Does your UK website need a privacy policy and a cookie banner?

Two different sets of rules are at work here, which is why the advice you find online contradicts itself. UK GDPR and the Data Protection Act cover personal data - anything that identifies a person. The Privacy and Electronic Communications Regulations, usually shortened to PECR, cover cookies and marketing messages. A privacy policy answers the first. A cookie banner answers the second.

The privacy policy

If your website collects anything that identifies a person, you need one. That is a lower bar than most people assume - a contact form, an email signup, a booking enquiry, an online order, and in most configurations analytics as well.

A usable policy answers, in plain terms:

• Who you are, and how to contact you about data.
• What you collect, and how - the form, the analytics, the booking system.
• Why you collect it, and what allows you to. Answering an enquiry someone sent you is a different basis from adding them to a mailing list.
• Who else sees it. Be specific: your email provider, your booking software, your payment processor.
• How long you keep it.
• What rights people have - to see their data, correct it, or have it deleted - and how to exercise them.

Write it as something a customer could actually read. A copied policy full of clauses that do not describe your business is not protection; it is a document that says you did not think about it.

The cookie banner

Cookies split into two kinds, and only one of them needs asking about. Essential cookies - the ones that keep someone logged in or hold a basket together - are exempt. Everything else, including analytics and anything advertising-related, needs consent before it is set.

The word "before" is where most banners fail. Four common mistakes:

1. Loading analytics before anybody clicks

   A banner that appears while the tracking has already fired is decoration. The scripts must not run until consent is given - which is a build decision, not a wording one.

2. Only offering "Accept"

   Refusing has to be as easy as agreeing. A banner with one button, or with "Accept" prominent and "Manage settings" hidden three clicks away, does not gather valid consent.

3. Pre-ticked boxes

   Consent has to be an active choice. Anything pre-selected is not consent.

4. No way to change your mind

   Somebody who accepted should be able to withdraw it later, as easily as they gave it - usually a link in the footer.

For what it is worth, this site does it the way described: nothing optional loads until a choice is made, refusing takes one click in the same place as accepting, and the choice can be changed from the footer at any time. It is not hard to do properly - it is just easier to do badly, which is why so many are.

The bit most people miss: the ICO fee

Separately from anything on your website, most UK organisations that process personal data must pay an annual data protection fee to the Information Commissioner's Office and appear on its public register. It is a modest amount for a small business, tiered by size, and there are exemptions - but the exemptions are narrower than people hope, and running a website with a contact form usually does not qualify for one.

The ICO has a short self-assessment on its own site that tells you whether you need to pay and how much. Check the figure there rather than anywhere else, including here: it changes, and a fee quoted in an article is exactly the kind of number that goes stale.

What else belongs on a UK business site

• If you are a limited company: your registered company name, company number, and registered office address. This is a legal requirement, not a nicety, and it is missing from a great many small business sites.
• A terms page, if you sell anything or take bookings - what you are agreeing to, and what happens if something goes wrong.
• If you sell online to consumers: cancellation and refund rights, which are set by law rather than by your preference.

None of this is exciting, and none of it wins you a customer. What it does is remove the reason a careful person would hesitate - and for a business asking a stranger to spend real money, that is worth an afternoon.