Website Privacy Policy UK: What It Must Include
What a UK website privacy policy must include under Article 13 UK GDPR, the new right to complain to you, and how to keep it accurate.
A UK website privacy policy must tell visitors who you are, what personal data you collect, why, on what lawful basis, who you share it with, how long you keep it and what rights they have, including the right to complain. Those items come from Article 13 of the UK GDPR, which applies whenever you collect personal data directly from people, such as through a contact form, a checkout or a newsletter sign-up. The notice must be accurate for your site, written in plain language and easy to find.
Key takeaways
- Article 13 of the UK GDPR lists what you must tell people when you collect their data: identity, purposes, lawful basis, recipients, transfers, retention, rights and complaints.
- The current text includes a right to complain to you, the controller, inserted with effect from 19 June 2026, alongside the right to complain to the regulator.
- Article 12 requires the information to be concise, transparent, intelligible, easily accessible and in clear and plain language.
- Build the notice from an audit of your actual forms, tools and suppliers, not from a template.
- Review it whenever you add a form, plugin, tracking tool or supplier that handles personal data.
Privacy policy or privacy notice: what is the difference?
In everyday use, they mean the same thing: the page on your website that explains how you handle personal data. Many advisers prefer "privacy notice", because the page is a notice to the public rather than an internal policy. Your website footer can call it either. What matters is what it says.
Behind the public notice, many businesses also keep internal documents: a record of what data they hold, retention rules and procedures for handling requests. Those are separate. This post is about the public notice on your website.
What UK GDPR requires your privacy notice to include
Article 13 of the UK GDPR sets out the information you must give when you collect personal data from the person it relates to. Here it is, translated into the sections a small business website usually needs.
| Article 13 item | What to write on your site |
|---|---|
| Identity and contact details of the controller | Your legal business name, registered address and an email or contact route for privacy questions |
| Data protection officer, where applicable | Their contact details, if you have one |
| Purposes and lawful basis | Each reason you use data (answering enquiries, fulfilling orders, sending newsletters) and the lawful basis for each |
| Legitimate interests, where relied on | What those interests are, in plain words |
| Recipients | Who you share data with, by name or category: hosting, email, payment, CRM, couriers, accountants |
| International transfers | Whether data goes outside the UK and the safeguards you rely on |
| Retention | How long you keep each kind of data, or the criteria you use to decide |
| Rights | Access, rectification, erasure, restriction, objection and data portability |
| Withdrawing consent | Where you rely on consent, that it can be withdrawn at any time, and how |
| Complaints | How to complain to you, and the right to complain to the UK regulator |
| Statutory or contractual requirement | Whether people have to give the data, and what happens if they do not |
| Automated decision-making | Whether you use it, including profiling, the safeguards that apply, and meaningful information about the logic and its consequences |
Most small business websites will not have a data protection officer, international transfers that need special safeguards or automated decision-making. Even so, say plainly where something does not apply rather than leaving it out and making readers guess.
What changed recently: complaints to you first
The UK GDPR text has been amended by recent legislation, and the version on legislation.gov.uk now shows two complaint rights in Article 13. One is a right to make a complaint to the controller under section 164A of the Data Protection Act 2018, shown as inserted with effect from 19 June 2026. The other is the right to lodge a complaint with the regulator under section 165 of the same Act.
In practice, that means your privacy notice should explain how someone can complain to your business directly, as well as mentioning the right to complain to the regulator. Give a clear route, such as an email address or a form, and make sure someone in the business owns the inbox. If your notice was written before mid-2026, check it against the current text.
Because the law in this area has been changing, check the current wording of the legislation and the regulator's guidance when you update your notice, rather than relying on an older template.
Write it so people can understand it
Article 12 says the information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, with particular care for anything aimed at children. That rules out pages of legal boilerplate that nobody reads.
- Use headings that match questions. "What we collect", "Why we use it", "Who we share it with", "How long we keep it", "Your rights".
- Be specific. "We use your email address to reply to your enquiry" is better than "we may process personal data for business purposes".
- Use layers if it is long. A short summary at the top, with detail below or on linked sections.
- Link it everywhere it matters. In the footer of every page, and next to every form that collects personal data.
- Date it. A "last updated" date shows the notice is maintained.
Good placement is part of good design. Our guide to contact page design shows where a short privacy line and a link sit naturally next to a form, and our about us page guide covers presenting your business details clearly, which helps with the identity section of the notice.
Audit your website before you write a word
The most common problem with small business privacy notices is not missing sections. It is that the notice describes a different website: one copied from a template or written years ago, before the booking plugin, the live chat and the new CRM. Start with an audit.
- List every form. Contact, quote, booking, checkout, account registration, newsletter, job applications.
- List every tool that touches personal data. Hosting, email marketing, CRM, payment gateway, live chat, analytics, booking system, reviews widget.
- For each, note what data, why and the lawful basis. For example: quote form, name, email, phone and project details, to reply and prepare a quote.
- Note where the data goes. Which supplier stores it, and in which country.
- Decide retention. How long you keep enquiries that did not become customers, customer records, order data and newsletter subscribers.
- Write the notice from the list. Each section of the notice should trace back to a line in your audit.
Keep the audit. It is the document you will update every time the site changes.
Cookies and tracking: a separate notice
Cookies and similar technologies have their own rules. Regulation 6 of the Privacy and Electronic Communications Regulations, substituted from 5 February 2026, sets a general prohibition on storing or accessing information on a user's device, subject to exceptions listed in a separate schedule. Most sites deal with this in their own cookie notice and banner. Your privacy notice should still mention analytics or marketing tools that collect personal data, and link to the cookie notice.
Keep it accurate as the site changes
A privacy notice is not a launch-day task you can forget. Make reviewing it part of your change process.
- Adding a new form, plugin or integration? Check whether it collects personal data and update the notice.
- Adding a new form or tool during routine website maintenance? Treat the privacy notice as part of the same job.
- Changing email, CRM or hosting provider? Update the recipients and any transfer details.
- Starting a newsletter or remarketing? Update purposes, lawful basis and consent wording.
- Once a year, compare the notice with the live site and your supplier list, line by line.
When we build or rebuild a site under our website design service, we list the forms and third-party tools so you have the inputs for your notice. The wording and the legal decisions remain yours, and for anything complex, take advice from a data protection specialist.
Frequently asked questions
Do I need a privacy policy if my website only has a contact form?
Yes. A contact form collects personal data, at least a name and an email address, directly from the person, so Article 13 of the UK GDPR applies. Your notice can be short, but it still needs to say who you are, why you collect the data, the lawful basis, who you share it with, how long you keep it, and what rights people have.
Can I use a free privacy policy template?
A template can help with structure and headings, but it cannot know your forms, tools, suppliers or retention periods. A notice that describes processing you do not do, or misses processing you do, is not accurate. Use a template as a checklist at most, and write the content from an audit of your own website.
Where should the privacy policy link go on my website?
Put a link in the footer so it is on every page, and add a short line with a link next to every form that collects personal data, before the submit button. People should be able to read it before they hand over their details, not only after. Make sure the link works on mobile too.
How often should I update my privacy notice?
Whenever something changes: a new form, plugin, supplier, marketing activity or retention rule. Also review it at least once a year against the live site, and whenever the law changes. Show a "last updated" date so you and your visitors can see when it was last checked.
Does my privacy notice need to say how to complain?
Yes. The current UK GDPR text lists both a right to complain to the controller and the right to complain to the regulator. Give people a clear route to complain to your business, such as a dedicated email address, and explain that they can also complain to the regulator.
Get your privacy notice right on the next update
Run the six-step audit above this week and compare it with your current notice. If the website has changed and the notice has not, you have your update list. If you are planning a new site or a rebuild, start a project or contact us, and we will build the forms and tools with the notice in mind.
