What is a privacy policy for a website?

A privacy policy for a website tells your visitors what personal data you collect from them and why. It also says who you share that data with, how long you keep it and what rights people have over it. In the UK it's also called a privacy notice, which is the term the ICO uses. The ICO is the regulator that oversees data protection. Both names mean the same document.

Does every website need a privacy policy?

Yes, if it collects personal data, and almost every website does. The ICO's advice for small businesses is clear: if you keep people's details, such as a name and an email address, you need a privacy notice. If your website is mainly how customers find you, the ICO says the notice belongs on your website.

Personal data is any information that can identify a person, directly or indirectly, such as a name or an email address. Online identifiers such as IP addresses and cookie identifiers are part of the UK GDPR definition too. So even a site without a single form needs a privacy policy, because its analytics or advertising tools can still collect personal data.

Is a privacy policy the same as GDPR?

No. GDPR is the law, and a privacy policy is one of the things it asks of you. In the UK, the rules are UK GDPR and the Data Protection Act 2018, and the ICO oversees them. UK GDPR gives people the right to be informed about how you collect and use their personal data. Your privacy policy is how you meet that right.

A privacy policy on its own doesn't make you compliant, though. You also need to handle people's data the way your policy says you do.

What is the purpose of a privacy policy?

A privacy policy tells people what will happen to their data before they hand it over. That's a legal duty, but it's also good for business. The ICO points out that a privacy notice reassures people you've thought about how to keep their data safe. It also helps you build trust with your customers.

The ICO warns that failing to tell people properly about the use of their data can leave you open to fines and damage your reputation.

What to include in your privacy policy

The ICO sets out what a privacy notice has to say. For a small business website, it usually comes down to these parts:

• Who you are: your business name and how people can contact you about their data, for example an email address.
• What data you collect: the kinds of personal data you hold, and where you got it if it didn't come from the person.
• Why you use it: each purpose, such as processing orders, answering enquiries or sending a newsletter. Give the lawful basis you rely on for each one, such as consent or a contract.
• Who you share it with: the companies that handle data for you, such as your payment provider, your email marketing service or your analytics tool, and anyone you have to share it with by law.
• How long you keep it: how long you hold each kind of data before you delete it.
• People's rights: for example the right to see, correct or delete their data and to object, and how people can use those rights. Where consent is your basis, say that people can withdraw it at any time.
• How to complain: that people can complain to the ICO, with its contact details.

Write the policy for your visitors, not for a lawyer. The ICO asks for privacy information that's concise, transparent and in clear and plain language, so short sections with plain headings work better than legal wording.

The personal data your website collects

Be as specific as you can about what you collect and where on your site you collect it. On most websites, that's some of the following:

• Names and email addresses that people give you in a contact form, a newsletter sign-up or a customer account.
• The billing address and payment details someone enters at your checkout.
• IP addresses and cookie identifiers, which relate to the device someone uses to visit your site.
• The pages people view, as recorded by your analytics tools.
• What the cookies on your site store for site functions, analytics or advertising.
• Sensitive details, such as someone's health, which the law treats as special category data with stricter rules. If you collect them, say so clearly and explain why you need them.

Privacy policy and cookie policy: do you need both?

Not necessarily. You have to tell visitors which cookies your site uses and what they do. That can be a section of your privacy policy or a separate cookie policy that it links to. For a small site with a handful of cookies, a section in your privacy policy is usually enough. A separate cookie policy is handy when your site uses a lot of cookies, because you can update the list without touching the rest.

If a cookie isn't strictly necessary for your website to run, the ICO says you also need the visitor's consent. That's what a cookie banner asks for. Analytics cookies can be an exception. Under the ICO's statistical purposes exception, you don't need consent for analytics that only produce statistics to improve your own site. The conditions are strict. You give visitors clear and full information about the purpose of your analytics, for example in your privacy policy. Visitors get a simple and free way to object, such as a switch in your cookie banner. You also never use the data to track people or for advertising. If an outside provider such as Google runs your analytics, it may only use the data for you. If you're not sure your analytics meet these conditions, we recommend asking for consent.

Can you write your own privacy policy?

Yes, most small organisations can write their own and don't need a lawyer to do it. The ICO's free privacy notice generator is meant for small and medium-sized organisations. That includes small businesses, sole traders and small charities. It builds a privacy notice for your business, and the ICO says it takes less than 15 minutes. If you handle sensitive data, such as health information, we recommend getting legal advice as well.

Before you open the generator, list the personal data each form and tool on your site collects, and what you use it for. Then work out your lawful basis for each purpose, because the ICO expects you to decide it before you start using people's data.

A lawful basis is the legal reason you rely on to use someone's data. UK GDPR has seven, and the ICO's guide to lawful basis explains each one. A contract is your basis when you need the data for a contract with someone, such as the address to deliver an order. It also covers steps they asked you to take first, such as sending them a quote. Consent is the usual basis for a newsletter people choose to sign up to.

The generator suits a simple site with a contact form and a newsletter. If your site uses many cookies and third-party tools, or you run an online shop, a tool that updates your policies for you saves work. Termly, which you can add to your website with us, scans your site for cookies. It generates a privacy policy, a cookie policy and a cookie banner, and keeps them up to date automatically. Termly saves you writing the policies, but you still need to check that what they say matches how you use people's data.

Let Termly scan your website and keep your privacy policy, cookie policy and cookie banner in step with it as it changes.

Where to put your privacy policy and how to keep it up to date

Put a link to your privacy policy in your website's footer, so it's easy to find wherever visitors are on your site. Also link to it next to every form where people enter their details, such as your contact form and newsletter sign-up. That way they can read it before they hand anything over. The ICO asks you to give people privacy information when you collect their data and to keep it easy to find afterwards.

Review your policy regularly. Review it again whenever you start using data in a new way, for example when you add an analytics tool or a new payment provider. If you plan a new use of people's data, the ICO says you must tell them before you start. Put the date of the last update at the top of the policy and change it each time you update it. Returning visitors can then see whether anything has changed.

Once your policy is live, that review is the part that's easy to forget, especially as you add new tools and cookies to your site. If your site changes often, you can set up Termly to rescan your site and update your policies and cookie banner for you.