Privacy notices for your website: what the ICO says you must tell customers

Almost every small business website collects personal data. A contact form, a booking widget, a newsletter box, an online order or even a CV sent to a jobs email address all count. When you collect that data, UK data protection law expects you to tell people what you are doing with it. The Information Commissioner's Office (ICO) calls this "privacy information", and the page on your website that carries it is usually called a privacy notice or privacy policy.

Many owners solve this by copying a policy from another site or downloading a template and never looking at it again. Law firm commentary we read while researching this post repeatedly warns that a template is not the same as compliance, because a policy that does not match what you actually do can leave you in breach. This post walks through what the ICO says a notice must cover, when to give it, and a sensible way to get one right in an afternoon.

What the ICO says you must tell people

The ICO's guidance on the right to be informed says you must provide your purposes for processing personal data, your retention periods and who the data will be shared with. It also says the information must be concise, transparent, intelligible and easily accessible, written in clear, plain language.

The ICO's detailed list of what to include is longer. For a typical small business, the items that apply every time are:

• Who you are: your organisation's name and contact details.
• Why you use the data: each separate purpose, stated clearly. "Replying to your enquiry" and "sending marketing emails" are different purposes.
• Your lawful basis: the legal reason for each purpose. If you rely on legitimate interests, you also explain what those interests are.
• Who receives it: the recipients or categories of recipients, including the suppliers who process data on your behalf. The ICO says that if you use categories, you should be as specific as possible.
• How long you keep it: a retention period, or if there is no fixed period, the criteria you use to decide.
• People's rights: the rights that apply, such as access, correction, erasure, restriction, objection and portability. The ICO says these depend on your lawful basis, so the wording must match it. The right to object must be brought to people's attention clearly and separately from other information.
• The right to complain: tell people they can complain to the ICO and give its contact details.

Some items only apply in certain situations. If you rely on consent, you must tell people they can withdraw it at any time and how, and the ICO says withdrawing must be as easy as giving consent. If you send data outside the UK, you need to say so and explain the safeguards. If you make solely automated decisions with legal or similarly significant effects, you need to explain the logic involved. If you collect data directly and providing it is required by law or contract, you say that and what happens if the person does not provide it. If you get data from another source, you must also say what categories of data you hold and where they came from, and if it was a publicly accessible source you must say so.

When to give it

The ICO is clear on timing. If you collect data directly from someone, for example through a web form, give them the privacy information at the time you collect it. If you obtain data from somewhere else, such as a bought list or a partner, you must provide it within a reasonable period and no later than one month.

In practice, that means a link to your privacy notice sits next to every form, near the checkout and in the footer of every page, not buried on a page nobody visits. The ICO also says layering, dashboards and just in time notices are often the most effective ways to deliver this information. A short line under an email sign up box that says what you will send and links to the full notice is a good example.

There are exceptions. The ICO says you do not need to provide privacy information if the person already has it, or if providing it would involve disproportionate effort, and the page says these are examples rather than a full list. For a normal website form, assume the exceptions do not apply.

Use the ICO's free generator, then check it

The ICO offers a free privacy notice generator aimed at sole traders, start ups, small and medium sized businesses and charities. It has separate versions for staff and volunteer information and for customer and supplier information, and sector versions for general business including retail and manufacturing, professional services, education and childcare, health and social care, and charities. The ICO says the staff and volunteer version was updated on 10 July 2026 and the sector versions on 7 July 2026, because it is updating its guidance following the Data (Use and Access) Act 2025.

The generator asks you questions and builds the text from your answers, which is the key difference from a copied policy. But it can only describe what you tell it. So before you answer, make a quick list of what your site really does:

• Every form on the site and where the submissions go (email inbox, CRM, booking system).
• Every third party that receives data: your email marketing tool, payment provider, analytics, live chat, booking software and hosting.
• How long you actually keep enquiries, orders and mailing list records.
• Whether any of those suppliers store data outside the UK.

If you run an online shop or ordering platform, include the order and delivery details you collect. If you are planning a new site, it helps to have the forms and notice links designed in from the start, which is part of good web design.

Common mistakes to avoid

Practitioner commentary lists similar errors. Treat it as advice from firms who sell legal services rather than as regulator guidance, but the points are sensible:

• Using a generic template without tailoring it to what you actually do.
• Choosing consent as the lawful basis when another basis fits better, which then brings the duty to let people withdraw consent.
• Not updating the notice when you add a new tool, such as a new newsletter service or a chat widget.

What to do this week

• Open your current privacy notice and compare it with your list of forms and suppliers. Anything missing is a gap.
• Run the ICO generator using the customer and supplier version, and compare its output with your existing text.
• Put a link to the notice beside each form and in the footer.
• Check that the right to complain to the ICO and the way to withdraw consent are both stated.
• Diary a review, and repeat it every time you add a new tool that touches customer data.

The ICO notes that its guidance is being reviewed because of the Data (Use and Access) Act, so check its pages before you sign off your final version. A notice that is honest, plain and matches your real practice does more for customer trust than any amount of legal language.