UK GDPR and Website Hosting: What Small Websites Need to Do

Even a small website collects personal data: contact form messages, newsletter sign-ups, analytics data and sometimes orders. In the UK, this is covered by UK GDPR and the Data Protection Act 2018, with cookies covered by PECR. This guide explains the practical basics. It is general information, not legal advice.

1. Publish a clear privacy policy

Your privacy policy should explain who you are, what data you collect, why you collect it, the legal basis, how long you keep it, who you share it with (for example your hosting provider, email marketing tool or payment processor) and how people can exercise their rights. Write it in plain English and link to it from the footer and from forms.

2. Cookies and consent

Under PECR, you generally need consent before setting non-essential cookies, such as analytics and advertising cookies. Strictly necessary cookies (for example a shopping basket) do not need consent. A good cookie banner lets visitors accept or reject non-essential cookies as easily as each other, and does not load those cookies until consent is given.

3. Contact forms

• Collect only the fields you need.
• Link to the privacy policy near the submit button.
• Do not add people to marketing lists unless they opt in.
• Delete old enquiries you no longer need.

4. Your hosting provider and other processors

Your host, email provider and analytics tool process data on your behalf. Use reputable providers that offer a data processing agreement. If data is stored outside the UK, check that the transfer is covered by appropriate safeguards; established providers usually explain this in their terms.

5. Security

• HTTPS on every page.
• Keep CMS, themes and plugins updated.
• Strong passwords and two-step verification for admin accounts.
• Regular backups.
• Limit who has admin access.

6. ICO data protection fee

Many organisations that process personal data must pay an annual data protection fee to the Information Commissioner’s Office (ICO), unless they are exempt. The ICO website has a short self-assessment tool to check whether you need to pay.

7. Handling requests and breaches

People can ask for a copy of their data or ask you to delete it. Have a simple process to respond within the required time. If a personal data breach is likely to cause a risk to people, you may need to report it to the ICO within 72 hours.

Quick checklist

1. Privacy policy published and linked.
2. Cookie banner with real choice.
3. Forms collect minimum data.
4. Providers offer data processing agreements.
5. Site secured and backed up.
6. ICO fee checked.

Related: choosing UK web hosting for a small business.