What a UK privacy notice must contain
UK law lists exactly what you must tell people when you collect their personal data. Here is that list in plain English, updated for the changes that took effect in 2026, with the article each item comes from.
Last checked against legislation.gov.uk on 14 October 2026. General information, not legal advice.
What a privacy policy must include: the checklist
When you collect personal data directly from people, UK GDPR Article 13 says you must tell them:
| What to tell people | Article |
|---|---|
| Who you are, and how to contact you | 13(1)(a) |
| How to contact your Data Protection Officer, if you have one | 13(1)(b) |
| Why you use the data, and the lawful basis for each use | 13(1)(c) |
| If you rely on legitimate interests, what those interests are | 13(1)(d) |
| Who you share the data with, or what kinds of organisation | 13(1)(e) |
| Whether data leaves the UK, and what protects it | 13(1)(f) |
| How long you keep it, or how you decide | 13(2)(a) |
| People's rights: access, correction, deletion, restriction, objection and data portability | 13(2)(b) |
| If you rely on consent, that it can be withdrawn at any time | 13(2)(c) |
| New from 19 June 2026: the right to complain to you | 13(2)(ca) |
| The right to complain to the regulator, now the Information Commission | 13(2)(d) |
| Whether people have to give the data, and what happens if they do not | 13(2)(e) |
| Any significant automated decisions, how they work and what they mean for people | 13(2)(f) |
| Before you use data for a new purpose, what that purpose is | 13(3) |
If you get personal data from somewhere else, Article 14 adds two more: what categories of data you hold, and where you got it. Article 12 says all of this must be concise, easy to access, and in clear and plain language, especially anything aimed at children.
Sources: Article 13, Article 14, Article 12.
Privacy policy review checklist
Already have a policy? Work through these, or let the free checker do the first pass for you.
- Does every item in the checklist above appear, in words a customer would understand?
- Does it name the tools your website actually uses today, including analytics and advertising?
- Does it include the right to complain to you, added on 19 June 2026, and do you have a complaints procedure?
- Does it name the regulator as the Information Commission? (Old references to the ICO still count in law, but update them at this review.)
- Does it describe what you really do: where data goes, who you share it with, how long you keep it?
- Is there a "last updated" date, and is it recent?
Also worth covering
- Cookies and similar technologies. PECR requires clear and comprehensive information about anything stored on or read from a visitor's device. It can be in a separate cookie policy, as long as people can find it.
- Marketing. If you send marketing, the right to object to it must be brought to people's attention clearly and separately from other information (Article 21).
- A "last updated" date, so people and you can see how current it is.
- How you keep data secure. Not required in the notice, but it builds trust.
Check your policy against this list
The Privacy Register reads your existing policy and website and checks every item above, plus the cookies and tools your site actually uses. Free, no sign-up.
Questions
Does my business website need a privacy policy in the UK?
If your website collects any personal data, you must give people the information listed above. That includes a contact form, an email sign-up, online orders, and analytics or advertising tools that record visitors. In practice almost every business website needs one.
What should a website privacy policy include?
Everything in the checklist above, plus information about cookies and similar technologies, and the names of the tools your website uses to collect visitor information. If you send marketing, include how to opt out.
What is the difference between a privacy notice and a privacy policy?
The law uses neither term. It sets out information you must give people. "Privacy notice" and "privacy policy" are both common names for the public page that gives it. Some organisations also use "privacy policy" for an internal document about how staff handle data. What matters is that the public page contains everything on the checklist.
Can I just use a privacy policy template?
A template is a good start, but it only works if it describes what you actually do: the tools on your website, where your data goes, and how long you keep it. A template copied a few years ago will also miss the 2026 changes. Checking your finished policy against your real website catches both problems.
How often should I review my privacy policy?
The law sets no fixed interval, but you must update it whenever what you do with data changes, and before you use data for a new purpose. UK law changed three times in 2026, so a policy last reviewed before October 2026 is worth checking now.