Does my UK website need a privacy policy?
Short answer: almost certainly yes. If your website collects any personal data. A contact form, an email signup, analytics cookies, an online order, UK GDPR expects you to tell people what you collect and why. That's what a privacy policy does.
When you need one
You're processing personal data (and so need a policy) if your site does any of these:
- A contact or enquiry form (name, email = personal data).
- A newsletter or mailing list signup.
- Analytics or advertising cookies (Google Analytics, Meta pixel, and the like).
- E-commerce: orders, accounts, payments.
In short: if a visitor can give you information about themselves, you need a policy. A brochure site with no forms, no analytics and no cookies is the rare exception, and most sites have analytics.
What a UK privacy policy should cover
- Who you are: business name and a contact point.
- What you collect: the categories of personal data.
- Why, and your lawful basis: UK GDPR requires a lawful basis for processing.
- Who you share it with: processors like your email tool, analytics, payment provider.
- How long you keep it.
- People's rights: access, correction, deletion, and how to complain to the ICO.
- Cookies: what you set and how people can control them.
The bit people miss
A policy isn't a one-off. Add a tool that collects data. A booking widget, a chat box, and the policy should reflect it. You likely also need a cookie banner that lets people decline non-essential cookies, not just a policy page.
Honest limits
A generated policy gives you a clear, well-structured draft covering the standard bases, a big head start on a blank page. It is not legal advice, and for anything unusual (special-category data, children's data, large-scale processing) it's worth a professional review. The ICO's website has plain-English guidance and a small-business helpline.
The fast way
Vizivo's Privacy Policy Generator produces a clear, UK-focused draft from a few details about your site and what it collects, structured around the points above, in plain language, for you to review before you publish.
Common questions
- Does a small UK website really need a privacy policy?
- If it collects any personal data, yes. A contact form, an email signup or analytics cookies all count as processing personal data under UK GDPR, which requires you to tell people what you collect and why.
- Is a privacy policy the same as a cookie banner?
- No. The policy explains what you collect and why. The banner is how you obtain consent for non-essential cookies before they are set. Most UK sites running analytics need both.
- Can I copy another company's privacy policy?
- It is a poor idea. The policy has to describe what your site actually collects, which tools you use and how long you keep data. A copied policy describes someone else's processing, which is worse than useless if a customer or the ICO asks.
Do it in two minutes
30 free credits, no card needed.
Related guides
- Terms and Conditions for Small Businesses: A UK How-To GuideHow to write terms and conditions for a UK small business, what to include, and where templates fall short. Practical, plain-spoken advice.
- What documents do you need after registering a UK limited company?Companies House sends the certificate and then goes quiet. Here is what you actually have to file, what you need before you can trade, and what can wait.
- How to write website copy that convertsWrite website copy that sells: lead with the customer's outcome, make the homepage clear in five seconds, and turn features into benefits.