What a small business privacy notice needs

Personal data means information about an identified or identifiable person. It can include a name, email address, booking history or information that identifies someone when combined with other details. Business contact details can still be personal data when they identify a person.

Your business is usually the controller for information it decides how and why to use. A supplier handling it on your instructions is a processor. That distinction matters when describing responsibilities and sharing. Do not assume that outsourcing a contact form, bookings or payroll removes your own duties.

• List where information arrives, including website forms, emails, telephone calls, paper forms, shop bookings and information received from other businesses.
• Record each purpose, the information needed for it, who can access it and which suppliers handle it. Include your email, booking, payment, accounting and customer record systems.
• Find out where suppliers store information and whether it is transferred outside the UK. Check their contracts and settings rather than guessing from the company's address.
• Decide how long each type of information is needed and how you delete it. A retention promise is only useful if your systems can carry it out.
• Separate customer, employee, applicant and CCTV information where the purposes differ. Health details, children's information or sensitive records may need specialist checks before you draft anything.

Article 13 of the UK GDPR covers information you collect directly from the person. The ICO says to give privacy information when you collect it. That includes a booking or enquiry form, and information gathered by observation, such as CCTV. A footer link people might happen to find later is not enough on its own.

Article 14 covers information received from another source, such as a referral partner or a public directory. As well as the shared notice details, explain the categories of information and where it came from, including whether the source was public. Public availability does not by itself remove the obligation to inform the person.

For Article 14, the ICO says to provide the information within a reasonable period, no later than one month after obtaining the data. If you contact the person sooner, provide it by that first communication. If you disclose the data sooner, provide it by that first disclosure. Do not wait a month if an earlier trigger applies.

Both articles have exceptions. For example, you do not need to provide information the person already has. Article 14 also contains limited exceptions for situations such as impossible or disproportionate effort, with safeguards including making the information public. These are not shortcuts for a small business that finds sending notices inconvenient. Check the current article and get advice before relying on an exception.

Start with your business's identity and a working contact route. Add your representative's details and your data protection officer's contact details if those roles apply. A data protection officer is a specific role; do not give someone that title just because they answer privacy enquiries.

Articles 13 and 14 set out the information to provide. Use this checklist for each purpose, rather than describing all your processing with one vague paragraph.

• What you use the information for, such as answering enquiries, managing bookings or sending marketing. Describe different purposes separately.
• The lawful basis for each use. This means the legal ground that permits it, such as fulfilling a contract, meeting a legal obligation or legitimate interests. Consent is not the default for everything. Where you rely on legitimate interests, explain the interests pursued.
• Who receives the information, or clear categories of recipients. Include suppliers handling it on your behalf, not just businesses you sell or disclose it to.
• Any relevant transfers outside the UK. Explain the applicable adequacy arrangements or safeguards and how someone can obtain details or a copy where required. Ask for help if your supplier's transfer arrangements are unclear.
• How long you keep each type of information, or the criteria used to decide. Do not invent a universal period that ignores different purposes or legal record-keeping duties.
• For Article 13, whether providing the information is a legal or contractual requirement, or necessary to enter a contract, and what happens if the person does not provide it. Make optional fields distinguishable from genuinely required information.
• For Article 14, the categories of information obtained and its source. Name a specific source where possible, rather than referring only to third parties.
• Any automated decision-making, including profiling, that falls within the Article 22C safeguards requirement. Explain the logic meaningfully and what the decision means for the person. Get specialist advice if software makes significant decisions without a person making the decision.

Explain the relevant rights to access, correct or erase information, restrict its use, object and receive portable data. Which rights apply depends on the processing and lawful basis. Avoid promising that every request means you can immediately delete every record. Give people a usable contact route for requests.

Where you rely on consent, explain how to withdraw it. The ICO says withdrawal must be as easy as giving consent. The current articles also require information about the right to complain to your business and the right to complain to the ICO. Include both, not just a regulator's website link.

The Data (Use and Access) Act 2025 complaint changes took effect on 19 June 2026. As at 13 October 2026, they are already in force. The ICO says organisations must provide a complaints route, acknowledge complaints within 30 days and investigate, keep people informed and give an outcome without undue delay. The acknowledgement deadline is not permission to leave a complaint unanswered until then.

Make the right to object clear and separate from other information, as the ICO advises. If you use personal data for direct marketing, explain that the person can object to that use. A marketing unsubscribe route and a general privacy contact can work together, but check that both actually reach someone who can act.

Use headings that match people's questions, such as what you collect, why you use it, who receives it and how long you keep it. Explain legal terms when needed. The ICO recommends common, everyday language and short sentences. Information aimed at children needs wording they can understand.

A short explanation beside a form can link to the full notice. This is a layered notice: the first layer gives the key facts and the next gives the detail. Flag any unexpected or significant use upfront. Do not bury it several clicks into a policy.

Keep a readable notice on your website, with a direct link beside forms and in the footer. Provide suitable information for telephone, face-to-face and paper collection too. Staff and CCTV notices may need their own delivery methods. One web page does not automatically reach everyone whose information you handle.

A fictional cafe takes reservations by telephone and online. Its form gives a short explanation of how booking details are used and links to the full notice. Staff give callers the same key information and offer a way to read or receive the notice. The notice describes reservation handling separately from any mailing list.

Publishing a privacy notice and registering with the ICO are different jobs. Under the Data Protection (Charges and Information) Regulations 2018, controllers generally need to pay an annual data protection fee unless all their processing is exempt. This can include sole traders. Use the ICO's fee self-assessment for your actual activities, rather than assuming your business is too small to pay.

The ICO lists exemptions for processing limited to certain purposes, including staff administration, your own advertising and marketing, and accounts and records. Each exemption has limits. Customer service records, sensitive information or CCTV can change the assessment. The ICO says a company using CCTV for crime prevention needs to pay the annual fee.

An exemption from the fee does not remove other data protection obligations. You may still need privacy information. Paying a fee does not replace checking that your processing is lawful, secure and accurately described.

• As at 13 October 2026, the ordinary tier 1 fee is £52 a year. It generally covers a turnover of £632,000 or less, or no more than 10 staff.
• Tier 2 is £78 a year if tier 1 does not apply and turnover is £36 million or less, or there are no more than 250 staff. The ordinary tier 3 fee is £3,763.
• The ICO gives a £5 discount for direct debit. Public authorities, charities and small occupational pension schemes have special tier rules. Check the ICO's calculation guidance if one applies.
• If payment is required, register with the ICO and keep renewal and contact details current. Renew each year, or tell the ICO if registration is no longer required.

A privacy notice explains processing; it does not make every use lawful merely because someone has read it. A compulsory checkbox accepting a privacy policy is not a substitute for choosing a valid lawful basis. If a particular use needs consent, make that request specific and separate from information about how the business handles data.

Avoid statements that you never share information if an email host, booking supplier, payment service or accountant receives it. Do not claim to store everything in the UK until you have checked the suppliers. A copied policy from another business can promise settings and processes you do not have.

Treat cookies and marketing as separate checks too. A privacy notice alone does not collect valid consent for tracking that needs it, or settle the rules for promotional messages. Review those activities against the relevant ICO guidance.

Review the notice when you add a supplier, change a form, keep information longer or introduce a new use. Articles 13 and 14 generally require you to tell people about a new purpose before processing for that purpose. Updating a web page without drawing attention to a significant change may not be enough.

Keep a dated copy and check that the contact address, complaint route and linked controls work. Ask someone unfamiliar with the business to explain what they think happens to their information after reading it. If their answer differs from your actual process, rewrite the unclear part.

This is general UK information, not a finished notice or legal advice for your business. Some older ICO privacy guidance is marked as under review following the 2025 Act. The current Articles 13 and 14 include the 2026 changes. Use the legislation and current ICO guidance together, and get qualified advice for sensitive data, unusual sharing or uncertain exemptions.