Writing a privacy notice for a UK small business

When you need one

You need a privacy notice if you collect personal data at all, whether that’s through a contact form, a newsletter sign-up, an online shop or a booking system. The duty is the “right to be informed”, and the ICO explains it in its right to be informed guidance. The detailed requirements are in two articles of the UK GDPR:

• Article 13 applies when you collect data directly from the person, for example through a form. You must give the information at the time you collect the data.
• Article 14 applies when you get data from somewhere else, such as a bought-in list, a partner or a public source. You must give the information within a reasonable period and at the latest within one month, or when you first contact the person or first disclose the data, if that’s sooner.

What it must include

Here is the Article 13 list in plain English. Article 14 is almost the same, with two additions marked below.

1. Who you are and how to contact you. For a sole trader, that means your name or trading name and contact details. Include your data protection officer’s details if you have one (most small businesses don’t have to).
2. What you use the data for, and your lawful basis for each purpose. The ICO has a guide to lawful bases, which include consent, contract, legal obligation and legitimate interests.
3. Your legitimate interests, if that’s the basis you rely on.
4. Who receives the data. This includes service providers such as your payment processor, email platform, web host and accountant. You can name them or describe categories.
5. International transfers. If data leaves the UK (many software tools are US-based), say so and explain the safeguards.
6. How long you keep it, or how you decide.
7. People’s rights: access, rectification, erasure, restriction, objection and data portability.
8. The right to withdraw consent at any time, where you rely on consent.
9. The right to complain to you under section 164A of the Data Protection Act 2018. This is new: it has been in force since 19 June 2026.
10. The right to complain to the regulator, the ICO (since 30 September 2026 the Information Commission, still known as the ICO).
11. Whether providing the data is required by law or contract, and what happens if someone doesn’t provide it.
12. Automated decision-making, including profiling, if you use it in a way that has significant effects.

Article 14 also requires the categories of data you hold and where you got it from, including whether it came from public sources.

The new complaints duty

From 19 June 2026, section 164A of the Data Protection Act 2018 gives people the right to complain to you directly. You must make complaining easy, for example with a complaint form that can be completed electronically. You must acknowledge a complaint within 30 days, look into it, keep the person updated and tell them the outcome without undue delay. The ICO has published guidance on handling complaints, and its June 2026 announcement stressed that the duty applies to all organisations handling personal data. Your privacy notice should explain how to complain to you, as well as to the ICO.

Common gaps

• A template copied from another site that mentions things you don’t do, and leaves out things you do.
• No lawful basis, or one basis given for everything.
• No retention periods.
• Service providers missing, especially newsletter, payment and analytics tools.
• No mention of transfers outside the UK.
• No complaints route other than the ICO.
• Not linked from the forms where data is actually collected.

A simple structure that works

The ICO says privacy information must be concise, transparent, intelligible, easily accessible and written in clear and plain language. It adds that a combination of different techniques is often most effective. A common approach is a short summary at the point of collection, linked to the full notice. A structure that works for most small businesses:

1. Who we are and how to contact us
2. What we collect and where it comes from
3. What we use it for and our lawful basis (a small table works well)
4. Who we share it with
5. International transfers
6. How long we keep it
7. Your rights, and how to complain to us or to the ICO
8. Cookies (or a link to your cookie information)
9. Changes to this notice, and the date it was last updated

Write it for your customers, not for lawyers. Short sentences and specific examples (“we use your email address to send the newsletter you signed up for”) are more transparent than broad statements.

FAQ

Is a privacy policy a legal requirement for a UK website?

If you collect personal data, yes. UK GDPR Articles 13 and 14 require you to give people specific information about how you use their data. A privacy notice on your website is the usual way to do it.

What’s the difference between Article 13 and Article 14?

Article 13 covers data you collect directly from the person. Article 14 covers data you get from elsewhere, and adds the categories of data and the source.

Do I need to mention the right to complain to my business?

Yes. Since 19 June 2026, Articles 13 and 14 include the right to complain to the controller under section 164A of the Data Protection Act 2018, as well as the right to complain to the ICO.

Can I use a free template?

A template can help you get started, but it must describe what you actually do. Generic templates often list the wrong tools and leave out retention periods and lawful bases.

Is the regulator still called the ICO?

Yes. The Information Commission took over from the Information Commissioner on 30 September 2026, and it is still known as the ICO.

Official sources

• UK GDPR Article 13 (legislation.gov.uk)
• UK GDPR Article 14 (legislation.gov.uk)
• ICO: Right to be informed
• ICO: Guide to lawful basis
• Data Protection Act 2018, section 164A
• ICO: How to deal with data protection complaints

Laws and guidance change. Check the sources above for the latest position. For advice on your own circumstances, consult a solicitor.