Do I need a privacy policy for my business?

The UK GDPR and the Data Protection Act 2018 apply to any business that handles personal data: names, email addresses, phone numbers, delivery addresses, online identifiers and staff records. Articles 13 and 14 of the UK GDPR give people the right to be told how their data is used:

• data you collect from the person: tell them at the time you collect it
• data you get from elsewhere, such as a referral: tell them within a reasonable period and no later than one month, or sooner if you contact them or share the data first

The law doesn't require the words "privacy policy". But a privacy notice on your website, linked wherever you collect data, is the usual way to comply. It must be concise, clear, in plain language and easy to find. The rules apply across the UK.

Your privacy notice should cover:

• your business name and contact details, and your data protection officer if you have one
• what personal data you collect and, if it doesn't come from the person, where it comes from
• why you use it and the lawful basis for each purpose, such as contract, consent or legitimate interests (and what those interests are)
• who you share it with, such as payment providers, couriers, IT and email platforms
• whether it goes outside the UK, and how it's protected
• how long you keep it
• people's rights, including access, correction, erasure and objection, and their right to withdraw consent
• whether they have to provide the data, and any automated decision-making
• how to complain to you, and their right to complain to the regulator

A copied template rarely fits. The notice must describe what your business actually does with data.

Since 19 June 2026, you must make it easy for people to complain to you about how you use their personal data, for example with a complaint form that can be completed electronically. You must acknowledge a complaint within 30 days, respond without undue delay and tell the person the outcome (section 164A of the Data Protection Act 2018). Your privacy notice is a sensible place to explain how to complain.

On 30 September 2026, the Information Commission took over from the Information Commissioner's Office (ICO) as the UK's data protection regulator. Its role and powers are unchanged.

Regulation 6 of PECR (the Privacy and Electronic Communications Regulations 2003) covers cookies and similar tracking technologies. For most non-essential cookies, such as advertising and cross-site tracking, you must give clear and comprehensive information and get consent before setting them. Pre-ticked boxes and "by using this site you agree" banners don't count as consent.

Consent isn't needed for cookies that are strictly necessary for a service the user asked for, such as a shopping basket or security. Since 5 February 2026, changes made by the Data (Use and Access) Act 2025 also allow, without consent:

• cookies used only to collect statistics to improve your own website or service, as long as the data is only shared with someone helping you make those improvements
• cookies used only to adapt how your website looks or works to the user's preferences

For both, you must explain them clearly and give a simple, free way to object.

Most businesses that process personal data must pay an annual fee to the regulator under the Data Protection (Charges and Information) Regulations 2018, made under section 137 of the Data Protection Act 2018. The current fees are:

• Tier 1 (turnover up to £632,000 or no more than 10 staff): £52
• Tier 2 (turnover up to £36 million or no more than 250 staff): £78
• Tier 3 (everyone else): £3,763

There's a £5 discount for paying by direct debit. You may be exempt if you only use personal data for staff administration, advertising your own business, or keeping accounts and records. The ICO's online self-assessment will tell you. Not paying when you should can lead to a fixed penalty, currently £400 to £4,000 depending on your tier.