Website tips
Privacy Policy and Cookies for UK Small Business Websites
Key takeaways
- You need a privacy policy: Explain what data you collect through forms, analytics, and cookies.
- Cookie banner if you track: Analytics and marketing tags usually need consent before they fire in the UK and EU.
- Contact forms collect personal data: Say who processes it, why, and how long you keep it.
- Get legal review when risk rises: E-commerce, health data, or large mailing lists need proper advice.
If your website has a contact form, analytics, or a newsletter signup, you handle personal data. UK GDPR and PECR set expectations for transparency and cookie consent. This article is a practical checklist, not legal advice. See a solicitor when your risk is higher.
Most local brochure sites need a clear privacy page, sensible cookie controls, and honest form wording. That is achievable without a law library.
Privacy policy page
- Who you are and how to contact you about data.
- What you collect: form fields, phone logs, analytics cookies.
- Why you collect it: respond to enquiries, improve the site, marketing if applicable.
- How long you keep data and who you share it with: hosting provider, email tool, etc.
- Rights to access, correct, or delete data and how to exercise them.
Use plain English. Link the policy from the footer and near forms.
Cookie banner and consent
If you use Google Analytics, Meta Pixel, or similar non-essential cookies, you typically need consent before they run for UK and EU visitors. A banner should offer accept and reject equally, not a dark pattern that hides decline. Keep a record of consent if your tool supports it.
Analytics and forms
- Load analytics only after consent if required by your setup.
- Do not add form submissions to mailing lists without explicit opt-in.
- Use HTTPS on every page. Standard on good hosts.
- Limit form fields to what you actually need.
When to get proper legal review
Online sales, payment cards, sensitive sectors, employment screening, or large-scale email marketing increase risk. A solicitor can tailor documents to your processing activities. For a simple local site, a reputable policy generator plus common sense is a starting point, not the finish line for high-risk processing.
Launching a compliant local site? Get in touch about Starter packages with privacy pages included, or see Starter vs custom for package fit.