If your business collects any personal data — from customers, website visitors, or employees — UK GDPR applies to you. This guide covers what you must have in place.
Yes — if your business collects any personal data from individuals, including customers, website visitors, or employees, UK GDPR requires you to publish a privacy policy explaining what you collect and how you use it. This applies to sole traders, partnerships, and limited companies of any size.
Every business that processes personal data must comply with six principles. Personal data must be:
A UK GDPR-compliant privacy policy must clearly explain:
If your website uses cookies (including analytics cookies like Google Analytics), you must also comply with the Privacy and Electronic Communications Regulations (PECR). This means:
Analytics exemption: From 5 February 2026, the Data (Use and Access) Act 2025 allows cookies used only to collect statistical information to improve your own website or service to be set without consent, as long as you give users clear information and a simple way to opt out. Analytics tools that share data with third parties for their own purposes still need consent. PECR fines now match UK GDPR levels (up to £17.5 million or 4% of global turnover).
Controllers must now run their own data protection complaints process: acknowledge complaints within 30 days, respond without undue delay and tell the complainant the outcome. Individuals will normally complain to you before going to the ICO.
If you share personal data with any third-party service that processes it on your behalf — a payroll provider, email marketing platform (Mailchimp, Kit), cloud storage (Google Drive, Dropbox), or CRM system — you must have a Data Processing Agreement (DPA) in place under UK GDPR Article 28.
Individuals have the right to request a copy of all personal data you hold about them — a Subject Access Request (SAR). You must respond within one month and provide the information free of charge in most cases. An extension of two further months is allowed for complex or numerous requests, but you must inform the individual within the first month.
Most businesses that process personal data must pay the ICO's annual data protection fee: £52 for most sole traders and micro-organisations, £78 for small and medium businesses, £3,763 for large organisations. Check the ICO's self-assessment tool at ico.org.uk to confirm whether you need to register.
Yes. If your business collects any personal data — including names, email addresses, or website cookies — you must have a privacy policy under UK GDPR. This applies regardless of business size.
UK GDPR is the UK version of the EU General Data Protection Regulation, retained in UK law after Brexit. It is enforced by the Information Commissioner’s Office (ICO). The principles are almost identical to EU GDPR.
Most organisations that process personal data must pay the ICO’s annual data protection fee — £52, £78 or £3,763 depending on size and turnover. Some organisations are exempt; use the ICO’s self-assessment tool to check.
A DPA is a contract required under UK GDPR Article 28 when you share personal data with a third-party processor such as a payroll provider, email marketing platform, or cloud service. It sets out each party’s obligations for protecting the data.