If you run a website in the UK — whether it's a shop, a blog, a portfolio, or a service business — you've probably wondered whether you legally need a Privacy Policy. The short answer is: almost certainly yes.
In this guide, we'll explain exactly when a Privacy Policy is required under UK law, what it must contain, and what happens if you don't have one.
What is a Privacy Policy?
A Privacy Policy is a legal document that tells your website visitors what personal data you collect about them, why you collect it, what you do with it, and what their rights are. It sits at the heart of UK GDPR compliance.
Personal data is any information that can identify a living individual — this includes names, email addresses, IP addresses, cookies, location data, and payment information.
When is a Privacy Policy legally required?
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you are legally required to have a Privacy Policy if your website does any of the following:
- Has a contact form (collects names and email addresses)
- Uses Google Analytics or any other analytics tool (collects IP addresses)
- Has an email newsletter sign-up
- Allows users to create accounts or log in
- Processes payments online
- Uses cookies (beyond strictly necessary ones)
- Runs any kind of advertising or remarketing
✅ In practice, virtually every business website in the UK needs a Privacy Policy. Even a simple brochure site that uses Google Analytics is collecting personal data (IP addresses) and must disclose this.
What must a UK Privacy Policy include?
Under Articles 13 and 14 of the UK GDPR, your Privacy Policy must include the following information:
- Your company name and contact details (the "data controller")
- The contact details of your Data Protection Officer (if you have one)
- What personal data you collect and why
- Your lawful basis for processing each category of data
- How long you keep personal data
- Whether you share data with third parties, and who those parties are
- Whether you transfer data outside the UK or EEA
- The rights of your data subjects (access, erasure, portability, etc.)
- How to make a complaint to the ICO
A generic "we respect your privacy" statement is not enough. Your Privacy Policy must be specific to your business and the data you actually collect.
What are the penalties for not having a Privacy Policy?
The Information Commissioner's Office (ICO) is the UK's data protection regulator. It has the power to issue fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious breaches of UK GDPR.
For small businesses, enforcement action typically begins with a formal warning or improvement notice. However, ignoring the requirements entirely — especially if a complaint is made — can result in significant fines even for small businesses.
⚠ Important: You don't have to suffer a data breach to receive a fine. Simply failing to have an adequate Privacy Policy, or processing data without a lawful basis, can trigger enforcement action.
Where should your Privacy Policy be displayed?
Your Privacy Policy must be:
- Easily accessible — linked in your website footer on every page
- Written in plain language — not legal jargon that users can't understand
- Specific to your business — not a generic template that doesn't reflect what you actually do
- Up to date — reviewed and updated whenever your data practices change
Do I also need a Cookie Policy?
If your website uses cookies — including analytics cookies from Google Analytics, advertising cookies from Meta Pixel, or any tracking tools — you also need a separate Cookie Policy and a cookie consent banner.
The Cookie Policy explains which cookies you use, what they do, and how users can opt out. It works alongside your Privacy Policy, not instead of it.
The bottom line
If your website collects any personal data from UK visitors — and almost all websites do — you need a Privacy Policy. It's not optional, and a generic template that doesn't reflect your actual data practices won't cut it with the ICO.
The good news is that generating a personalised, legally-structured Privacy Policy doesn't have to cost hundreds of pounds in legal fees. DataShark generates a custom document based on your specific business in under 5 minutes.
Ready to generate your GDPR policy?
Answer a few questions about your business and get a personalised, legally-structured document in minutes.
Start free — from £29 →