Back to all answers

/ Web design

Do I need a privacy policy on my UK website?

Yes, if you collect any personal data — including a contact form or analytics. UK GDPR requires it.

/ 01

The short version

Legal pages are cheap to add and awkward to be missing.

/ 02

What actually matters

  • Privacy policy: what you collect, why, how long, who else sees it.
  • Cookie banner if you use analytics or ad pixels — with a genuine reject option.
  • Terms of service if you sell anything online.
  • Company details in the footer if you're a limited company.
  • Accessibility statement is good practice, not mandatory for most SMBs.

/ 03

The bit most people get wrong

Pre-ticked consent boxes and cookie banners with no 'reject' option are the two most common UK compliance failures on small sites.

/ 04

What to do next

Add or update your privacy policy and check your cookie banner lets people say no as easily as yes.

/ 05

Where RIOT fits in

We're a small Colchester studio helping UK SMBs get website compliance right without agency waste or freelancer flake. If you've read this far and you want a second opinion on your specific setup, book a 20-minute call and we'll tell you honestly whether it's worth doing anything at all.

We work with clients across Essex, Suffolk, London and the wider UK — and remotely with brands abroad. No lock-in, no monthly retainer minimums, no pretending your problem is bigger than it is.

/ FAQs

Common questions

Can I copy someone else's policy?

Bad idea — it won't match what you actually collect.

Do I need a cookie banner for Google Analytics?

Yes, in the UK and EU.

Still not sure?

Book a free 20-minute call — we'll answer your specific version of this question with no sales pitch.

Book a call
Ashley Scott
Studio Lead
speak to Ashley