UK GDPR & Privacy Policy Guide 2026 — What Your Website Must Include

Does your website collect personal data?

If your website has any of the following, the answer is yes: a contact form, an email newsletter signup, a cookie banner, Google Analytics, a login or account system, an e-commerce checkout, or a live chat widget.

Personal data includes names, email addresses, phone numbers, IP addresses, and any information that can identify a living individual — directly or indirectly.

What UK GDPR requires

Under UK GDPR (which diverged from EU GDPR after Brexit and is now governed by the UK Data Protection Act 2018), you must tell users:

Who you are and how to contact you (and your Data Protection Officer if you have one)
What personal data you collect and why
The legal basis for processing that data
How long you retain the data
Whether you share data with third parties and who they are
Whether data is transferred outside the UK
Their rights — access, rectification, erasure, portability, objection
How to complain to the ICO
Whether you use automated decision-making or profiling

The six lawful bases for processing

Lawful Basis	When it applies
Consent	You have a clear, specific opt-in. Must be freely given, informed, and withdrawable.
Contract	Processing is necessary to fulfil a contract with the individual.
Legal obligation	You must process the data to comply with a legal requirement.
Vital interests	Necessary to protect someone's life — rare.
Public task	Public authorities carrying out official functions.
Legitimate interests	Your business interest outweighs the individual's privacy rights. Requires a balancing test.

Cookies — the separate regime

Cookies are governed by the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. Non-essential cookies — analytics, advertising, social media — require explicit consent before they are set.

A cookie banner that pre-ticks consent boxes or buries the reject option is not compliant. The ICO has issued enforcement notices against major websites for exactly this.

Common mistake: Having a cookie banner that says "By continuing to use this site you agree to our use of cookies" is not valid consent under PECR. Consent must be a clear affirmative action taken before non-essential cookies are set.

ICO registration

Most organisations that process personal data must register with the ICO and pay an annual fee — £40 for small organisations, £60 for medium, £2,900 for large. Failure to register is a criminal offence.

Check whether you need to register at ico.org.uk/registration. The exemptions are narrow — most businesses with a website will need to register.

What the ICO can do

Issue enforcement notices requiring you to change how you process data
Fine organisations up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious breaches
Issue reprimands (public warnings that appear on the ICO website)
Prosecute for criminal offences including failing to register and unlawful data sales

UK GDPR Privacy Policy & Cookie Policy

Two-document pack — UK GDPR-compliant Privacy Policy and Cookie Policy for UK websites and businesses. Updated for UK GDPR 2026. Word and PDF. Instant download.

Get the Privacy & Cookie Policy Pack →