- Any site that collects personal data from people in the UK or EU needs privacy information that meets GDPR.
- A contact form, analytics, a newsletter sign-up or a chat widget all count as collecting personal data.
- Say what you collect, why, your legal basis, who you share it with, how long you keep it and people's rights.
- Copying another firm's policy is risky: it must describe what your business actually does.
Does my website need a privacy policy?
Almost certainly, yes. If your website collects personal data, you need to tell people what you do with it. Personal data is any information that can identify a person, directly or indirectly. On a typical business website that includes:
- names, emails and phone numbers from contact or quote forms
- email addresses from newsletter sign-ups
- IP addresses and identifiers collected by analytics and advertising tags
- information shared in live chat or chatbots
- details from job applications, downloads and event registrations
This is a jurisdictional topic, so here are the main rules in plain terms. It's general information, not legal advice.
| Where your visitors or customers are | What applies |
|---|---|
| European Union | GDPR requires you to give people clear information about how you use their data when you collect it (Articles 13 and 14). |
| United Kingdom | UK GDPR and the Data Protection Act 2018 set the same requirement. The ICO's "right to be informed" guidance explains what to include. |
| United States | No single federal law, but California's Online Privacy Protection Act requires commercial websites that collect personal information from California residents to post a privacy policy, and several state privacy laws add further requirements. |
| Elsewhere | Many countries have similar laws. Check those where you have significant customers. |
What your privacy policy must include
Under GDPR and UK GDPR, the privacy information you give must cover:
| Section | What to say |
|---|---|
| Who you are | Your business name and contact details; your data protection officer, if you have one |
| What you collect | The types of personal data, by activity: enquiries, newsletter, analytics, recruitment |
| Why you collect it | The purposes: replying to enquiries, sending newsletters, improving the website |
| Your lawful basis | For each purpose, the legal basis you rely on, such as consent, contract or legitimate interests (and what those interests are) |
| Who you share it with | Categories of recipients: CRM, email platform, analytics provider, IT support |
| International transfers | Whether data goes outside the UK or EU, and the safeguards in place |
| How long you keep it | Retention periods, or the criteria you use to decide |
| People's rights | Access, correction, erasure, restriction, objection, portability, and withdrawing consent |
| How to complain | The right to complain to the data protection authority (the ICO in the UK, or the relevant authority in the EU) |
| Where data comes from | If you collect data from other sources, say which |
| Automated decisions | Whether you make decisions about people purely automatically, if you do |
Write it in plain language. Regulators expect privacy information to be concise, transparent and easy to understand, not pages of legal jargon.
A privacy policy template structure
Use this as a framework, and fill it in with what your business actually does:
- About this policy: who it covers (website visitors, enquirers, customers, applicants).
- Who we are: name, address, contact email for privacy questions.
- Information we collect and why: a short section per activity, for example:
- When you contact us: what we collect, why, lawful basis, how long we keep it.
- When you sign up to our newsletter: the same.
- When you visit our website: analytics and cookies, with a link to the cookie policy.
- When you apply for a job: the same.
- Who we share it with.
- International transfers.
- How we keep it secure.
- Your rights and how to use them.
- How to complain.
- Changes to this policy and the date it was last updated.
Template generators can help with structure, but don't copy another business's policy. It has to describe your actual data, tools and suppliers, and regulators can act on a policy that doesn't match what you do.
Where to put it
- Link it in the footer of every page.
- Link it beside every form, with a short line such as "We'll use your details to reply to your enquiry. See our privacy policy."
- Link it from your cookie banner.
- Keep it on its own page, at a simple URL such as /privacy.
Cookie policy
If your site uses cookies or similar technologies, you also need to explain them, either in a separate cookie policy or a section of the privacy policy, and in the UK and EU you usually need consent for non-essential ones. Our guide to the cookie consent banner covers both the banner and the policy.
Other website legal requirements
A privacy policy is the most common requirement, but a business website often needs more.
| Requirement | When it applies | What to do |
|---|---|---|
| Business identity details | UK companies must show their registered name, registered number, place of registration and registered office address on their website. EU rules also require businesses offering online services to show identifying details | Put them in the footer or on a legal page |
| Cookie consent and policy | Non-essential cookies, for visitors in the UK or EU | See cookie consent banner |
| Website terms of use | Optional, but useful to set rules for using the site and its content | A short terms page linked in the footer |
| Terms and conditions of sale | If you sell or take bookings online | Have them drafted for your business and linked before purchase |
| Accessibility | Required for public sector sites; expected by many buyers | See the website accessibility checklist |
| Regulatory information | Regulated professions (such as law firms) often must show regulator details | Follow your regulator's rules |
| Marketing consent | Sending marketing emails | Collect consent or rely on the rules for existing customers, and offer an unsubscribe in every email |
Keep it up to date
Review your privacy policy when you add a new tool that handles personal data (a CRM, chat widget, analytics platform, booking system), when you start a new activity (recruiting, events, a newsletter), and at least once a year. Update the "last updated" date each time.
Questions
Does my website need a privacy policy if I don't sell anything?
Yes, if it collects personal data. A contact form, newsletter sign-up or analytics tool is enough to require privacy information under GDPR and UK GDPR.
Does a website with only Google Analytics need a privacy policy?
Yes. Analytics tools collect identifiers such as IP addresses and cookie IDs, which count as personal data. You need to explain this, and you'll usually need cookie consent too.
Can I copy a privacy policy from another website?
You shouldn't. Your policy must describe what your business actually collects, why, and who you share it with. A copied policy will almost certainly be inaccurate.
What happens if I don't have a privacy policy?
You risk breaching data protection law, which regulators can act on, and you lose trust with visitors who look for it before submitting a form. Buyers in regulated sectors often check.
Where should my privacy policy be linked?
In the footer of every page, beside every form that collects personal data, and from your cookie banner.
Every guide is checked against the platform it describes before it’s published, and re-checked when the platform changes.