Yes. The ICO says that if your business holds personal data, even just customers' names and email addresses, you need a privacy notice. If customers mainly find you through your website, it should be on your website. It must say who you are and how to contact you, why you use people's data and on what lawful basis, who you share it with, how long you keep it, what rights people have, and that they can complain to you and to the ICO. Most small businesses can write one free with the ICO's privacy notice generator.
Last updated 2 November 2026. Checked against the ICO's own pages on ico.org.uk.
Not legal advice. This is a plain-English summary of the ICO's own published guidance, checked on 2 November 2026. For advice about your situation, speak to a solicitor or call the ICO's helpline on 0303 123 1113.
DataSorted is not affiliated with the ICO. DataSorted is a waitlist and demand test only: no product is live and no payment is taken.
Almost certainly. The ICO says there are very few situations where privacy information isn't needed. A privacy notice is also called a privacy policy or privacy information. It tells people what you do with their details before they hand them over.
No website? You still need to tell people. The ICO suggests printed copies, a link in your emails, or simply telling people when you take their details.
Under the Data (Use and Access) Act 2025, you must give people a way to make data protection complaints to you, acknowledge each complaint within 30 days, and tell them the outcome without undue delay. The ICO says you must tell people they can complain to you, as well as to the ICO, when you collect their information, for example in your privacy notice.
Make it easy to find before people hand over their details. The ICO's examples: a link on your website's contact form page, a link in your email signature, the web address on your voicemail, or printed copies. Review it regularly and tell people about any changes.
If your website uses cookies, visitors need to be told what they are and what they do. For cookies that aren't strictly necessary (for example most analytics and advertising cookies), you need the visitor's agreement first.
The ICO says some of its guidance is under review after the Data (Use and Access) Act 2025. It updated its privacy notice generator in July 2026 to reflect the Act.
Yes, if you hold personal data such as customers' names, phone numbers or email addresses. The ICO says every business, however small, needs a privacy notice when it uses people's data.
You still need to tell people how you use their data. The ICO suggests printed copies, a link in your emails, or explaining it when you take someone's details.
Not usually. The ICO says most small businesses, sole traders and small charities can make their own privacy notice free with its privacy notice generator.
Who you are and how to contact you, why you use the data and your lawful basis, how long you keep it, people's rights, and that they can complain. Add who you share it with, transfers outside the UK and the right to withdraw consent where they apply.
No. It is a plain-English summary of the ICO's guidance, checked on 2 November 2026. DataSorted is a waitlist test only and is not affiliated with the ICO.
Everything above is taken from these ICO pages, checked on 2 November 2026. If anything here differs from the ICO, the ICO is right.
DataSorted is a planned phone-friendly helper for UK tradespeople and small businesses. It is not built yet. If you'd like to hear if it launches, join the free waitlist. It is free, nothing is charged, and you can ask to be removed at any time. Everything on this page can also be done for free using the ICO's own tools.