Privacy Policy UK: Website Privacy Notice and Cookie Policy Template

Lawyers call it a privacy notice; most website owners call it a privacy policy. Both names describe a public statement giving individuals the information listed in Articles 13 and 14 of the UK GDPR when their data is collected. It is not a contract. Nobody signs it, and a tick box saying "I accept the privacy policy" adds nothing legally. Its job is transparency, and the regulator judges it on a simple test: can a visitor understand, in plain English, what happens to their name, email address, IP address or order history?

A privacy policy UK law expects is also different from your terms and conditions. The terms govern the sale; the notice explains the data processing behind it, and the terms simply point to it. The cookie policy is the third piece. It explains the files and tags your site places on a visitor's device, which fall under PECR rather than the UK GDPR alone.

Keeping the three topics in one document has a practical benefit. The classic contradiction is an old privacy page, a cookie banner configured later by a developer, and a newsletter tool that neither mentions. A single notice built from the same answers keeps purposes, cookies and retention periods aligned, with one dated version to update.

The core duty sits in Article 13 of the UK GDPR. When you collect data directly from someone, you must give your identity and contact details, the purposes and lawful basis of each processing operation, the legitimate interests relied on, the recipients, any transfer outside the United Kingdom, the retention period and the person's rights. Article 14 adds the source of data obtained from others, such as a payment provider's fraud check. The full list is in Article 13 of the UK GDPR on information to be given to individuals, and the template covers every item.

Most of the 2025 reforms took effect on 5 February 2026. Article 6(1)(ea) and Annex 1 set out recognised legitimate interests that need no balancing test: disclosures requested for public tasks, national security and defence, emergencies, crime, and safeguarding vulnerable people. Articles 22A to 22D allow solely automated decisions, with safeguards. Article 12A sets the one-month response period and its extensions. Schedule A1 to PECR lets you set cookies used only to produce statistics that improve your own site, or only to adapt its appearance and functions, without consent, provided visitors are told and can object simply and free of charge. Those statistics may be shared only with a provider helping you make the improvements.

Two later changes matter just as much. From 19 June 2026, section 164A of the Data Protection Act 2018 lets people complain to the business directly, with an acknowledgement due within 30 days. On 30 September 2026 the Information Commissioner was replaced by the Information Commission. A notice that still names the Information Commissioner, or omits the right to complain to the business itself, is out of date. Email marketing remains governed by regulation 22 of PECR: consent, or the soft opt-in for existing customers.

Almost every business website needs a UK privacy policy, even a brochure site, because the server logs IP addresses and the contact form captures names and emails. The clearest case is an online shop: orders, payments, deliveries and returns all involve personal data, and online shop terms and conditions for consumer sales refer customers to your privacy notice for exactly that reason. Consultants and service businesses need one as soon as an enquiry or quote form goes live.

A newsletter is another trigger. Once you collect email addresses for marketing, the notice has to explain consent, the soft opt-in if you use it, unsubscribing and the suppression list. Adding Google Analytics, a Meta Pixel or embedded YouTube videos brings in the cookie rules, and the cookie policy must then match what your banner actually does.

Two edge cases come up often. A careers page that accepts CVs makes you a controller of candidate data, sometimes including health information for reasonable adjustments, which needs its own condition and a policy document. And a business that switches tools, say to a new live chat widget, often gains a new processor and a new transfer abroad, so the notice must change before the tool goes live.

The notice opens with the identity of the controller, built from your answers for a limited company, an LLP, a sole trader or a partnership. Contact details for privacy requests follow, with your registration number with the Information Commission if you pay the fee, and either your data protection officer's details or a short statement that the law does not require one. Section 3 covers website visits and each activity you tick (orders, accounts, enquiries, newsletters, job applications, live chat, reviews and age checks) with the data, purpose and lawful basis for each, so the notice never describes processing your site does not carry out.

Next comes the part copied notices most often get wrong: data received from third parties, each lawful basis including recognised legitimate interests, recipients by category, transfers under Articles 45A and 46, and retention periods tied to real obligations such as the six-year accounting rule. Staff data is deliberately left out. Employees need their own privacy notice, and an employee handbook with workplace data protection policies sets the rules staff follow when they handle customer data.

Rights fill the following sections: access with a reasonable and proportionate search, erasure, portability, the separately presented right to object, automated decisions, the one-month deadline and the two complaint routes. The cookie policy then sets out the categories used, consent or exemption for analytics and functionality cookies, a table of up to eight named cookies and how to change choices. A short clause on future changes closes the document.

You start with the website name, its address and the date of the version, then say who runs the site. The form switches between company, LLP, sole trader and partnership and asks only for the identification that structure needs; if you are still setting the business up, the business templates for UK companies and sole traders cover the earlier paperwork.

Next come the privacy contact address, the data protection fee, the data protection officer and any online complaint form. The key screen is the list of activities: tick only what your website really does. Each tick adds the matching paragraph, recipients and retention period, and an unticked box removes every reference to it, so a blog with a newsletter never ends up describing deliveries.

The marketing screen asks about the soft opt-in and email tracking. The cookie screens ask which categories you use, whether analytics and functionality cookies rely on consent or on the new exceptions, and how visitors reopen your cookie settings. You then fill in the cookie table, one cookie per screen, using the names a cookie scanner shows. The preview updates as you go.

The most frequent error is copying a UK privacy policy from another website. It lists tools you do not use, misses the ones you do, and often still names the old regulator or quotes the EU GDPR as if it applied. Cookie policies that contradict the banner come a close second, claiming analytics run only with consent while the script fires on page load. Under Schedule A1, analytics can run without consent only for statistics that improve your own site, shared with no one beyond the provider helping you. If that provider reuses the data for its own advertising, the exception does not apply and consent is required.

Vague retention is another weak spot: "as long as necessary" tells the reader nothing, and stated periods must match what your systems delete. Processors are the blind spot. Your developer, hosting company and email platform handle data for you and need a written contract with data protection terms; a UK contractor agreement for freelancers sets the working terms, and those data processing terms sit alongside it. Timing matters too: link the notice from every form, not just the footer, so people see it when their data is collected. If a prospective partner wants to see your customer list, sign a mutual or one-way NDA first and check that the disclosure itself has a lawful basis, because confidentiality does not replace data protection terms.