Yes, if your website collects any personal information at all, and a contact form counts. UK GDPR Article 13 says that when you collect someone’s details you must tell them, at that moment, who you are, why you want the information, what gives you the right to use it, who else sees it, how long you keep it, and what their rights are. A privacy policy linked from the form is how almost every website does that. Two of the things it must say changed in 2026, so a policy written before June is probably out of date.
Does a small business website legally need a privacy policy?
If it collects personal data, yes. A contact form, a quote request, a newsletter sign-up, a booking form, an online shop, or analytics that capture IP addresses all collect personal data. Article 13 of UK GDPR requires you to give people specific information “at the time when personal data are obtained”. There is no exemption for small businesses or sole traders.
A brochure site with no form, no analytics and no cookies beyond the strictly necessary collects very little, but almost no real business site is like that. If in doubt, assume you need one.
What changed about privacy policies in 2026?
Two things, both from the Data (Use and Access) Act 2025:
- 19 June 2026: Article 13(2)(ca) was inserted. Your privacy notice must now tell people they have the right to complain to you, under section 164A of the Data Protection Act 2018. Before, most policies only mentioned complaining to the regulator.
- 30 September 2026: the regulator became the Information Commission, replacing the Information Commissioner. It still runs from ico.org.uk, but a policy that names “the Information Commissioner’s Office” as the body you complain to is now out of date.
We found both problems in our own policy while writing this page, and fixed them the same morning.
What must a privacy policy include?
Article 13 lists it. Paraphrased in plain English:
| You must say | Article 13 reference | For a typical small business site |
|---|---|---|
| Who you are and how to contact you | 13(1)(a) | Your business name and an email address |
| Why you want the data, and your legal basis | 13(1)(c) | To reply to enquiries and quote for work |
| Your legitimate interest, if you rely on one | 13(1)(d) | Answering people who contact you |
| Who else receives it | 13(1)(e) | Your email provider, payment provider, web host |
| Transfers outside the UK and the safeguards | 13(1)(f) | If any of those providers are based abroad |
| How long you keep it | 13(2)(a) | A period, or how you decide it |
| Their rights: access, correction, erasure, restriction, objection, portability | 13(2)(b) | Listed, with how to use them |
| The right to withdraw consent | 13(2)(c) | For a newsletter sign-up, say how to unsubscribe |
| The right to complain to you | 13(2)(ca), new from 19 June 2026 | Say people can complain to you, and how |
| The right to complain to the Information Commission | 13(2)(d) | Name it correctly, and link to it |
| Whether they have to give the data | 13(2)(e) | “We need your email to reply” |
| Any automated decision-making or profiling | 13(2)(f) | Usually “none” |
Can I just copy a privacy policy template?
You can start from one, but a template describes somebody else’s website. The most common faults we see are policies that mention comments, gravatars and embedded content the site does not have, policies that promise analytics the site does not run, and policies that leave out the payment provider the site actually uses. A privacy policy is a description of what your site really does. If it describes a different site, it does not meet Article 13 however long it is.
WordPress itself ships a placeholder privacy page full of “Suggested text:” notes. It is not a privacy policy, and it is unpublished by default for a reason. We found our own still sitting as an unpublished draft, which meant our privacy link returned a “page not found” error.
Do sole traders need a privacy policy?
Yes. UK GDPR applies to anyone processing personal data for business purposes, whatever the size or legal form of the business. A sole trader is the data controller, trading under their business name.
Does my privacy policy need to show my home address?
Not under Article 13, which asks for “the identity and the contact details of the controller”. A business name and a working email address meet that. Other laws can require an address on a website, which is a separate question.
Where should the privacy policy go on my website?
Somewhere people can find it at the moment they hand over their details. In practice that means a link in the footer of every page, and a link directly beside every form that collects personal information. Article 13 says “at the time when personal data are obtained”, and a link that only exists three clicks away does not really meet that.
How long should a small business keep enquiry data?
As long as you genuinely need it, and you have to say how long in the policy. There is no fixed period in law for general enquiries. Six years is common for client records and invoices because of tax rules. For enquiries that never became work, a shorter period such as one or two years is easier to justify. Whatever you choose, write it down and then actually delete on schedule.
You can see how we applied all of this in our own privacy policy, which covers a contact form, a newsletter, Stripe payments and an affiliate programme in plain English.
General information on UK law as at 22 October 2026, not legal advice for your circumstances.
More on website law and tax: do you need a cookie banner, the ICO data protection fee, are website costs tax deductible, can you reclaim VAT on a website.
Get web & SEO tips that actually move the needle
Short, occasional emails for business owners: what's changing in Google, how to win more enquiries, and the fixes worth your time. No spam, no jargon.