Yes. If your business collects a name, email address, phone number, or any other personal data, UK GDPR requires you to give people a privacy notice explaining what you do with it. Start by trying the ICO’s free privacy notice generator, or work through the checklist below. No Worry Websites can also help you get one published properly.
TL;DR:
- All small businesses processing personal data must provide a privacy notice from the moment they start collecting or handling data, regardless of size.
- The notice must clearly specify the business identity, data categories, processing purposes, lawful bases, third-party recipients, international transfers, retention periods, individual rights, and automated decision-making if applicable.
- Relying on generic templates without matching them to your actual data collection practices risks non-compliance and misleading recipients.
- Privacy notices should be simple, transparent, and accessible, with links in footers and contextual prompts at data collection points to build trust and ensure legal compliance.
- Using the ICO’s free privacy notice generator and review checklist helps small businesses create and maintain an accurate, understandable, and compliant policy.
Table of Contents
- What is a privacy policy for small business, and when do you need one?
- What must a compliant privacy notice include?
- How do you draft a short, usable privacy policy?
- Where should your policy appear, and when does it need to be shown?
- What mistakes do small businesses make with their privacy policy?
- Where can you get templates and quick resources?
- Why plain-English privacy policies matter for small businesses
- A managed alternative if you’d rather someone else handled it
- Official guidance and essential reading
- Sources
- FAQ
What is a privacy policy for small business, and when do you need one?
A privacy notice is the public-facing document you show customers, website visitors, and staff. It explains what personal data you collect and why. This is different from an internal privacy policy, which sets out how your team should actually handle that data day to day. Small businesses often need both, but the notice is the one the law says you must publish.
You need one the moment you start processing personal data, and that threshold is lower than most founders assume. Under UK GDPR, this obligation applies to sole traders, charities, and one-person startups just as much as it applies to larger companies. There’s no size exemption.
Common triggers that mean you need a notice include:
- A contact form on your website, even a simple one asking just for name and email.
- A newsletter or mailing list sign-up.
- Taking payments, which means handling billing names, addresses, and transaction records.
- Employing staff, which involves payroll, HR files, and right-to-work checks.
- Running CCTV on your premises, which counts as processing personal data too.
If you didn’t collect the data directly (say, a referral partner passed you a lead list), you still have to inform those people, generally within one month of receiving their data. This catches a surprising number of small businesses off guard, particularly those buying in customer lists or working with affiliates.
What must a compliant privacy notice include?
Every UK privacy notice needs to answer the same core questions, and the Information Commissioner’s Office maps these to specific legal requirements. Miss one of these and your notice isn’t compliant, even if it reads well.
Here’s what a compliant notice must cover:
- Your identity and contact details. Name your business, give a proper contact method, and if you have a data protection contact (you don’t need a formal Data Protection Officer unless you’re a public authority or process data at scale), name them too.
- The categories of personal data you collect. Be specific: names, email addresses, payment details, IP addresses, CCTV footage, whatever actually applies to your business.
- Your purposes for processing that data. “To fulfil orders”, “to respond to enquiries”, “to send marketing emails” — one line per purpose is fine.
- The lawful basis for each purpose. This is where most first-time drafts go wrong. Every purpose needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Most small business processing sits under contract (you need the data to deliver what was ordered), legal obligation (tax and payroll records), or legitimate interests (general business operations that don’t override someone’s rights).
- Recipients or categories of recipients. Name the types of third parties who see the data: your payment processor, your email marketing platform, your accountant, your web host. You don’t need to list every supplier by name, but you do need to be honest about categories.
- International transfers, if any apply. If your email platform or hosting stores data outside the UK or EU, say so and note the safeguard used (typically Standard Contractual Clauses).
- How long you keep the data. Either a specific period (“customer records for six years after the last transaction”) or the criteria you use to decide.
- Individual rights, including access, correction, deletion, restriction, objection, and portability, plus a line telling people they can complain to the ICO if they’re unhappy with how you’ve handled their request.
- Automated decision-making, only if it applies. Most small businesses don’t do this, but if you use software to auto-approve or auto-reject applications with no human involved, you need to disclose it.
Pro Tip: When you rely on legitimate interests as your lawful basis, you don’t have to publish your full reasoning on the website. But you do need to record a short balancing test internally: what’s the purpose, is it necessary, and how does it affect the individual? Keep that note in a folder somewhere. If the ICO ever asks, you’ll be glad you did.
Choosing the right lawful basis matters more than people think. Consent sounds like the safe default, but it’s actually the hardest one to maintain properly, because consent has to be freely given, specific, and easy to withdraw at any time. If you’re processing an order, you don’t need consent at all. Contract already covers it. Save consent for genuinely optional things like marketing emails, where a clear opt-in and unsubscribe link do the job.
How do you draft a short, usable privacy policy?
Start with a data map, not a blank document. Before you write a word of policy, spend twenty minutes listing every channel where your business collects personal data: your website contact form, your point-of-sale system, your email inbox, your booking software. Against each one, note what data comes in, where it’s stored, and which third-party processor (if any) handles it. The ICO’s own guidance treats this single-sheet exercise as enough groundwork for most small businesses to write an accurate notice.
Once you know what you collect, match each processing activity to a lawful basis and write it down. This becomes your internal reference and the backbone of the published notice.
Write the notice itself in plain English, and keep it short. The ICO’s own preference is for accessible, transparent language over dense legal drafting. A “layered” approach works well for small sites: put a short summary at the top (what you collect, why, and how to contact you), then link down to the fuller detail underneath for anyone who wants it. This structure has been shown to improve how much people actually read and retain, compared with one long unbroken wall of text.
If your website uses cookies or tracking scripts, mention this briefly in your privacy notice and link out to a dedicated cookie policy for the technical detail. Trying to cram cookie consent mechanics into the same document as your general privacy notice usually makes both harder to read.
Before publishing:
- Confirm every lawful basis is documented somewhere, even if only internally.
- Check the notice matches what your website forms and checkout actually collect.
- Set a review date, ideally every six to twelve months, or sooner if you start a new type of processing.
Pro Tip: Read your finished notice out loud. If you stumble over a sentence or need to reread it twice, a customer will too. Simplicity beats completeness dressed up in legal language every time.
Where should your policy appear, and when does it need to be shown?
A footer link across every page is the baseline. Most visitors expect to find “Privacy Policy” tucked at the bottom of a website, and that’s where search engines and browsers look for it too.
But a footer link alone isn’t enough for good compliance. Put contextual links right at the point of collection: next to a contact form, on the checkout page, beside a newsletter sign-up box. If you collect data offline, printed notices at reception, a QR code linking to your online policy, or a line in your booking confirmation email all count.
Timing matters legally, not just practically. If you collect data directly from someone (they fill in your form), you must give them the privacy information at that point, not days later. If you receive data about someone indirectly, you generally have one month to inform them.
- Footer link: always, on every page.
- Point-of-collection links: forms, checkouts, booking widgets.
- Offline equivalents: QR codes, printed notices, confirmation emails.
- Just-in-time prompts: short pop-ups or notes explaining exactly why a specific field (like a phone number) is being asked for, right where it’s asked.
Layering and just-in-time notices don’t just tick a compliance box. They genuinely change whether people read and understand what you’re doing with their data, which builds more trust than a wall of legal text ever will.
What mistakes do small businesses make with their privacy policy?
Copying a generic template without checking it against your own data map is the single most common error. A downloaded template might mention data categories you don’t collect and miss ones you do, which makes your notice both misleading and non-compliant. Always adjust wording to your actual practices.
Relying on consent when another lawful basis fits better is another frequent trip-up. Businesses sometimes bolt an “I consent” tick box onto every form out of caution, not realising that consent obtained unnecessarily is harder to manage (it has to be withdrawable at any time) than simply relying on contract or legitimate interests where those genuinely apply.
Forgetting employee data is a gap that catches out founders who think of privacy purely as a customer-facing issue. Payroll records, HR files, and right-to-work documents are personal data too, and your processor contracts with payroll software or HR platforms need to be documented, not assumed.
Vague or missing retention rules and undocumented international transfers round out the most common practical risks small businesses face. Saying “we keep your data as long as necessary” without any criteria behind it won’t hold up if challenged.
A quick corrective checklist:
- Match your notice line by line against your actual data map, not a template’s assumptions.
- Replace blanket consent requests with the correct lawful basis for each purpose.
- List employee data types and confirm processor contracts exist with your HR and payroll suppliers.
- Write a concrete retention period or clear criteria for every data category.
- Note any storage or processing outside the UK or EU and record the safeguard used.
A compliance checklist covering record-keeping and retention schedules alongside your privacy notice work is worth building once and reusing every year.
Where can you get templates and quick resources?
The ICO’s privacy notice generator is the fastest legitimate route to a bespoke notice, and it’s free. A generic template is fine as a starting skeleton, but always adapt it to your data map. Seek advice if you handle sensitive data (health, biometric, criminal records) or transfer data internationally at scale.
The shortest usable skeleton covers: who you are, what you collect, why (with lawful basis), people’s rights, how to contact you, and how long you keep data. Store your notice versions and review dates somewhere you’ll actually check them, a shared drive folder works fine.
Why plain-English privacy policies matter for small businesses
Getting this right isn’t just about avoiding an ICO letter. A privacy notice that’s honest, short, and easy to find does something a dense legal document never will: it makes customers trust you faster. I’ve seen founders treat their privacy policy as an afterthought copied from a competitor’s site, then wonder why customers ask nervous questions about data before signing up. A clear, specific notice answers those questions before they’re asked.
There’s a practical business case here too. Fewer confused enquiries, smoother supplier and partner negotiations (many B2B clients now ask to see your privacy notice before signing a contract), and a document that actually reflects what your business does. A website partner who understands both the legal side and the technical side of getting a notice published, linked correctly, and kept current removes one more thing from a founder’s plate.
— Mark Jones
A managed alternative if you’d rather someone else handled it
Writing the notice is one job. Getting it published correctly, linked at every collection point, and kept up to date every time your website changes is another job entirely, and it’s the one founders tend to let slide. No Worry Websites’ pay monthly website packages include free domain and SSL as standard, with every change to your site, including policy updates, handled each month as part of the service.
This suits founders who are confident enough to draft their own notice using the ICO generator but don’t want the ongoing hassle of remembering to update the footer link, add a new contextual notice when they launch a booking form, or reformat the page when they redesign the site. It’s also useful if you’re not confident writing the notice yourself and want a tailored website build where compliance details get folded into the setup from day one rather than bolted on afterwards. If your business uses AI-driven call handling or automated booking, that processing needs disclosing too, and it’s worth checking how automated phone systems should be reflected in your notice before you switch one on. Get in touch to see how a pay-monthly site with ongoing support could take this off your plate.
Official guidance and essential reading
Start with the ICO’s privacy notice generator and its drafting guidance for the primary rules on UK GDPR and the Data Protection Act 2018.
Sources
FAQ
Can I write my own privacy policy in the UK?
Yes. Many small businesses draft their own using the ICO’s free generator or by working through a data map and the checklist in this guide. Seek professional advice if you process sensitive data or transfer data internationally at scale.
Does GDPR apply to small businesses?
Yes, without exception for size. UK GDPR applies to any sole trader, startup, charity, or company that processes personal data, regardless of how many staff you employ.
What are the 7 GDPR requirements?
Definitions of the “seven principles” vary slightly by source, but they generally cover lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality (security), and accountability. Your privacy notice should reflect all of these in how you describe your data handling.
What should I include in a privacy policy?
Your identity and contact details, the categories of data you collect, your purposes and lawful basis for each, who you share data with, how long you keep it, and an explanation of individual rights including the right to complain to the ICO. See the full checklist above for the complete breakdown.
