomeIT Services builds fast, secure websites for small businesses across Essex, with clear contact forms and sensible privacy settings from the start. See domains, websites and email setup, or contact us from Chelmsford, Brentwood or nearby.
Frequently asked questions
If your website collects personal information, for example through a contact form, newsletter sign-up or analytics, you need to tell people how you use it, usually in a privacy notice.
If your site uses cookies that are not strictly necessary, such as marketing or many analytics cookies, UK rules generally require consent first. The rules are being updated, so check the ICO’s current guidance.
No. Consent has to be a clear, positive choice. Pre-ticked boxes and silence do not count, and refusing should be as easy as accepting.
Yes, a short privacy notice near the form that explains what you do with the details, plus sensible handling and deletion.
No. This is general information. For your own situation, check the ICO guidance or take professional advice.
Rather have it done properly?
Get a clear, fixed quote from a local engineer before any work starts.