If your website collects names, email addresses or phone numbers, even through a simple contact form, you are handling personal data. In the UK that means UK GDPR and the Data Protection Act 2018 apply. For most small business websites, getting the basics right is very achievable.
This is a practical guide, not legal advice. For anything specific to your business, speak to a legal professional or check the Information Commissioner's Office (ICO) website.
1. Know what you collect and why
List every place your website collects personal data: contact forms, quote requests, newsletter sign-ups, bookings, live chat and online orders. For each one, write down what you collect, why you need it and your lawful basis. For replying to an enquiry, that is usually legitimate interests or taking steps towards a contract. For marketing emails, it is usually consent.
2. Publish a clear privacy notice
Your privacy notice should explain, in plain language:
- Who you are and how to contact you.
- What personal data you collect and why.
- Your lawful basis for each use.
- Who you share it with, such as your hosting, email and CRM providers.
- Whether data leaves the UK and how it is protected.
- How long you keep it.
- People's rights and how to complain to the ICO.
Link to it from every form and from your website footer.
3. Make your forms honest
- Only ask for what you need. Make extra fields optional.
- Add a short line near the submit button explaining what happens to the details and linking to your privacy notice.
- Do not add enquiries to your mailing list automatically. Use a separate, unticked box for marketing.
4. Keep it secure
- Use https on every page.
- Keep your website software, plugins and themes up to date.
- Use strong, unique passwords and two-factor sign-in for your website, hosting and email.
- Store enquiries somewhere secure, not in a shared inbox that half the company can see.
5. Be ready for requests
People can ask for a copy of their data, ask you to correct it or ask you to delete it. You normally have one month to respond to a subject access request. Know where your website enquiries end up, so you can find someone's data quickly.
6. Plan for breaches
If personal data is lost, stolen or accessed without permission, you may need to report it to the ICO within 72 hours of becoming aware of it, and tell the people affected if the risk to them is high. Keep a simple record of any incidents, even small ones.
7. Pay the ICO data protection fee
Most organisations that process personal data must pay an annual data protection fee to the ICO unless they are exempt. Check the ICO's fee self-assessment to see whether it applies to you.
8. Remember cookies are a separate rule
Cookies and similar tracking are covered by PECR, which sits alongside UK GDPR. If your site uses analytics or advertising cookies, read our guide to cookie banners.
The law is changing
The Data (Use and Access) Act 2025 updates parts of UK data protection law, with changes coming into force in stages. Check the ICO's latest guidance before relying on any rule of thumb, including the ones here.
How we help
Every website we build includes a privacy notice page, honest consent wording on forms, https and secure handling of enquiries. If you are unsure whether your current site covers the basics, we are happy to take a look.