Does My Small Business Website Need a Privacy Policy?
Understand when a small-business website needs privacy information and how to write a notice that matches its forms, analytics and suppliers.
Part of our guide: UK Website Compliance and Security: A Practical Guide for Small Businesses
If your website collects or otherwise processes personal information, you will generally need to provide appropriate privacy information. That commonly includes sites with enquiry forms, newsletter subscriptions, booking tools or analytics that involve identifiable people.
A document usually called a privacy policy or privacy notice is one way to provide it. The important point is that people receive an accurate, understandable explanation at the right time, not merely that a footer contains a legal-sounding link.
Find out what the website really collects
Start with the enquiry journey. Record the fields submitted, where the information goes, who can access it and whether copies remain in email, hosting logs or a customer-management system.
Check embedded services too. Maps, video players and review tools may create data flows that are not obvious from the page design.
The compliance and security guide helps organise this wider inventory.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Check the rest of the public-facing information against what a business website should include.
Explain the actual purposes
Tell people who is responsible for their information and why it is used. Distinguish responding to an enquiry from sending later marketing.
The ICO’s privacy-notice resources provide a starting point for small organisations. Your notice should cover applicable matters such as lawful bases, sharing, retention, rights and complaint routes.
Avoid claiming that consent is the basis for everything without assessing each purpose. Different activities may need different treatment.
Put information where it is needed
A footer link makes the full notice findable. A short explanation beside a form can tell visitors what will happen to their enquiry and point to the details.
Do not hide important information only in a long terms document. Make the wording readable on a phone and understandable without legal training.
The contact-form data guide explains the practical handling decisions behind that short explanation.
Set a defensible retention approach
Decide how long different information is needed and why. An unanswered enquiry may not need the same retention period as a contract record.
Avoid copying a single arbitrary period into the policy without checking operational and legal needs. Make sure the systems can follow the arrangement, including archived mail and third-party tools.
Document any necessary exceptions and seek advice where statutory retention or disputes are involved.
Name the right supplier relationships
Understand whether providers process data on your instructions or use it for their own purposes. Review contracts, locations and any international-transfer arrangements that apply.
If a chatbot is added, revisit the notice and assessment. The AI chatbot privacy guide covers conversation logs, model providers and staff access.
A supplier’s own privacy policy does not automatically describe your responsibilities to your customers.
Keep cookies and personal data distinct
Cookie and similar-technology rules are related to, but not identical with, data-protection duties. A technology may require a storage/access assessment even when you believe the resulting statistics are anonymous.
Read cookie-banner requirements and cookieless analytics. A privacy notice does not itself obtain valid consent for activities that require it.
The experience should remain usable, as explained in respectful privacy controls.
Review the notice when things change
Add privacy review to the launch checklist for a new form, analytics service, booking provider or marketing integration. Check that the published notice and actual configuration still agree.
Keep a dated internal record of the review and the responsible person. Do not simply change the public date to suggest an update that did not happen.
For implementation help, contact AfterWorks. For uncertainty about lawful bases, international transfers or sensitive information, obtain qualified data-protection advice.
