Check your privacy policy against UK law, and against your own website.
For UK businesses, charities and the agencies that build their websites. The Privacy Register reads the privacy policy you already have, compares it with the tracking tools your website actually uses, asks what your business really does, and shows every gap with plain-English fixes and suggested wording. Up to date with the 2026 changes.
Free. No sign-up. Takes about two minutes. Anything you paste stays in your browser.
UK privacy law changed three times in 2026.
Most privacy policies were written before any of these dates. A policy that was fine last year can now be missing something the law requires.
- 5 February 2026New rules on automated decisions, cookies and transfersSignificant automated decisions now need safeguards. Some analytics cookies no longer need consent, but only under strict conditions.
- 19 June 2026The right to complain to youEvery organisation must handle data protection complaints, acknowledge them within 30 days, and say so in its privacy notice.
- 30 September 2026A new regulatorThe Information Commissioner was replaced by the Information Commission.
Read the 2026 changes in plain English · Free complaints procedure template
Sources: Data (Use and Access) Act 2025 commencement regulations, SI 2026/82 and SI 2026/1015.
It checks the policy you have, against the business you run.
Most privacy tools hand you a new template to fill in. That helps if you have nothing. If you already have a policy, the question is whether it is still right, and that is what this answers.
Reads your existing policy
No starting again. It reads the policy already on your website, or one you paste in, and tells you what is missing.
Checks it against your website
It finds the tracking tools your homepage loads, such as Google Analytics or a Meta Pixel, and lists any your policy does not name.
UK law, as it stands now
Built for UK GDPR, the Data Protection Act 2018 and PECR as amended by the Data (Use and Access) Act 2025, including the complaints duty in force since 19 June 2026.
Asks what you actually do
Nine quick questions, pre-filled from what the scan found, so the check fits your business and not just your wording.
Fixes, not just flags
Every gap comes with why it matters, how to fix it, suggested wording, and the law it relies on. Download it all as a PDF.
Practises what it checks
No cookies and no third-party scripts. A page counter that identifies no one, and that you can turn off. Text you paste, your answers and the report stay in your browser.
We have not found another free tool that does all of this for UK law. If you know of one, tell us.
Your website may be sharing more than your policy says.
Analytics, advertising pixels, chat widgets and embedded videos all send information about your visitors to other companies. The law says your privacy information must cover who receives personal data, and PECR requires clear information about cookies and similar technologies.
Policies often fall behind the website. A tool gets added by a developer or a marketing agency, and nobody updates the policy. The Privacy Register compares the tools it finds on your homepage with the names in your policy and lists the ones that are missing, so you get a concrete, checkable list rather than a general warning.
"Fewer than 15 percent" of third-party data flows were disclosed in website privacy policies.
Timothy Libert, An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies, The Web Conference 2018. A study of over 200,000 website privacy policies, not limited to the UK.
Four steps, about two minutes.
- 1
Enter your website
Or paste your policy if your site blocks automated visitors.
- 2
We scan it
Your homepage, the tools it loads, your organisation details and your privacy policy. You can watch every step.
- 3
Answer nine questions
Yes, no or not sure, about what your business does. Some are pre-filled from the scan.
- 4
Get your results
A score, every gap with a fix and suggested wording, and a PDF report. Change an answer and check again at any time.
Every check names the law it relies on.
These are the checks in the current rule set. Checks marked "Updated for 2026" cover changes that took effect this year. Some only run when they apply to you.
Every policy (15)
- Who you areUK GDPR Art 13(1)(a)
- How to contact you about privacyUK GDPR Art 13(1)(a)
- Why you use people's dataUK GDPR Art 13(1)(c)
- Lawful basis for each purposeUK GDPR Art 13(1)(c), Art 6
- Who you share data withUK GDPR Art 13(1)(e)
- How long you keep dataUK GDPR Art 13(2)(a)
- People's data rightsUK GDPR Art 13(2)(b)
- The right to complain to you Updated for 2026UK GDPR Art 13(2)(ca), 14(2)(da); DPA 2018 s164A (in force 19 June 2026)
- Right to complain to the regulator Updated for 2026UK GDPR Art 13(2)(d)
- Whether people must give their dataUK GDPR Art 13(2)(e)
- Out of date legal references Updated for 2026Current UK law
- Last reviewed date Updated for 2026Good practice; Data (Use and Access) Act 2025 commencement dates
- Clear and plain languageUK GDPR Art 12(1)
- How you keep data safeGood practice
- How you will tell people about changesGood practice; UK GDPR Art 13(3), 14(4)
When it applies to you (14)
- Data Protection Officer contactUK GDPR Art 13(1)(b)Runs when: you have a Data Protection Officer
- Legitimate interests explained Updated for 2026UK GDPR Art 13(1)(d)Runs when: the policy relies on legitimate interests
- Transfers outside the UK Updated for 2026UK GDPR Art 13(1)(f), Chapter V (amended 2025)Runs when: data leaves the UK
- Withdrawing consentUK GDPR Art 13(2)(c)Runs when: you rely on consent or send marketing
- Automated decisions and AI Updated for 2026UK GDPR Art 13(2)(f), Art 22A to 22D (2025 Act)Runs when: you make automated decisions about people
- Use of AI toolsUK GDPR Art 13(1)(c), 13(1)(e)Runs when: you use AI tools on personal data
- Where you got data fromUK GDPR Art 14(1)(d), 14(2)(f)Runs when: you get data from other sources
- Cookies and tracking technologies Updated for 2026PECR reg 6 and Schedule A1 (as amended by the 2025 Act)Runs when: trackers were found on the website
- Tools found on your site but not namedUK GDPR Art 13(1)(e); PECR reg 6Runs when: trackers were found on the website
- ChildrenUK GDPR Art 12(1), Art 25(1A) (2025 Act); Age Appropriate Design CodeRuns when: children could use your service
- Marketing emails and textsPECR reg 22; UK GDPR Art 21(2) to (4)Runs when: you send marketing
- Sensitive (special category) dataUK GDPR Art 9 and 10; DPA 2018 Sch 1Runs when: you handle sensitive data
- Job applicantsUK GDPR Art 13Runs when: you recruit through your website
- Company details on the websiteCompany, LLP and Business (Names and Trading Disclosures) Regulations 2015, reg 25Runs when: a website was scanned
Rule set v0.2, reviewed 14 October 2026. Every result also shows why the check matters, how to fix a gap, and suggested wording.
Whichever side of the website you are on.
I run a business or charity
Find out whether the policy you have still meets the law, in plain English, before a customer, a complaint or the regulator finds the gap. Fix it yourself with the suggested wording.
I build or advise on websites
Web designers, agencies, accountants and advisers: run a check before a site launches or at a client review, and hand over the PDF report as a clear list of what to fix.
What it does not do.
- It is not legal advice. It checks what your policy says, not what your business does. If the answer matters, ask a qualified data protection professional.
- It looks for words, not meaning. It checks whether the right things are mentioned, so it can miss problems or flag wording that is fine. No AI is used.
- It scans your homepage only. Tools that load on other pages, after consent, or on the server side will not be found.
- It does not test your cookie banner. It cannot tell whether cookies are set before people agree.
- Some websites block it. If a site uses bot protection, the scanner respects that and you can paste the policy in instead.
Questions and answers
Is the privacy policy checker free?
Yes. There is no sign-up and no charge to run a check and download the report.
How do I check if my website is GDPR compliant?
Start with the privacy policy, because it is the part of your website the law says most about. Enter your website address above: the checker reads your policy, compares it with the tools your homepage loads, and checks it against UK GDPR, the Data Protection Act 2018 and PECR. Then look at what you actually do with data, which no website scan can see: your cookie banner, your contracts with suppliers, and how you handle requests and complaints.
Is this a privacy policy generator?
No. It checks the policy you already have. If you do not have one yet, start with our free UK privacy notice template, then check it here. Generator or checker: which do you need?
Is my website GDPR compliant if it passes?
Not necessarily. The check looks at what your privacy policy says. Compliance also depends on what you actually do with personal data, which no website scan can see. A good result means your policy covers what the law asks it to cover, as far as an automated check can tell.
Does my business website need a privacy policy?
If your website collects any personal data, such as through a contact form, an email sign-up, online orders, or analytics and advertising tools, you must tell people the things listed in UK GDPR Article 13. In practice almost every business website needs one. See what it must contain.
What happens to my data when I run a check?
The website address you enter is sent to our server, which fetches that site's homepage and privacy policy and passes them back to your browser. We do not store the address, the pages or the results. Text you paste, your answers and the PDF report never leave your browser. The page sets no cookies and loads nothing from other companies. We count page views and which kind of check was started, without identifying you, and you can turn that off.
What is new in UK data protection law in 2026?
Three things affect privacy policies: new rules on automated decisions, cookies and transfers from 5 February 2026; the right to complain to the organisation from 19 June 2026; and the Information Commission replacing the Information Commissioner from 30 September 2026. Read the guide.
Why could the scanner not read my website?
Some websites block automated visitors, or ask them not to read certain pages in a robots.txt file. The scanner respects both and never tries to get round them. Open your policy, copy the text and use "Paste a policy instead".
Who is behind The Privacy Register?
Second Lens, an independent UK consultancy run by Phil Swindin, which gives plain-English advice on AI adoption, compliance and governance. Questions or corrections: hello@secondlens.co.uk.
See what your privacy policy is missing.
A few quick questions
A scanner can only read words. Your answers tell us what you actually do, so we check the right things. Where the scan spotted something, we have pre-selected an answer: change it if it is wrong. You can come back and change your answers after you see the results.
Your results
Findings
This is an automated check. It looks at what a privacy policy says, not what an organisation actually does, and it can miss things or flag things wrongly. It is not legal advice. Websites are fetched only by our own server, which identifies itself honestly and respects each site's robots.txt. Text you paste, your answers and the PDF report all stay in your browser and are not sent to us.