Every UK website that collects personal data — including email addresses, contact form submissions, or analytics cookies — must have a compliant Privacy Policy. Most don't. The ICO can fine businesses up to £17.5 million or 4% of global turnover.
If your website has any of the following, the answer is yes: a contact form, an email newsletter signup, a cookie banner, Google Analytics, a login or account system, an e-commerce checkout, or a live chat widget.
Personal data includes names, email addresses, phone numbers, IP addresses, and any information that can identify a living individual — directly or indirectly.
Under UK GDPR (the UK’s retained version of the EU GDPR, read with the Data Protection Act 2018 and amended by the Data (Use and Access) Act 2025), you must tell users:
| Lawful Basis | When it applies |
|---|---|
| Consent | You have a clear, specific opt-in. Must be freely given, informed, and withdrawable. |
| Contract | Processing is necessary to fulfil a contract with the individual. |
| Legal obligation | You must process the data to comply with a legal requirement. |
| Vital interests | Necessary to protect someone's life — rare. |
| Public task | Public authorities carrying out official functions. |
| Legitimate interests | Your business interest outweighs the individual's privacy rights. Requires a balancing test. |
Cookies are governed by the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. Non-essential cookies — advertising, social media and most tracking — require consent before they are set.
Analytics exemption (from 5 February 2026): The Data (Use and Access) Act 2025 allows first-party cookies used only to collect statistical information to improve your website or service to be set without consent, provided users are given clear information and a simple way to opt out. Analytics tools that share data with third parties for their own purposes, or that are used for advertising, still need consent. The Act also raised PECR fines to UK GDPR levels (up to £17.5 million or 4% of global turnover).
A cookie banner that pre-ticks consent boxes or buries the reject option is not compliant. The ICO has issued enforcement notices against major websites for exactly this.
Common mistake: Having a cookie banner that says "By continuing to use this site you agree to our use of cookies" is not valid consent under PECR. Consent must be a clear affirmative action taken before non-essential cookies are set.
From 19 June 2026, controllers must have their own process for handling data protection complaints. You must acknowledge a complaint within 30 days, take appropriate steps to respond without undue delay, and tell the complainant the outcome. Individuals will normally be expected to complain to you before going to the ICO.
Most organisations that process personal data must register with the ICO and pay an annual fee — £52 for micro organisations, £78 for small and medium organisations, £3,763 for large. Failing to pay the fee can lead to a monetary penalty from the ICO.
Check whether you need to register at ico.org.uk/registration. The exemptions are narrow — most businesses with a website will need to register.
UK GDPR-compliant Privacy Policy for UK websites and businesses (a matching Cookie Policy is also available). Updated for UK GDPR 2026. Word and PDF. Instant download.
Get the Privacy Policy — £12.99 →