UK GDPR for website owners: a plain English guide

UK GDPR is the UK's version of the General Data Protection Regulation, working alongside the Data Protection Act 2018. It applies to anyone handling personal data, which means any information that can identify a living person, either directly or when combined with other information. A name, an email address, a phone number, an IP address and an online identifier can all be personal data.

If your site has a contact form, a newsletter sign-up, an online shop, a booking system, comments, analytics or a customer login, you are processing personal data. The law does not exempt small businesses or sole traders. In data protection terms you are usually the controller, meaning you decide why and how the data is used. Your hosting company, email provider and form plugin are usually processors acting on your instructions.

The law rests on a short set of principles that translate well into daily habits. Be lawful, fair and open about what you do. Collect data only for a stated purpose, and no more than you need. Keep it accurate. Do not keep it longer than necessary. Keep it secure. And be able to show that you comply, which in practice means writing down what you decided and why.

For a form, that means asking for the minimum. If you only need an email address to answer a question, do not require a phone number, a company size and a postal address. Every extra field is data you must protect, justify and eventually delete.

Decide a retention period too. An enquiry from three years ago that went nowhere has no reason to sit in your inbox forever. A simple rule such as deleting unsuccessful enquiries after a set period, written down in your privacy notice, is far better than keeping everything by default.

A privacy notice is the page that explains your use of personal data. Link to it from the footer and from every form that collects data. It should use plain language, not legal fog. The ICO lists the information required, and it is broadly: your identity and contact details, what data you collect and why, your lawful basis, who receives it, whether it is sent outside the UK, how long you keep it, and the rights people have.

Write it for the data you actually collect. Copying a template that mentions services you do not offer is a common mistake, and a mismatch between your notice and your real practice is a risk in itself. Review it when you add a new plugin, tool or form. Our own policy is on our privacy page, which shows the kind of structure customers expect.

People have rights over their data. They can ask what you hold about them, ask for errors to be corrected, ask for deletion in certain circumstances, object to some uses, restrict processing, and in some cases receive their data in a portable form. They can also object to direct marketing, and that right is absolute, so you must stop.

A request can arrive in any form, by email, through a form or on social media, and does not need a special phrase. You generally have one month to respond, and you normally cannot charge. Decide in advance who deals with requests, how you will verify identity and where data lives, such as email folders, spreadsheets and your website database. The ICO publishes guidance on subject access requests aimed at small organisations.

The Data (Use and Access) Act 2025 also adds a duty to have a way for people to complain to you about how you handle their data. In practice that means a clear route, such as a named email address, a short acknowledgement and a record of what you decided. Say how to complain in your privacy notice, and mention that people can also complain to the ICO.