What a UK Business Needs on Its Website for UK GDPR and Cookies
A plain checklist of UK GDPR and cookie requirements for business websites in 2026: the February cookie exceptions, privacy notices, contact forms, suppliers, the new complaints duty and the ICO fee.
If your website has a contact form, takes orders or uses cookies, two sets of UK rules apply to it: UK GDPR (with the Data Protection Act 2018) for the personal data you collect, and PECR for cookies, tracking and marketing messages. Both were changed by the Data (Use and Access) Act 2025, and the changes that matter most for websites took effect in 2026: new cookie exceptions from 5 February, and a duty to handle data protection complaints from 19 June.
This guide explains what a typical UK business website needs, in plain language. We build websites; we are not lawyers. Treat it as a practical checklist and take advice on the wording of your own policies.
The short answer: a checklist
- A privacy notice that matches what your website actually collects, linked from every page and next to every form.
- Consent before non-essential cookies, such as advertising and retargeting, with rejecting as easy as accepting.
- Clear information and an easy opt-out for analytics or preference cookies you use without consent under the 2026 exceptions.
- Forms that ask only for what you need, served over HTTPS, with a separate, unticked box for marketing.
- Written contracts with suppliers who handle the data for you: hosting, email, CRM, form tools and developers.
- A way to deal with requests and complaints, including an easy way for people to complain to you directly.
- The data protection fee paid to the ICO, unless you are exempt.
The rest of this guide takes each point in turn.
Which UK laws apply to your website
| Law | What it covers on a website |
|---|---|
| UK GDPR and the Data Protection Act 2018 | Personal data: names, emails and phone numbers from forms, customer accounts, orders, and online identifiers such as IP addresses |
| Privacy and Electronic Communications Regulations (PECR) | Cookies and similar technologies (pixels, local storage, fingerprinting), and marketing emails and texts |
| Data (Use and Access) Act 2025 | Amends both: new cookie exceptions (5 February 2026), higher PECR fines, and a complaints duty for organisations (19 June 2026) |
One more change worth knowing: on 30 September 2026 the Information Commissioner’s Office became the Information Commission. It still uses the name ICO, and your obligations did not change with the name.
Cookies: what changed in February 2026
Consent is still the default. Under regulation 6 of PECR you must not store information on a visitor’s device, or read it, unless an exception applies. What changed on 5 February 2026 is the list of exceptions, now set out in Schedule A1 of PECR. Alongside “strictly necessary” storage, two exceptions matter for most business websites: statistics used to improve your site, and appearance and functionality that follows the visitor’s preferences.
| What the cookie or tag does | Consent needed? |
|---|---|
| Keeps a basket, a login session or a form working; security and fraud prevention | No: strictly necessary for the service the visitor asked for |
| Counts visits and page use, only to improve your website, with the data not shared except to make those improvements | No, if visitors get clear information and a simple, free way to object |
| Remembers a chosen language, text size or dark mode | No, if visitors get clear information and a simple, free way to object |
| Advertising, retargeting and social media pixels | Yes |
| Analytics that is also used for advertising, profiling, or by the provider for its own purposes | Yes |
The ICO’s final guidance on storage and access technologies, published on 29 April 2026, reads these exceptions narrowly. The statistics exception covers how your website is used, not who is using it. It does not cover tracking individual visitors, profiling, measuring advertising, or tracking people across other sites. If a single tool serves more than one purpose and one of those purposes is outside an exception, you need consent for it. Whether a particular analytics tool qualifies depends on how it is set up and whether the provider uses the data for its own ends. If you are unsure, ask for consent.
What a good cookie banner looks like
- Reject is as easy as accept. In 2023 the ICO warned many of the UK’s busiest websites to make “Reject all” as easy as “Accept all”. A banner that accepts in one click but hides refusal on a settings page does not meet that standard.
- Nothing non-essential runs before a choice. Advertising tags load only after consent, and no boxes are pre-ticked.
- Each purpose is explained in plain words, with the providers named.
- Visitors can change their mind later, for example from a “Cookie settings” link in the footer.
- Cookies you use under an exception are described too, with an easy way to object.
Your privacy notice
Under Article 13 of UK GDPR, when you collect personal data you must tell people, at that moment, how you will use it. On a website, that means a privacy notice linked from the footer and from every form. It should cover:
- who you are and how to contact you
- what personal data you collect, why, and your lawful basis for each purpose
- your legitimate interests, where you rely on them
- who you share data with, such as your hosting, email and CRM providers
- whether data goes outside the UK, and how it is protected
- how long you keep it
- people’s rights, including access, correction, deletion and objection, and withdrawing consent
- how to complain to you, and their right to complain to the ICO
- whether giving the data is required, and any automated decision-making
A template is a starting point, not a finished notice. The most common problem we see is a notice that does not match the website: it mentions tools the site does not use and leaves out the ones it does.
Contact forms, enquiries and marketing
- Ask only for what you need to answer the enquiry. A phone number field can be optional.
- Replying to an enquiry does not need consent. It is usually a step the person asked you to take, so a compulsory “I consent” box is not the right lawful basis. Link to your privacy notice next to the button instead.
- Marketing is different. Under PECR, marketing emails and texts to individuals need consent, unless the soft opt-in applies to existing customers. Use a separate, unticked box.
- Protect the data in transit and at rest. Use HTTPS, add spam protection, know where form entries are stored, and delete old ones you no longer need.
Suppliers, developers and data outside the UK
Your hosting company, email service, CRM, form tool and web agency may all handle personal data for you. Under Article 28 of UK GDPR, these processors need a written contract that sets out what they can do with the data. Most large providers include one in their terms; check it exists.
If personal data goes to a country without UK adequacy regulations, the transfer needs a safeguard, usually the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. This applies to agencies too. We are based in Lahore, and Pakistan has no UK adequacy regulations, so where our work gives us access to a client’s personal data, such as form entries or orders, the transfer needs that safeguard in place.
Complaints: a new duty since June 2026
Since 19 June 2026, section 164A of the Data Protection Act 2018 gives people the right to complain to you directly about how you handle their personal data. You must:
- make complaints easy to make, for example with an online form
- acknowledge each complaint within 30 days
- look into it without undue delay, keep the person informed, and tell them the outcome
On a website, this can be as simple as a short section in your privacy notice that says how to complain, with a link to your contact form or a dedicated email address.
The data protection fee
Most organisations that process personal data must pay an annual fee to the ICO unless they are exempt. Since 17 February 2025 the fee has been £52 for micro organisations, £78 for small and medium organisations and £3,763 for large ones, with £5 off when paying by Direct Debit. The ICO’s website has a short self-assessment to check whether you need to pay and which tier you are in.
What happens if you get it wrong
The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to the UK GDPR level: £17.5 million or 4% of worldwide annual turnover, whichever is higher. Large fines are rare for small businesses. The likelier costs are complaints, lost trust and the time it takes to fix a website after the fact. Getting the basics right during the build is far cheaper.
Accessibility is a separate duty
Privacy is not the only legal point for a UK website. The Equality Act 2010 requires businesses in England, Scotland and Wales to make reasonable adjustments for disabled people, and that includes services offered online. The Act names no technical standard, but WCAG 2.2 level AA is the benchmark most UK organisations build to.
How we handle this on the websites we build
On every website we build for UK businesses, we list every cookie and tag before launch, set up consent so advertising tags wait for a choice, configure analytics for the 2026 exceptions where that fits, keep forms to the fields you need with a link to your privacy notice, and build to WCAG 2.2 AA. We also give you a plain list of the tools the site uses and what each one collects, so your privacy notice can match it. The wording of your policies stays with you and your adviser.
Frequently asked questions
Do I still need a cookie banner if I only use analytics?
Possibly not. Since 5 February 2026, analytics used only to improve your website can run without consent, provided visitors get clear information and a simple, free way to object. If the tool also feeds advertising or the provider uses the data for its own purposes, you still need consent.
Does a small brochure website need a privacy notice?
Yes, if it collects any personal data. A contact form is enough. The notice can be short if the website collects little.
Does UK GDPR apply to sole traders?
Yes. UK GDPR applies to anyone processing personal data for business purposes, whatever their size. Some duties, such as the data protection fee, have exemptions, so check the ICO’s guidance for your situation.
Is the ICO still the regulator?
Yes. Since 30 September 2026 it is formally the Information Commission, but it still uses the name ICO, and its guidance, fees and powers carried over.
Sources
This guide reflects the law as of November 2026. It is general information, not legal advice.
- Legislation: PECR regulation 6, PECR Schedule A1, Data Protection Act 2018, section 164A, UK GDPR Article 13, UK GDPR Article 28
- ICO: guidance on storage and access technologies: the exceptions, governance changes on 30 September 2026
- Commentary: Osborne Clarke on the final cookie guidance, Stevens & Bolton on the cookie changes and fines, The Record on the ICO’s “Reject all” warning, Lewis Silkin on the 2025 fee increase
Keep reading
Let's build something exceptional.
Have a website, CMS or CRM project in mind? Let's discuss it and turn your vision into a practical solution.