Getting a business website ready for UK GDPR and cookie consent

Almost every business website handles personal data: enquiry forms, newsletter sign-ups, online orders, live chat, analytics and advertising tags. In the UK, three sets of rules matter most: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and electronic marketing. This guide explains what they mean for a typical business website, based on guidance from the Information Commissioner's Office (ICO). It is general information, not legal advice; for advice about your organisation, use the ICO's resources or speak to a data protection professional.

Which rules apply to a UK business website?

The UK GDPR sets out the core principles, the rights people have and the duties of organisations that decide how personal data is used (controllers) and of those that handle it on their behalf (processors). The Data Protection Act 2018 sits alongside it and adds UK-specific detail, such as exemptions. PECR has its own rules for cookies and similar technologies, and for marketing by email, text and phone.

All three were amended by the Data (Use and Access) Act 2025. GOV.UK's commencement plan says most of the Act's data protection and privacy changes came into force on 5 February 2026, and the ICO has confirmed that all of the Act's data protection provisions are now in force. Under the same plan, the Information Commissioner's functions passed to a new body, the Information Commission, on 30 September 2026. The guidance this article relies on is published at ico.org.uk.

Which lawful basis do you need?

Under the UK GDPR you need a lawful basis for each purpose you use personal data for. On a business website the most common are:

• Contract: processing an order, or taking steps someone asks for before a contract, such as preparing a quote.
• Legitimate interests: for example, replying to a general enquiry or keeping the site secure, where your interests are not overridden by the person's rights. The ICO recommends recording a legitimate interests assessment.
• Consent: for example, for marketing emails or non-exempt cookies where PECR requires it. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
• Legal obligation: for example, keeping order records that tax law requires.

What should your privacy notice say?

The right to be informed means you must tell people how you use their data, in a way that is concise, transparent, intelligible and easily accessible, using clear and plain language. When you collect data directly from someone, the ICO's guidance lists the information to provide, including:

• your organisation's name and contact details, and those of your data protection officer if you have one;
• the purposes of the processing and the lawful basis for each;
• the legitimate interests you rely on, where that is the basis;
• who you share the data with;
• details of any transfers outside the UK and the safeguards used;
• how long you keep the data, or how you decide;
• people's rights, including the right to withdraw consent and to complain to the regulator;
• whether providing the data is a legal or contractual requirement, and what happens if someone does not provide it;
• any automated decision-making, including profiling.

Link the notice from every page, usually in the footer, and next to each form, with a short line saying what the details are for.

How should your forms collect personal data?

The data minimisation principle says personal data should be adequate, relevant and limited to what is necessary. In practice:

• ask only for the fields you need, and mark optional fields clearly;
• offer marketing consent as a separate, unticked option, never as a condition of sending an enquiry;
• avoid collecting special category data, such as health details, unless you genuinely need it and have a condition for processing it;
• send submissions to a secure system rather than a shared personal mailbox;
• set a retention period and delete old submissions on a schedule.

The Data (Use and Access) Act 2025 also requires organisations to help people who want to complain about how their data is used, for example with an electronic complaints form, and to acknowledge complaints within 30 days.

How do the cookie rules work?

PECR prohibits storing information on, or accessing information from, a visitor's device unless an exception applies. The rules cover cookies and similar technologies, such as tracking pixels, local storage and device fingerprinting. Where no exception applies, you need consent to the UK GDPR standard before the technology is used.

The ICO's guidance on storage and access technologies, finalised in April 2026, describes the exceptions. The ones most relevant to a business website are:

• Strictly necessary: essential to provide the service the visitor asks for, such as a shopping basket, a login or security. Necessity is judged from the visitor's point of view, and advertising never qualifies.
• Statistical purposes: the sole purpose is collecting statistical information about how your service is used, in order to improve it. The results must be aggregate, the exception does not cover tracking individuals, profiling or advertising, and any third-party provider must act as your processor.
• Appearance: adapting how the site looks or works to the visitor's preferences, such as a chosen language or display setting.

For the statistical and appearance exceptions, you must give visitors clear and comprehensive information and a simple, free way to object. Advertising cookies, cross-site tracking and most marketing pixels still need consent.

What makes a good cookie banner?

The ICO's guidance on managing consent sets clear expectations. A banner and consent tool should:

• not set any non-exempt cookies or tags before the visitor has given consent;
• make refusing as easy as accepting: if there is an "Accept all" button, offer an equally prominent "Reject all";
• leave optional categories switched off by default, with no pre-ticked boxes;
• not rely on silence, inactivity or "by continuing to browse" wording;
• explain each purpose and the third parties involved, without bundling everything into one request;
• let people withdraw consent as easily as they gave it, for example from a link in the footer, and stop and remove the technologies when they do;
• not keep asking people who have already refused.

Check the result in a private browser window, using the developer tools to see which cookies appear before you choose, after you reject and after you accept.

What about marketing emails?

PECR says you must not send marketing emails or texts to individuals without their specific consent, unless the soft opt-in applies. For products and services, the soft opt-in needs all of these: you collected the details directly from the person, during a sale or negotiation for a sale; you only market your own similar products or services; and you offered a simple way to opt out when you collected the details and in every message since. A separate soft opt-in for charitable purposes commenced on 5 February 2026. Sole traders and some partnerships are treated as individuals under these rules.

What if your website providers are outside the UK?

Hosting, email, form tools, CRMs, chat platforms and development teams are often based abroad. Under the UK GDPR, sending personal data to, or making it accessible to, a separate organisation outside the UK can be a restricted transfer. The ICO's guidance sets out three routes: adequacy regulations for the country, appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses together with a transfer risk assessment, or a limited exception. You also need a written contract with every provider that processes personal data for you.

How should you protect data and handle a breach?

The UK GDPR requires appropriate security. For a website, that usually means HTTPS on every page, individual logins with multi-factor authentication for the admin area, prompt updates to the platform and plugins, access to submissions and orders limited to the people who need it, and secure backups.

If a personal data breach is likely to result in a risk to people's rights and freedoms, you must report it to the regulator without undue delay and not later than 72 hours after becoming aware of it. If the risk to people is high, you must tell them too, without undue delay. Record every breach, including those you decide not to report.

Do you need to pay the data protection fee?

Under the Data Protection (Charges and Information) Regulations 2018, organisations and sole traders that handle personal data must pay a data protection fee unless they are exempt.

These points are easiest to handle while a website is being designed or rebuilt. Our website development in the UK and website development pages show how we work, and you can contact us to plan the privacy features of your site.

Sources

• ICO: A guide to lawful basis
• ICO: What privacy information should we provide?
• ICO: Guidance on the use of storage and access technologies
• ICO: What are the exceptions?
• ICO: How do we manage consent in practice?
• ICO: How do we comply with the PECR electronic mail marketing rules?
• ICO: International transfers
• ICO: Personal data breaches: a guide
• ICO: Data protection fee
• ICO: The Data (Use and Access) Act 2025: what does it mean for organisations?
• GOV.UK: Data (Use and Access) Act 2025: plans for commencement