GDPR compliance for UK websites

27 August 2026

This article is practical guidance, not legal advice. For a high-risk product (health, children, large-scale profiling) speak to a solicitor.

What counts as personal data on a website

Names, emails, phone numbers, IP addresses in logs, and anything that can identify someone. A contact form is a data processing activity. So is a newsletter. So is Google Analytics if it is configured to identify users.

Lawful bases you will actually use

• Legitimate interests / steps toward a contract: answering an enquiry the person just sent you.
• Consent: optional analytics, marketing emails, non-essential cookies.
• Legal obligation: invoices and tax records.

Pages and records to have

A privacy policy that names the controller, purposes, retention, rights, and the ICO. A cookie policy if you use cookies or similar tech. A way to accept or reject non-essential cookies. A process for access and deletion requests (email is enough if you actually monitor it).

Forms and processors

Only ask for what you need. Link the privacy policy under submit. If a US email tool stores the message, you need an appropriate transfer mechanism. Hosting providers are processors — know who they are. We document this on development handovers.

Analytics without being casual

Privacy-focused analytics (Plausible, Fathom) or a tightly configured GA4 with ads features off and consent. Do not fire marketing pixels on every page “just in case”. The ICO has been clear that implied consent from a bouncing banner is not a strategy.

We include these templates in builds — see our policy as a starting pattern, then have it reviewed. Ask us to implement the technical side.