UK GDPR for Small Business 2026

Does My Business Need a Privacy Policy?

Yes — if your business collects any personal data from individuals, including customers, website visitors, or employees, UK GDPR requires you to publish a privacy policy explaining what you collect and how you use it. This applies to sole traders, partnerships, and limited companies of any size.

The Six UK GDPR Principles

Every business that processes personal data must comply with six principles. Personal data must be:

• Lawfully, fairly, and transparently processed — you need a lawful basis and must tell people what you are doing with their data
• Collected for specified, explicit, and legitimate purposes — you cannot use data for purposes beyond what you originally stated
• Adequate, relevant, and limited — only collect what you actually need
• Accurate and kept up to date — take reasonable steps to correct or erase inaccurate data
• Kept only as long as necessary — define and stick to retention periods
• Processed securely — technical and organisational measures must be in place

What Your Privacy Policy Must Include

A UK GDPR-compliant privacy policy must clearly explain:

• Who you are and your contact details (and your Data Protection Officer, if applicable)
• What personal data you collect
• Why you collect it and your lawful basis (consent, legitimate interests, contract, legal obligation)
• Who you share it with and why
• How long you keep it
• Individual rights: access, rectification, erasure, restriction, portability, objection
• How to make a complaint to the ICO

Cookie Policy — PECR

If your website uses cookies (including analytics cookies like Google Analytics), you must also comply with the Privacy and Electronic Communications Regulations (PECR). This means:

• Obtaining consent before setting non-essential cookies
• Providing clear information about the cookies used
• Giving users a genuine choice to accept or reject non-essential cookies
• Having a separate cookie policy (or section within your privacy policy)

Data Processing Agreements

If you share personal data with any third-party service that processes it on your behalf — a payroll provider, email marketing platform (Mailchimp, Kit), cloud storage (Google Drive, Dropbox), or CRM system — you must have a Data Processing Agreement (DPA) in place under UK GDPR Article 28.

Subject Access Requests

Individuals have the right to request a copy of all personal data you hold about them — a Subject Access Request (SAR). You must respond within one month and provide the information free of charge in most cases. An extension of two further months is allowed for complex or numerous requests, but you must inform the individual within the first month.

Do I Need to Register with the ICO?

Most businesses that process personal data must pay the ICO's annual data protection fee: £40 for most sole traders and micro-organisations, £60 for small and medium businesses, £2,900 for large organisations. Check the ICO's self-assessment tool at ico.org.uk to confirm whether you need to register.