Privacy Policy for Small Business: A Simple Template Guide

If your website collects personal data - even just an email address from a contact form - you are legally required to have a privacy policy under UK GDPR (the UK's data protection law, which came into force after Brexit). For most small businesses, this is not a complex document. But a copied template that does not reflect what your business actually does with personal data is not compliant - and a non-compliant privacy policy can result in ICO enforcement action.

This guide explains what a UK privacy policy must include, where it must appear on your website, and how to use a template safely - without needing a solicitor for most straightforward cases.

What a Privacy Policy Is and Why Your Website Needs One

A privacy policy (also called a privacy notice) is a document that tells people how you collect, use, store, and share their personal data. Under UK GDPR, individuals have a right to know what happens to their data - and you have a legal obligation to tell them.

Personal data means any information that can identify a living person - names, email addresses, IP addresses, phone numbers, and purchase history all count. If your website has a contact form, a newsletter sign-up, an e-commerce checkout, or even just standard analytics tracking, you are collecting personal data and a privacy policy is not optional.

The ICO (Information Commissioner's Office) is the UK's data protection regulator. It publishes clear guidance for small businesses and provides free resources to help you comply. The bar for a small business with simple data practices is genuinely achievable without specialist legal help.

What UK GDPR Requires Your Privacy Policy to Cover

UK GDPR Articles 13 and 14 set out the specific information a privacy notice must contain. Article 13 applies when you collect data directly from individuals (a contact form, a sign-up page). Article 14 applies when you obtain data from a third party or another source.

For most small business websites, Article 13 is the relevant one. The law requires you to provide this information at the point of data collection - meaning your privacy policy must be accessible before or at the moment someone submits their data, not buried in a footer link they can only find after the fact.

The Eight Sections Every UK Small Business Privacy Policy Must Include

The sections below reflect the disclosure requirements under UK GDPR. A compliant privacy policy for a UK business website needs to address these areas. Skipping any one of them potentially leaves you exposed:

1. Who you are - Your full business name, trading name, registered address, and contact details. If you have a Data Protection Officer (DPO), include their contact details too - though most small businesses are not required to appoint one.

2. What data you collect - List every category of personal data your website collects: names, email addresses, IP addresses, payment information, purchase history. Be specific. Vague language like "certain information" is not sufficient.

3. Why you collect it and the legal basis - UK GDPR requires you to have a lawful basis for processing. The most common ones for small businesses are: consent (the person opted in), contract (you need the data to fulfil an order), and legitimate interests (you have a genuine business reason that does not override the individual's rights).

4. Who you share data with - Name any third parties that receive or process the data: payment processors, email platforms, analytics tools, delivery companies. Include the country where data is stored if it is outside the UK.

5. How long you keep data - You cannot keep personal data indefinitely. State your retention periods for each data type, or explain the criteria you use to decide how long to keep it.

6. Individual rights - Under UK GDPR, individuals have the right to access, correct, delete, restrict processing of, and object to the use of their data. Your policy must explain these rights and tell people how to exercise them.

7. How to make a complaint - You must direct individuals to the ICO if they believe their data has been mishandled. Include the ICO's website address (ico.org.uk) and confirm they can lodge a complaint there.

8. How you keep data secure - You do not need to publish technical security specifications, but you must confirm that appropriate technical and organisational measures are in place to protect personal data.

Where to Display Your Privacy Policy: Website Placement Requirements

UK GDPR requires that your privacy notice is provided to individuals at the time their data is collected - or before. That means placement on your website is not just a usability decision, it is a legal one.

There are three placements your website should have as a minimum:

• Footer link on every page - A clearly labelled link titled "Privacy Policy" (not "Legal" or "Terms") in your site footer ensures it is discoverable from anywhere on the site.

• At the point of data collection - Every form that collects personal data - contact forms, sign-up forms, checkout pages - should include a reference to your privacy policy alongside the submit button. A short line such as 'By submitting this form, your information will be processed in accordance with our Privacy Policy [link]' informs users how their data will be used*.

• Cookie consent banner - If you use cookies that require consent (analytics or marketing cookies), your consent banner should link directly to your privacy policy and your cookie policy.

The policy must be easy to read and written in plain language - this is an explicit requirement under UK GDPR, not just good practice. Legal jargon and dense paragraphs fail the test.

* Note: If consent is your lawful basis for processing, you will also need a separate, specific opt-in - simply submitting a form does not by itself constitute valid UK GDPR consent.

Using a Template: What to Check Before You Publish It

For most small businesses with straightforward data practices, a well-reviewed template is entirely appropriate. The ICO itself provides a privacy notice generator at ico.org.uk to help small businesses generate a compliant baseline. The risk with templates is not that they are inadequate - it is that founders publish them without checking whether they accurately describe what the business actually does.

Before publishing any template, work through this checklist.

Template review checklist - before you publish

• Your business name, trading name, and contact details are accurate and complete.

• Every category of personal data the template mentions is data your business actually collects - remove anything that does not apply.

• Every purpose listed is a purpose you genuinely use the data for - do not keep purposes that do not match your actual practices.

• Every third party listed actually processes data for your business - and any processor not listed has been added.

• Your lawful basis for each processing activity is correctly identified - do not default to "consent" if you are processing under contract or legitimate interests.

• Retention periods are specified and realistic for your business.

• The ICO complaint link (ico.org.uk) is included and accurate.

• If data is stored outside the UK, the relevant transfer safeguards are described.

Cookie Policies: Do You Need a Separate Cookie Policy or Can You Combine It?

A cookie policy and a privacy policy are not the same document - they serve different legal purposes. Conflating them is a common mistake that can leave both incomplete.

Your privacy policy covers how you handle personal data broadly - what you collect, why, how long you keep it, and individuals' rights. Your cookie policy covers the specific cookies your website uses - what each one does, whether it is strictly necessary or optional, and how users can manage or reject it. Cookie use is governed by PECR (the Privacy and Electronic Communications Regulations), which sits alongside UK GDPR. PECR was significantly amended by the Data (Use and Access) Act 2025, with key changes - including new cookie consent exceptions and substantially higher fines (up to £17.5 million or 4% of global turnover) - in force from 5 February 2026.

In practice, small businesses often include a cookies section within their privacy policy rather than creating a separate page - and this is acceptable, as long as both sets of content are genuinely covered. If your site uses a significant number of cookies across multiple categories (analytics, advertising, functionality), a dedicated cookie policy page is cleaner and easier to maintain.

How Often to Review and Update Your Privacy Policy

A privacy policy is not a one-time document. It needs to reflect what your business actually does with personal data - and as your business changes, so should your policy.

The most common triggers that require a policy update:

• You add a new third-party tool that processes personal data (a new CRM, email platform, or analytics tool).

• You start collecting a new category of personal data - for example, launching a new form or expanding your product range.

• You change what you use existing data for - for instance, starting a newsletter when you previously only processed data for order fulfilment.

• You begin storing or transferring data outside the UK for the first time.

• UK data protection law has undergone significant changes under the Data (Use and Access) Act 2025, with key provisions already in force from 5 February 2026 and further changes due by June 2026. The ICO is actively updating its guidance - check ico.org.uk for the current publication schedule.

A sensible baseline for most growing businesses is a review every 12 months, even if nothing obvious has changed. Add it to your calendar as an annual compliance task. When you do update the policy, add a "last updated" date at the top of the document - this signals to users and to the ICO that your policy is actively maintained.

Cut Through the Noise - Get the BGE Newsletter