Does my website need a privacy policy? UK GDPR for a small business, in plain English

UK GDPR says that when you collect personal data you must tell the person, at that moment, who you are, what you will do with it, why you are allowed to, how long you will keep it, who you share it with, and what their rights are. A privacy policy (the law calls it a privacy notice) is the document that does the telling. It is not optional and it is not a formality: the Information Commissioner's Office can fine for not having one, and customers' procurement teams will look for it before they look at anything else.

• Who you are: the legal entity, its address and a contact for data questions. A data protection officer is only required for some organisations, but a named contact always helps.
• What data you collect: name and email from a form, account details, payment data (usually held by your payment provider, say so), usage data from analytics, cookies.
• Why, and your lawful basis for each purpose: performing a contract (delivering what they bought), legitimate interests (running and securing the site, some marketing to business contacts), consent (newsletters to individuals, non-essential cookies), legal obligation (keeping accounting records).
• Who you share it with: hosting, email, payment, analytics and support providers by category, and any transfers outside the UK with the safeguard used.
• How long you keep it: by category, in plain terms. "As long as necessary" is not an answer the ICO accepts.
• Their rights: access, correction, erasure, restriction, portability, objection, withdrawing consent, and the right to complain to the ICO.

Write it for a reader, not a regulator. The ICO's guidance favours short, layered notices over ten pages of defined terms. A privacy and cookie policy template with the structure above takes an hour to adapt.

The cookie rules are in the Privacy and Electronic Communications Regulations (PECR), not UK GDPR. The test is simple: cookies that are strictly necessary for the service the visitor asked for (keeping them logged in, remembering a basket) need no consent; everything else (analytics that identifies users, advertising, embedded video players) needs consent before the cookie is set. A banner that sets cookies first and asks afterwards does not comply, and "by continuing to browse you accept" has not been good enough for years.

The least painful route for a small site is to avoid consent cookies altogether: cookieless analytics, no third-party embeds on key pages, and a cookie section in the privacy policy that says so. That is what this site does.

Most organisations that process personal data must register with the ICO and pay an annual data protection fee, tiered by size and turnover. The exemptions are narrow and mostly for organisations that only process data for staff administration, accounts or marketing their own business without electronic means, so assume you have to pay unless you have checked. Not paying attracts a fixed penalty and shows up in due diligence.

You have staff. Employees and contractors are data subjects too, and the website notice does not cover payroll, monitoring or references. Give them a staff privacy notice when they start.

Business customers put personal data into your product. You are then a processor for them, and UK GDPR Article 28 requires a written contract: a data processing agreement. Customers will ask for it; it is far better to have yours than to sign theirs.

You do something with higher risk. Profiling, large-scale monitoring, children's data, AI that makes decisions about people. These need a data protection impact assessment before you start, and the ICO can ask to see it. A DPIA and AI impact assessment form is the structured way to do one.

Something goes wrong. A personal data breach that risks people's rights must be reported to the ICO within 72 hours of you becoming aware of it. You will not meet that deadline without a written retention and breach response policy that says who does what.

A privacy and cookie policy on the site, the ICO fee paid, a cookie approach that does not need a banner, and a DPA ready for business customers. All of those documents are in the SaaS launch pack, or individually from £9. If you process health, financial or children's data, or operate in a regulated sector, this article is the starting point and not the end: take advice.