Topic hub

Legal and Compliance for UK Websites

4 published guides0 subtopicsUpdated 21 July 2026

Start here

The main guide for this topic

Website Cookie Consent Requirements

A cookie banner is only the visible part of cookie compliance. The business first needs to know which technologies store information on, or access information from, a visitor's device, why they do it …

Open the complete guide →

Published guides

Articles in this section

Practical guide29 September 2026

Website Cookie Consent Requirements

A cookie banner is only the visible part of cookie compliance. The business first needs to know which technologies store informati…

Read guide →

Practical guide26 September 2026

Legal Requirements for UK Business Websites

A UK business website should identify the trader clearly, describe offers honestly and provide the information required by the act…

Read guide →

Practical guide22 September 2026

GDPR Basics for Small-Business Websites

A small-business website uses personal data whenever it can identify a person directly or indirectly. Contact forms, booking detai…

Read guide →

Practical guide19 September 2026

Consumer Rights and Your Website

A website that sells goods, services or digital content to consumers forms part of the sales process. Product descriptions, prices…

Read guide →

About this section

A UK business website may be affected by company disclosure rules, data protection law, privacy and electronic communications rules, consumer law, accessibility duties, intellectual property and sector-specific regulation. The exact obligations depend on what the business is, where it operates, what the website collects and whether it sells goods, services or digital content.

This section provides a practical starting point for small businesses. It is not a substitute for legal advice. Use the guides to identify the areas that need action, then check current official guidance or obtain professional advice where the consequences are significant.

Information checked: 21 July 2026. UK data and privacy rules changed under the Data (Use and Access) Act 2025, including new cookie exceptions and a data protection complaints requirement that came into force on 19 June 2026. Older template articles may therefore be incomplete.

Choose the guide that matches the risk

Main compliance areas for a small-business website
Area	Read first	Typical trigger
Business identity and website information	Legal Requirements for UK Business Websites	The site promotes or operates a business
Personal data and privacy notices	GDPR Basics for Small-Business Websites	Forms, customer accounts, analytics, email lists or staff data
Cookies and similar technologies	Website Cookie Consent Requirements	Analytics, advertising, embedded media or device storage
Online sales	Consumer Rights and Your Website	Goods, services or digital content sold at a distance
Accessibility	Website Accessibility Basics and relevant sector guidance	Providing goods, services, employment or public-sector information
Sector rules	Relevant regulator or professional adviser	Financial, health, legal, gambling, age-restricted or regulated activity

Start with what the website actually does

Make a data and transaction inventory. Record:

every form and the information it collects;
analytics, advertising and embedded services;
customer accounts, bookings, payments and subscriptions;
email marketing and remarketing;
third parties receiving information;
where data is stored and for how long;
which countries suppliers process data in;
goods, services or digital content sold online;
any regulated or age-restricted activity.

Policies must describe this real operation. Copying another website's privacy or cookie text can create inaccurate statements and does not configure the underlying technology.

Business identity and contact information

Businesses trading online generally need to make identifying and contact information easy to find. Companies and limited liability partnerships also have specific disclosure requirements. Online sellers must provide additional information before a consumer places an order.

The legal form of the business matters. A sole trader, partnership and limited company should not all use the same footer wording.

Privacy notices and data handling

A privacy notice should explain, in clear language, what personal information is used, why, the lawful basis, retention, sharing, rights and how to complain. It should be available when the information is collected, not hidden after submission.

From 19 June 2026, organisations must provide a clear way for people to make data protection complaints, acknowledge complaints within 30 days, investigate them appropriately and communicate the outcome. The process should be reflected in internal responsibility and public contact information.

The website must identify storage and access technologies before deciding which need consent. Some technologies are strictly necessary. The Data (Use and Access) Act 2025 introduced additional exceptions for limited-risk purposes, including certain statistical measurement and functionality uses, subject to conditions. Advertising and many cross-site tracking technologies still require careful consent handling.

A banner that accepts everything by default, places non-essential technologies before a decision or provides no equivalent refusal route is not a safe substitute for analysis.

Consumer-facing websites need transaction-specific information

Before an online order, consumers generally need clear information about the trader, product or service, total price, delivery, cancellation, contract length and complaint arrangements. The precise rights differ for goods, services and digital content, and exceptions apply.

Terms should match the actual checkout and fulfilment process. A generic terms page cannot correct hidden charges, misleading availability or an unclear cancellation route.

Accessibility is broader than a technical score

Public-sector websites have specific accessibility regulations. Businesses providing goods and services also need to consider duties under the Equality Act 2010, while Northern Ireland has separate legislation. An automated scan can identify some issues, but keyboard use, readable content, labels, focus, error handling and real user tasks still require human testing.

Keep a compliance record

Record who owns each policy and when it was checked.
Keep a list of processors and relevant contracts.
Document cookie classification and consent settings.
Retain evidence of how marketing permission is obtained.
Define how access requests, deletion requests, complaints and breaches are handled.
Review checkout information and terms when the offer changes.
Recheck policies when tools, suppliers or tracking change.

Primary sources

The next practical step is to complete a one-page inventory of data collection, tracking, online sales and regulated activity before writing or updating any policy.