What every UK and EU business website needs, what each document must contain, and why getting it right matters more than most business owners realise.
Many business owners treat privacy policies, cookie policies, and terms and conditions as an afterthought — something to copy from another website and paste in. That approach carries real legal risk. These documents are not optional extras or box-ticking exercises. They are legal requirements for most commercial websites in the UK and EU, and they exist to protect both you and your visitors.
Each document serves a different purpose, and understanding that distinction is the starting point for getting them right.
Your web developer's responsibility is to ensure these pages exist on your website and are accessible from the correct locations — typically linked from the footer on every page, and referenced near any point where data is collected.
A good developer will advise you that these documents are needed, point you in the right direction, and may be able to recommend suitable tools or services to help with the generation of them.
The content itself — the specific policies, terms, and data practices they describe — is entirely the responsibility of the website owner. The policies must accurately reflect your actual business practices, your specific data handling, and your trading terms.
Only you know those details, and only a qualified legal professional can advise on whether your documents meet your legal obligations.
Do not copy legal pages from another website. They will not reflect your business, may contain terms that are unenforceable or incorrect for your situation, and will almost certainly omit protections specific to how you operate.
The General Data Protection Regulation (GDPR) is the legal framework that governs how personal data is collected, stored, and used. In the UK, it is retained as UK GDPR following Brexit, alongside the Data Protection Act 2018. Businesses operating in or targeting the EU remain subject to EU GDPR. In practice the requirements are closely aligned.
GDPR applies to any business that collects personal data from individuals — which includes virtually every website with a contact form, newsletter sign-up, or analytics tool. It is not limited to large organisations. A sole trader with a simple business website is subject to the same fundamental obligations as a multinational corporation.
Your privacy policy must include a dedicated GDPR section. This is not optional. It must identify you as the data controller, state the legal basis on which you process personal data, and clearly set out the rights of individuals under GDPR — including the right to access, correct, delete, and object to the use of their data.
Failure to comply with GDPR can result in significant fines. In the UK, the ICO has the power to issue penalties of up to £17.5 million or 4% of global annual turnover, whichever is higher. EU supervisory authorities have equivalent powers under EU GDPR.
Important: If your website collects any personal data and your privacy policy does not contain a GDPR section, your website is not compliant. This applies regardless of the size of your business or the volume of data you collect.
A privacy policy is a legal document that explains how your website collects, uses, stores, and protects personal data belonging to visitors and customers. In the UK it is required under UK GDPR and the Data Protection Act 2018. For businesses operating in or targeting the EU, the EU GDPR applies. In practice the requirements are very similar.
If your website collects any personal data — even something as simple as an email address through a contact form — you are legally required to have a privacy policy. This applies to virtually every commercial website. Analytics tools such as Google Analytics also collect personal data, which means websites using them require a privacy policy regardless of whether they have a contact form.
Your privacy policy must be easily accessible from every page of your website — typically via a link in the footer. It should also be specifically referenced at any point where personal data is collected, such as near a contact form or newsletter sign-up.
Under UK and EU GDPR, privacy policies must be written in plain, clear language that any visitor can understand. Copying dense legal text from another website often fails this requirement and may not accurately reflect your own data practices.
Cookies are small text files that websites store on a visitor's device. They serve a range of purposes — keeping a visitor logged in, remembering their preferences, tracking their behaviour across pages, or enabling third-party advertising. Not all cookies are the same, and the legal requirements depend on the type.
In the UK, cookie use is governed by the Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR. In the EU, the ePrivacy Directive applies alongside EU GDPR. Both require websites to tell visitors what cookies they use and, for non-essential cookies, to obtain the visitor's consent before setting them.
This is where many websites fall short. Displaying a cookie banner is not the same as obtaining valid consent. Under UK GDPR and the EU GDPR, valid consent must be freely given, specific, informed, and unambiguous. It must be as easy to decline cookies as to accept them. Pre-ticked boxes do not constitute consent. Continuing to browse is not consent. And no non-essential cookies should be set until consent has been actively given.
Important: A cookie banner that simply announces cookies exist without giving visitors a real choice to decline, or that sets non-essential cookies before consent is given, is not compliant. The ICO in the UK and data protection authorities across the EU have the power to investigate and fine businesses that fail to comply.
Terms and conditions (also referred to as terms of service or terms of use) are the legal agreement between your business and anyone who uses your website or purchases your products or services. Unlike a privacy policy, there is no single law that requires every website to have terms and conditions — but for any business that sells goods or services online, they are essential for protecting your interests and managing customer expectations.
If your website sells products or services, takes bookings, or operates any form of membership or subscription, you should have terms and conditions. Even for informational websites, terms of use that govern how visitors may use your content — particularly if you publish original written material, photographs, or other intellectual property — are advisable.
UK businesses selling to consumers must be aware of the Consumer Rights Act 2015, which sets out statutory rights that cannot be excluded or limited by your terms and conditions. Any terms that attempt to remove rights the law already provides to consumers are unenforceable. Your terms and conditions must work within this framework, not against it.
If your website sells to customers in EU member states, the EU Consumer Rights Directive and relevant national consumer protection laws also apply. Among other requirements, you must provide a statutory right of withdrawal (a cooling-off period) for most online purchases. Businesses selling into the EU should ensure their terms reflect these additional obligations.
Terms and conditions copied directly from another website may not reflect your actual business practices, may contain terms that are unenforceable, and may omit protections that are specific to your situation. A template is a starting point, not a finished document.
Privacy law, cookie regulations, and consumer protection legislation change. A privacy policy or set of terms written in 2019 may not reflect the current legal position. These documents should be reviewed at least annually, and updated whenever your data practices change — for example, when you add a new analytics tool, start using a new third-party service, or begin selling to customers in new markets.
When you update any of these documents, it is good practice to include a "last updated" date so visitors can see they are current.
Advisory: This guide provides general information only. Privacy and data protection law is complex, changes regularly, and its application depends on your specific circumstances. For advice tailored to your business, consult a qualified legal professional or data protection specialist.