Many small business owners assume privacy rules are only for big companies. In fact, a simple contact form can mean you are collecting personal data, and the rules apply to you too.

When you need a privacy policy

You are likely to need one if your website or business does any of the following:

• Uses a contact or enquiry form
• Takes bookings or payments
• Collects email addresses for a mailing list
• Uses analytics or advertising tools
• Embeds third-party content such as maps or videos

What a privacy policy usually covers

1. Who you are and how to contact you
2. What personal information you collect
3. Why you collect it and your lawful basis for using it
4. Who you share it with, such as hosting or email providers
5. How long you keep it
6. Visitors’ rights, such as access and deletion
7. How to complain, including to the ICO

Cookie notices

Cookies are small files stored on a visitor’s device. In the UK, rules generally require you to tell people about non-essential cookies, such as some analytics and advertising ones, and to get their consent before using them. Strictly necessary cookies, such as those that keep a shopping basket working, are treated differently.

A common approach is a cookie banner that lets visitors accept or reject non-essential cookies, with a short cookie policy explaining what each one does.

Practical steps for a small business

1. List what you collect. Forms, bookings, newsletters, analytics and ads.
2. List the tools you use, and check what data each collects.
3. Write or generate a policy that accurately describes your real practices, and have it checked if you can.
4. Add a cookie banner if you use non-essential cookies.
5. Link to the policy from your footer and near any form.
6. Review it whenever you add a tool or change how you collect data.

Privacy pages sit alongside the others in the pages a small business website needs.

Frequently asked questions