Short answer
A UK business website needs a privacy notice if it collects personal data, cookie controls that meet PECR, and terms and conditions if you sell online. UK GDPR still applies, as amended by the Data (Use and Access) Act 2025. Protect your brand by registering a trade mark: from £205 for one class.
Do you need website terms and conditions?
No law requires general website terms of use, but they set rules for using your site, limit your liability and protect your content. If you sell online, you must give certain information by law, and clear terms are the practical way to do it.
For sales to consumers, the Consumer Contracts Regulations 2013 require you to give key information before the order, including your identity and address, total price, delivery arrangements and the 14-day right to cancel. The Electronic Commerce Regulations 2002 require your business name, geographic address, email address and any company or VAT number to be easily available. Ecommerce terms cannot take away rights under the Consumer Rights Act 2015.
Libra has standard terms and conditions for selling goods online and terms and conditions of sale for business customers.
What must a privacy policy include under UK GDPR?
If you collect personal data, including names and emails from a contact form or customer orders, UK GDPR requires you to tell people how you use it. Your privacy notice (privacy policy) should explain:
- who you are and how to contact you
- what personal data you collect and where it comes from
- why you use it and your lawful basis for each purpose
- who you share it with, and any transfers outside the UK
- how long you keep it
- people's rights, including access, correction and objection, and how to complain
GDPR compliance for a small business also means keeping personal data secure, keeping it no longer than you need, having contracts with suppliers who process data for you, and paying the ICO data protection fee unless you are exempt.
Use Libra's privacy notice template as a starting point, and a data processor appointment where a supplier handles personal data for you.
What changed under the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 amends UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. Most data protection changes came into force on 5 February 2026. According to the ICO, key changes for small businesses are:
- Complaints: since 19 June 2026 you must give people a clear way to make a data protection complaint, acknowledge it within 30 days and respond without undue delay.
- Subject access requests: you only need to make reasonable and proportionate searches.
- Recognised legitimate interests: a new lawful basis for listed purposes, such as crime prevention, without a balancing test.
- Automated decisions: more lawful bases are available for significant automated decisions, with safeguards.
- Higher PECR fines: up to £17.5 million or 4% of global turnover, in line with UK GDPR.
Update your privacy notice to describe your complaints process.
Do you need a cookie policy and cookie banner?
Under PECR you must tell users about cookies and similar technologies and get consent, unless an exception applies. Since the 2025 Act, the exceptions include cookies that are strictly necessary, used only for statistical purposes to improve your site, or used to remember how a user wants the site to look or work. For the statistics and appearance exceptions you must give clear information and a simple, free way to object.
Advertising and cross-site tracking cookies still need consent. A cookie policy, or a cookie section in your privacy notice, should list the cookies you use, what they do and how long they last.
How do you register a trade mark in the UK?
You apply to the Intellectual Property Office (IPO). Since 1 April 2026 an online application costs £205 for one class of goods or services and £60 for each extra class. The IPO examines it, then publishes it for a two-month opposition period, and registration usually takes three to four months if there are no objections.
A registered trade mark lasts 10 years and can be renewed indefinitely. It gives you the right to stop others using the same or a similar mark for similar goods or services, and lets you use the ® symbol.
Registering a company name at Companies House does not give you trade mark rights. To protect your business name, search the trade mark register before choosing it, then register the name and any logo. Without registration you must rely on passing off, which is harder and more expensive to prove.
What can you do if someone copies your work or design?
Copyright arises automatically, with no registration, for original written, artistic, musical and dramatic work, software and photographs. It usually lasts for 70 years after the author's death. Designs are protected by unregistered design right (shape, up to 15 years) and supplementary unregistered design right (appearance, three years), or by registering a design from £60.
If someone copied your design or content: keep dated evidence of your original and their copy, check you own the rights, then send a letter asking them to stop. Low-value claims up to £10,000 can go to the Intellectual Property Enterprise Court small claims track.
Check ownership first. An employee's work made in the course of employment belongs to the employer, but a freelancer or agency keeps copyright unless there is a written, signed IP assignment agreement.
What are the key deadlines and time limits?
These dates and periods matter for website compliance and IP:
- 30 days: acknowledge a data protection complaint (in force since 19 June 2026).
- 1 month: respond to a subject access request, extendable by two further months for complex requests.
- 72 hours: report a notifiable personal data breach to the ICO after becoming aware of it.
- 14 days: consumer right to cancel most online purchases, starting when goods are received.
- 2 months: opposition period after a trade mark application is published.
- 10 years: trade mark registration period before renewal.
What should you do next?
- List what personal data your website and business collect, why, and who you share it with.
- Draft or update your privacy notice using the Libra privacy notice template, including a complaints process.
- Audit your cookies, remove any you do not need and set up consent for advertising and tracking cookies.
- Publish terms and conditions for online sales, such as the online sale of goods terms.
- Search the IPO register and apply to register your business name as a trade mark. Ask Libra which classes you need.
- If someone is copying your brand or work, find a lawyer or clinic through Libra.
Frequently asked questions
Do I need to pay the ICO data protection fee?
Most businesses that process personal data electronically must pay unless exempt. The fee is £52 for tier 1 (turnover up to £632,000 or no more than 10 staff), £78 for tier 2 and £3,763 for tier 3, with a £5 discount for paying by direct debit. Use the ICO self-assessment to check whether you are exempt.
Can I copy another company's privacy policy?
No. Copying risks copyright infringement, and the notice would not describe what you actually do with personal data, which is itself a breach of UK GDPR transparency rules. Start from a template and tailor it to your data, purposes, suppliers and retention periods.
Do I still need consent for Google Analytics cookies?
Possibly not. Since the Data (Use and Access) Act 2025, cookies used only to produce statistics to improve your own website can be set without consent if you give clear information and a simple, free way to object. If the tool also uses data for advertising or cross-site tracking, you still need consent.
Does registering my company name protect my brand?
No. Companies House registration only stops another company registering an identical name. It does not stop a business trading under a similar name or using it as a brand. A registered trade mark gives you enforceable rights across the UK for the classes of goods and services you register.
Who owns the copyright in my website or logo?
If an employee created it as part of their job, your business owns it. If a freelancer or agency created it, they own the copyright unless they have assigned it to you in a written, signed document. Check your website design agreement includes an IP assignment.
What is the maximum fine for breaching UK GDPR?
The higher maximum is £17.5 million or 4% of annual worldwide turnover, whichever is greater. Since the Data (Use and Access) Act 2025, breaches of the cookie and electronic marketing rules under PECR carry the same maximum. Most ICO action against small businesses involves reprimands, orders or smaller fines.
Do I need a privacy policy if I only collect email addresses?
Yes. An email address is personal data, so UK GDPR requires you to tell people who you are, why you collect it, your lawful basis, how long you keep it, who you share it with, and their rights. A website form or newsletter sign-up is enough to trigger this duty.
Do I need a complaints process for data protection?
Yes, since 19 June 2026 organisations that handle personal data must have a way for people to complain to them directly. You should make it easy to use, acknowledge complaints within 30 days, investigate and keep the person informed. The ICO can expect you to show this.
Can I use a photo I found on Google on my business website?
Not safely. Most images are protected by copyright from the moment they are created, and appearing in search results does not give permission. Use images you own, have a licence for, or that carry a clear free licence, and keep proof of the licence.
Do I need to register my business for data protection?
Most organisations that process personal data must pay the ICO data protection fee unless an exemption applies. Some small not-for-profits and purely personal or household activity are exempt. The fee is set in tiers by size and turnover, so check the ICO's self-assessment.
What should be in terms and conditions for selling online to consumers?
Include price and delivery terms, the consumer's right to cancel within 14 days for most distance sales, returns and refunds, faulty goods rights under the Consumer Rights Act 2015, payment, and your complaints process. You cannot exclude statutory consumer rights.
Can I use the same name as another business if it is not trade marked?
It is risky. If the other business has built up goodwill, it may sue you for passing off even without a registered mark. A registered trade mark owner can also object. Search the UK trade mark register and Companies House before you commit.
Do I need a cookie banner if I only use essential cookies?
No consent is needed for strictly necessary cookies, such as those remembering a shopping basket or security. You should still explain them in your privacy or cookie information. Analytics cookies may now be allowed without consent in some cases under recent law changes, but check current ICO guidance.
Ask Libra
- Do I need a privacy policy if I only collect email addresses?
- What must a data protection complaints process include from June 2026?
- Can I use an image from Google on my business website?
- Draft ecommerce terms and conditions for selling products online
- How do I trademark my business name in the UK?
- Do I own the logo a freelancer designed for my business?
Sources
- ICO: the Data (Use and Access) Act 2025, what it means for organisations
- ICO: exceptions to consent for storage and access technologies
- Data (Use and Access) Act 2025
- ICO: guide to the data protection fee
- Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013
- Apply to register a trade mark (GOV.UK)
- How long copyright lasts (GOV.UK)
- Unregistered design right (GOV.UK)
This guide is general information about the law in England and Wales as at September 2026, not legal advice. For advice on your situation, ask Libra or find a lawyer through Libra.
.png)