Privacy notice
If your website collects personal data, for example through a contact form, a booking system or a newsletter sign up, people have a right to be told what you collect and what you do with it. What that privacy information should include is listed in the ICO's right to be informed guidance. In plain terms, a privacy notice for a small business site would cover:
- who you are and how to contact you
- what personal data the site collects, and how
- why you use it, and your lawful basis
- who else receives it, such as an email or booking provider
- how long you keep it
- the rights people have, and how to complain to the ICO
Write it in plain language, specific to your site. A notice copied from another business will describe someone else's data.
The ICO says that guidance is being reviewed since the Data (Use and Access) Act 2025 became law, so read the version current on the day you write or update your notice.
The data protection fee
Organisations that process personal data must pay a data protection fee to the ICO unless they are exempt. The ICO publishes the current fee tiers and a self-assessment to check whether you need to pay. Check it there rather than relying on a figure from a guide.
Cookies and similar technologies
The Privacy and Electronic Communications Regulations govern storing information on, or reading it from, a visitor's device. Cookies are the best known example, but the rules cover similar technologies too. Consent is needed unless an exception applies. The ICO's guidance on storage and access technologies explains the rules.
The established exception covers what is strictly necessary to provide a service the visitor has asked for, such as a security token on a form. Since 5 February 2026, when SI 2026/82 (regulation 2(w)) brought section 112 of the Data (Use and Access) Act 2025 into force, there are also exceptions for collecting statistics to improve a website and for adapting how it looks to a visitor's preferences. The ICO finalised its guidance on these on 29 April 2026. They require clear information and a simple, free way to object.
For your plan:
- List every cookie or similar technology the site will use, including those set by embedded services such as maps, videos and booking widgets.
- For each one, note its purpose and whether an exception applies.
- If any need consent, plan a way to ask for it before they are set, and a way to change the choice later.
- Write a cookie page that lists them in plain terms.
Company details for limited companies
Under the 2015 trading disclosure regulations, every company must show its registered name on its websites. The same regulations require the company's websites to show the part of the United Kingdom in which it is registered, its registered number and the address of its registered office. A site wide footer covers every page, which keeps the details in front of visitors wherever they arrive.
Sole traders and partnerships have other rules on business names; check GOV.UK if you trade under a name other than your own.
Terms of sale
If you sell goods, services or digital content online, GOV.UK's online selling guidance lists what you must tell customers before they order, including the total price, delivery costs, how to pay and the steps to place an order. It also says customers must be able to store and reproduce your terms, for example by downloading or printing them.
For distance sales to consumers, the Consumer Contracts Regulations 2013 give cancellation rights, with exceptions. Terms of sale and a returns or cancellation page should reflect them. This is an area where advice from a solicitor or a trade body is worth having.
Accessibility statement
An accessibility statement is not required of every small business, but it helps visitors know what to expect and how to report a problem. If you publish one, describe the checks actually done and the known gaps, not a level of compliance you have not tested.
Putting it into the plan
Add each legal page that applies to your page list in the planner, and note who will write it. The launch checklist includes checks for each before go live.
Sources checked for this page