A customer enters an email address at checkout. A job applicant uploads a CV. A visitor submits a contact form. Each exchange gives a UK business personal data, and the person providing it deserves to know what happens next. That explanation is the purpose of a privacy notice.
Privacy notice requirements for UK businesses come mainly from the transparency provisions of the UK General Data Protection Regulation (UK GDPR). The aim is not to publish impressive legal wording. It is to explain real data practices in language people can understand, when they need the information.
Which businesses need a privacy notice?
Most businesses that handle identifiable information about customers, employees, applicants, suppliers or website visitors need to provide privacy information. This applies to small companies and sole traders as well as large organisations. Names, contact details, IP addresses and information about identifiable staff can all be personal data.
A privacy policy business page is a common way to share the information, but a page sitting unnoticed in a website footer is not always enough. People must be actively directed to the relevant notice. Internal staff processing and recruitment may also require notices tailored to those audiences.
What must a UK privacy notice include?
Articles 13 and 14 of the UK GDPR set out the core transparency requirements. The details vary with the activity and how the business obtained the information. A useful notice should answer the following questions without making readers decode legal terminology.
Who is responsible, and why is the data used?
State the legal identity and contact details of the organisation responsible for processing. Include the data protection officer’s contact details or a UK representative’s details where applicable. Describe distinct purposes, such as fulfilling orders, answering enquiries, running payroll or sending promotional messages.
For each purpose, identify the lawful basis relied upon. That might be performance of a contract, compliance with a legal obligation, consent or legitimate interests, depending on the facts. Where ordinary legitimate interests apply, identify those interests. A privacy notice does not create a lawful basis, and displaying one is not the same as obtaining valid consent.
What information is involved, and where did it come from?
Explain the types of personal data used, particularly where this helps people understand the activity. If information came from another organisation, a public register or another third-party source, describe the categories collected and identify the source, including whether it was publicly accessible.
Where providing information is legally or contractually required, explain what is compulsory and the consequences of refusing.
Who receives it, and does it leave the UK?
Identify recipients or meaningful categories of recipients, such as payment processors, payroll providers, couriers or hosting companies. If personal data is transferred internationally, explain the relevant transfer arrangements and safeguards, where applicable, and how people can obtain further details. Avoid claiming that every supplier keeps information in the UK unless that has been verified.
How long is it kept, and what choices do people have?
Give retention periods or understandable criteria for determining them. Vague statements such as “we retain information as long as necessary” are rarely helpful without context. A business might explain that different records are held for different periods because of tax, contractual or dispute-resolution needs.
Describe the relevant rights, including access, correction, erasure, restriction, objection and data portability where applicable. Explain how to exercise them, how consent can be withdrawn when consent is used, and the right to complain to the Information Commissioner’s Office (ICO). The right to object must be clearly brought to attention. Relevant significant automated decisions and their effects also require explanation where applicable.
When should privacy information be provided?
If someone gives the business personal data directly, the information must generally be provided when the data is collected. Place a clear notice beside an enquiry, order or job application form rather than expecting the person to hunt through the site.
When the business obtains personal data from elsewhere, it must generally inform the person within a reasonable period and no later than one month. If it contacts the person or discloses their information sooner, the notice is due by the first contact or disclosure, subject to the one-month limit. Limited legal exceptions exist; they are not a general excuse to avoid informing people.
A layered approach works well: provide a short explanation at the collection point and direct readers to a fuller privacy notice UK page.
A practical example: an online retailer
Imagine a small UK shop collecting delivery addresses, payment-related details and email addresses. Beside the checkout fields, it explains that information is used to process and deliver orders and directs customers to the full notice. That notice describes the payment provider, courier, retention criteria and rights.
Now suppose the shop also wants to send promotional emails. It should explain marketing separately, identify the relevant lawful basis and comply with electronic marketing rules under PECR, including consent requirements or any applicable soft opt-in. A sentence about marketing hidden in the checkout notice cannot substitute for meeting those rules.
This shows why a data-flow review beats copying another retailer’s notice. Related guidance might cover email marketing consent rules for UK businesses.
Keeping the notice accurate as operations change
Review the notice when adding new software, data sources, analytics, recruitment systems or purposes. Tell affected individuals about a new purpose before starting that processing, unless a relevant exception applies. Make sure the published explanation matches supplier contracts and actual retention practices.
The Data (Use and Access) Act 2025 introduced changes that came into force in stages through June 2026. These include updated requirements for handling data protection complaints and particular exceptions connected with research-related reuse. Businesses should check current ICO guidance instead of assuming an old template covers every situation. A data retention policy checklist can help keep published promises realistic.
Frequently asked questions
Is a privacy notice legally required for a small UK business?
Usually, yes, if it controls and processes personal data. There is no blanket exemption merely because an organisation is small, and the exact information required depends on its activities.
Is a privacy notice the same as a privacy policy?
Businesses often use the terms interchangeably. What matters is whether the document actually gives people the privacy information required by law, in a clear and accessible way.
Can one notice cover customers and employees?
It can, if each audience can easily find all relevant information. Separate customer, recruitment and employee notices are often clearer because the purposes, lawful bases and retention practices differ.
Does publishing a privacy notice mean customers have consented?
No. Transparency and consent are different obligations. Where consent is the appropriate lawful basis, it must meet its own requirements; other processing may rely on a different lawful basis.
Make transparency part of the customer experience
A strong personal data notice tells people what they would reasonably want to know, before anything surprising happens to their information. Start with an accurate record of what the business collects, explain each purpose and put the right explanation at the right touchpoint. That approach makes compliance more practical and the business easier to trust.