What the regulators actually say
This guide summarises official guidance read on 30 October 2026. It is not legal advice; for a business with real risk, ask a qualified lawyer in your jurisdiction.
UK: the ICO's guidance on the right to be informed lists the information you must provide when you collect personal data directly from people, marking each item "Always" or "If applicable". The ICO's small-business guide calls this a privacy notice ("sometimes known as a privacy policy") and offers a privacy notice generator. It also notes that, because of the Data (Use and Access) Act, the guidance "is under review and may be subject to change". [1][2]
EU: Article 13 of the GDPR sets out the information a controller must give when collecting personal data from the person, including identity and contact details, purposes and legal basis, recipients, retention period and rights. [5]
US: the FTC's privacy and security guidance says that if a company makes privacy promises, "the FTC Act requires you to live up to those claims" (a line from its health privacy section), and its consumer privacy guidance tells businesses to reread their privacy policy to make sure they honour it. The FTC also notes that COPPA applies to websites for kids and "may apply to sites aimed at general audiences". [6][7][9]
Which site features trigger a privacy notice
A purely static page with no forms, no cookies beyond what is strictly necessary and no analytics collects very little. Even then, your host may log visits, so check what your builder records before deciding you have nothing to disclose.
| Feature | What it collects | What to say in the notice |
|---|---|---|
| Contact form | Name, email, message | Purpose (replying), where submissions go (for example your email provider or form tool), how long you keep them |
| Newsletter signup | Email address, sometimes name | Purpose, lawful basis (often consent), the list provider as a recipient, how to unsubscribe and withdraw consent |
| Store checkout | Name, address, payment and order data | Order fulfilment purpose, payment and shipping recipients, retention for records |
| Analytics and other non-essential cookies | Device identifiers and browsing behaviour | What the cookies do and why; under UK PECR guidance, consent before setting non-essential cookies |
| Embedded third-party services | Depends on the service | Name the provider as a recipient and any transfers outside the UK or EU |
Cookies and analytics: the consent question
The ICO's PECR guidance says you must tell people about cookies, explain what they do and why, and get consent that is "actively and clearly given" through "some form of unambiguous positive action". Continuing to browse is not enough, and you cannot set non-essential cookies on the homepage before the visitor consents. [3]
The exemption covers cookies "strictly necessary" to provide a service the user asked for, such as a shopping basket or session security. Cookies that are only helpful or convenient still need consent, and the guidance says cookies essential only for your own purposes also need consent. The ICO's small-business cookie page says this guidance is under review after the Data (Use and Access) Act, so recheck it before relying on any analytics exemption. [3][4]
One way to reduce the cookie question is to use analytics that does not set cookies. Our small-site analytics guide compares options; the privacy notice should still describe whatever is collected.
Checklist: what the notice should cover
Based on the ICO's list and GDPR Article 13. Items marked "if applicable" can be left out when they do not apply to you. [2][5]
| Item | ICO marking | Small-site example |
|---|---|---|
| Your name and contact details | Always | Business name and a real contact email |
| Purposes of processing | Always | Reply to enquiries; send the newsletter you signed up for |
| Lawful basis | Always | Consent for the newsletter; legitimate interests or contract for enquiries |
| Legitimate interests pursued | If applicable | Only if you rely on legitimate interests |
| Recipients | If applicable | Form tool, email list provider, payment processor |
| Transfers outside the UK or EU | If applicable | If a provider stores data abroad |
| Retention period or criteria | Always | Delete enquiries after a set period; keep subscribers until they unsubscribe |
| Individual rights | Always | Access, correction, erasure and objection, as they apply to your lawful basis |
| Right to withdraw consent | If applicable | Unsubscribe link and contact address |
| Right to complain to a regulator | Always | The ICO for UK-based organisations |
| Statutory or contractual requirement | If applicable | Whether people must give the data and what happens if not |
| Automated decision-making or profiling | If applicable | Usually not applicable to a small brochure site |
Collect less, promise only what you do
- The FTC's guide for business starts with "Take stock" and "Scale down": know what personal information you hold and keep only what you need. [8]
- It goes further: if you do not have a legitimate business need for sensitive personally identifying information, "don't even collect it". [8]
- Keep data "only as long as it's necessary", then dispose of it properly ("Pitch it"). [8]
- Write the notice from what your site actually does. A copied policy that promises things you do not do is the problem the FTC warns about. [6][7]
- Use plain language; the ICO says it is important to be open and use simple language so people know where they stand. [1]
Where to put it on a builder site
Publish the notice as its own page and link it from the footer and next to every form or signup box, so people see it when their data is collected. GDPR Article 13 says the information is to be provided "at the time when personal data are obtained". [5]
Builders differ in how much they help. Shopify, for example, lists policy links in the checkout footer by default, suggests adding them to store menus or the footer, offers templates, and has automated privacy settings that update the policy when certain settings change. Shopify also states its templates are for informational purposes only, are not legal advice and do not guarantee compliance, and that you are responsible for the accuracy of your policies. [10]
On simpler builders, create a plain page or section with the notice and link it from each form. Review it whenever you add a form, a newsletter tool or analytics.
Questions before you decide
Do I need a privacy policy if my site only has a contact form?
Under UK and EU rules a contact form collects personal data, so the ICO and GDPR Article 13 expect you to tell people who you are, why you use their data, the lawful basis, who receives it, how long you keep it and their rights. This is not legal advice.
Do analytics cookies need consent in the UK?
The ICO's PECR guidance says only cookies strictly necessary for a service the user requested are exempt, and that cookies essential only for your own purposes still need consent. The ICO says its guidance is under review after the Data (Use and Access) Act, so check the current version.
Can I use a template or generator?
Yes, as a starting point. The ICO offers a privacy notice generator for small organisations, and Shopify offers templates, but Shopify says its templates are not legal advice and you remain responsible for accuracy.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- ICO: how to write a privacy notice and what goes in it Accessed 30 Oct 2026
- ICO: what privacy information should we provide? Accessed 30 Oct 2026
- ICO: cookies and similar technologies (PECR) Accessed 30 Oct 2026
- ICO: cookies and privacy notices in detail Accessed 30 Oct 2026
- GDPR Article 13 text (Regulation (EU) 2016/679, gdpr-info.eu) Accessed 30 Oct 2026
- FTC: privacy and security business guidance Accessed 30 Oct 2026
- FTC: consumer privacy Accessed 30 Oct 2026
- FTC: protecting personal information, a guide for business Accessed 30 Oct 2026
- FTC: children's privacy Accessed 30 Oct 2026
- Shopify help: refund, privacy and terms of service policies Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.