Skip to main content
Tide - Earn up to £200 codeREFER200Capital on Tap - 7,500 bonus points codeSETTINGUP
UK Startup

Templates · Compliance

Free UK website privacy policy template

A UK GDPR-compliant privacy policy for a standard small business website. Covers all the required disclosures — data collection, lawful basis, individual rights, cookies, and how to complain to the ICO. Copy, paste, and update the bracketed sections.

Last updated May 2026Check the cited official sources before acting.

Every website that collects personal data — including just an email address from a contact form — needs a privacy policy. UK GDPR requires you to tell visitors what data you collect, why, and what their rights are. This template covers the requirements for a standard small business website. It is written in plain English, as the ICO recommends.

Direct answer

A UK GDPR-compliant privacy policy for a standard small business website. Covers all the required disclosures — data collection, lawful basis, individual rights, cookies, and how to complain to the ICO. Copy, paste, and update the bracketed sections.

Required by
UK GDPR (ICO)
Must be
Easily accessible on your website
Updated when
Your data practices change
ICO registration
£40–£60/year (most businesses)

Privacy policy template — copy and paste

PRIVACY POLICY Last updated: [DD Month YYYY] This privacy policy explains how [BUSINESS NAME] ("we", "us", "our") collects, uses and protects personal information when you visit our website at [WEBSITE URL] ("our website"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This policy is written in plain English to make it as clear as possible. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. WHO WE ARE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ [BUSINESS NAME] is the data controller for the personal data collected through this website. Business name: [BUSINESS NAME] Legal structure: [Sole trader / Limited company] [Company number: [NUMBER] (if limited company)] Address: [ADDRESS] Email: [EMAIL ADDRESS] [ICO registration number: [NUMBER] (if registered with the ICO)] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2. WHAT PERSONAL DATA WE COLLECT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We may collect the following types of personal data: Contact information: name, email address, phone number, and postal address when you contact us or submit an enquiry form. Technical data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website. Usage data: information about how you use our website, including pages visited, time spent, and links clicked. [Marketing data: your preferences in receiving marketing from us and your communication preferences. (Include only if you send marketing emails.)] [Transaction data: details of products or services you have purchased from us. (Include only if you sell online.)] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3. HOW WE COLLECT YOUR DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We collect data in the following ways: Direct interactions: when you fill in a contact form, send us an email, or call us. Automated technologies: when you visit our website, we may automatically collect technical and usage data using cookies and similar technologies. See our cookie notice below. [Third parties: we may receive data about you from analytics providers (such as Google Analytics), advertising networks, and search information providers.] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4. HOW WE USE YOUR DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We use your personal data for the following purposes: Purpose Lawful basis ───────────────────────────────────────────────────────────── To respond to your enquiries Contract / Legitimate interests To provide our services to you Contract To send you marketing emails Consent / Soft opt-in (existing customers) To improve our website Legitimate interests To comply with legal obligations Legal obligation To analyse website usage Legitimate interests (or Consent for cookies) We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 5. WHO WE SHARE YOUR DATA WITH ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We may share your personal data with: Service providers: companies that provide services to us, such as [website hosting, email marketing, payment processing, analytics]. These companies are only permitted to use your data to provide services to us, not for their own purposes. [List specific providers if you know them, e.g.: - Google Analytics (website analytics) — Google LLC - Mailchimp (email marketing) — Intuit Inc. - Stripe (payment processing) — Stripe Inc.] Professional advisers: solicitors, accountants, and insurers who provide professional services to us. Regulatory authorities: HMRC, the ICO, or other authorities where required by law. We do not sell your personal data to third parties. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 6. INTERNATIONAL TRANSFERS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ [If you do not transfer data outside the UK, use this: We do not transfer your personal data outside the United Kingdom.] [If you use US-based services like Google Analytics or Mailchimp: Some of our service providers are based outside the United Kingdom. Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy regulations.] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 7. HOW LONG WE KEEP YOUR DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We will only keep your personal data for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are: Contact enquiries: [2 years] from the date of last contact Customer records: [6 years] from the end of the business relationship (to comply with HMRC record-keeping requirements) Marketing contacts: Until you unsubscribe or withdraw consent Website analytics: [26 months] (Google Analytics default) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 8. YOUR RIGHTS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Under UK GDPR, you have the following rights: Right of access: you can request a copy of the personal data we hold about you. Right to rectification: you can ask us to correct inaccurate or incomplete data. Right to erasure: you can ask us to delete your data in certain circumstances. Right to restrict processing: you can ask us to restrict how we use your data in certain circumstances. Right to data portability: you can ask us to provide your data in a machine-readable format. Right to object: you can object to our processing of your data where we rely on legitimate interests. Right to withdraw consent: where we rely on consent, you can withdraw it at any time. To exercise any of these rights, please contact us at [EMAIL]. We will respond within one month. We do not charge a fee for reasonable requests. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 9. COOKIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Our website uses cookies. A cookie is a small text file placed on your device when you visit a website. Strictly necessary cookies: required for the website to function. These cannot be disabled. [Analytics cookies: we use Google Analytics to understand how visitors use our website. These cookies collect anonymous information. We only set these cookies with your consent.] [Marketing cookies: we use [service] to [purpose]. These cookies are only set with your consent.] You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 10. COMPLAINTS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ If you are unhappy with how we handle your personal data, please contact us first at [EMAIL] and we will do our best to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 11. CHANGES TO THIS POLICY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website or, where appropriate, by email. This policy was last updated on [DD Month YYYY].

Section 01

How to use this template

Replace every item in square brackets with your own information. Delete any sections that do not apply to your business. The notes in square brackets are guidance — remove them from the final document.

  • Section 1 (Who we are): Add your business name, legal structure, address, and ICO registration number if you have one.
  • Section 2 (What data we collect): Remove any data types you do not collect. Add any types not listed.
  • Section 4 (How we use your data): Update the table to reflect your actual processing activities and lawful bases.
  • Section 5 (Who we share with): List the specific third-party services you use (Google Analytics, Mailchimp, Stripe, etc.).
  • Section 6 (International transfers): Choose the appropriate paragraph depending on whether you use US-based services.
  • Section 9 (Cookies): Update to reflect the cookies your website actually sets.
  • Publish the policy on your website with a clear link in the footer. Update the 'Last updated' date whenever you make changes.

Section 02

What UK GDPR requires in a privacy notice

UK GDPR Article 13 specifies the information you must provide when collecting personal data. This template covers all required elements.

  • Your identity and contact details.
  • The purposes and lawful basis for processing.
  • Legitimate interests pursued (if that is your lawful basis).
  • Recipients or categories of recipients of the data.
  • Details of any international transfers and safeguards.
  • Retention periods.
  • The individual's rights (access, rectification, erasure, portability, objection, restriction).
  • The right to withdraw consent (where consent is the lawful basis).
  • The right to complain to the ICO.
  • Whether providing data is a statutory or contractual requirement.
  • Details of any automated decision-making.

Section 03

Lawful basis — which one applies to you?

You must identify a lawful basis for each type of processing. The most common bases for small business websites are:

  • Contract: you need the data to fulfil a contract (e.g. processing an order, responding to an enquiry about your services).
  • Legitimate interests: you have a legitimate reason to process the data that is not overridden by the individual's rights (e.g. website analytics, fraud prevention).
  • Consent: the individual has actively agreed to the processing (e.g. signing up for a newsletter, accepting analytics cookies). Consent must be freely given, specific, informed, and unambiguous.
  • Legal obligation: you are required by law to process the data (e.g. keeping PAYE records).

Partner offers

Current reader offers

Review each provider's eligibility, conditions and terms before applying. UK Startup may receive a referral fee at no extra cost to you.

Compare both offers

Business banking

Reader offer

Tide Business Account

£200 Cash FREE

Earn up to £200 only when you complete both milestones: £75 for eligible Tide card transactions and £125 for the separate Tide Instant Saver milestone.

Tide code
REFER200
Check Tide eligibilityRead the full Tide offer guide

New eligible Tide members only. The reward is conditional on both milestones; provider terms, eligibility and payment timing apply.

Business credit card

Reader offer

Capital on Tap Business Credit Card

7,500 bonus points

7,500 bonus points after a completed qualifying card or cash transaction within 30 days of signing, subject to Capital on Tap’s current partner terms.

Capital on Tap code
SETTINGUP
Check Capital on Tap eligibilityRead the full Capital on Tap offer guide

18+, UK-resident qualifying company applicants. Credit subject to status and affordability.

18+ and UK requirements apply. Tide: Earn up to £200 only when you complete both milestones: £75 for eligible Tide card transactions and £125 for the separate Tide Instant Saver milestone. New eligible Tide members only. The reward is conditional on both milestones; provider terms, eligibility and payment timing apply. Capital on Tap: 7,500 bonus points after a completed qualifying card or cash transaction within 30 days of signing, subject to Capital on Tap’s current partner terms. 18+, UK-resident qualifying company applicants. Credit subject to status and affordability. We may receive a commission if you sign up; it does not change the provider’s offer or pricing.

Common questions

Frequently asked questions