UK GDPR for websites

Who Needs to Be UK GDPR Compliant & What to Check on Your Website

Reading Time: 3 minutes

There’s still a lot of confusion around UK GDPR, especially since Brexit. A common misconception is that GDPR no longer applies in the UK. In reality, it very much does and it is now referred to as UK GDPR – the requirements are largely the same.

If you run a business with a website, this article will help you understand whether UK GDPR applies to you and what you should be checking on your website.

Who does UK GDPR apply to?

In short: almost every business.

You need to comply with UK GDPR if you:

  • Run a business or organisation in the UK
  • Have a website that collects any personal data
  • Store or process information about customers, clients, or contacts

Personal data includes things like:

  • Names
  • Email addresses
  • Phone numbers
  • IP addresses
  • Enquiry form submissions
  • Newsletter sign-ups

If your website has any kind of form, analytics, cookies, or email capture, UK GDPR applies to you.

This includes:

  • Sole traders
  • Limited companies
  • Charities and clubs
  • E-commerce websites
  • Service-based businesses

Size doesn’t matter, compliance is about what data you collect, not how big your business is.

What does UK GDPR mean in simple terms?

UK GDPR is about:

  • Being clear about what data you collect
  • Explaining why you collect it
  • Keeping it secure
  • Only collecting what you actually need
  • Respecting people’s rights over their data

For most businesses, compliance isn’t about complex systems — it’s about clarity, transparency, and good website practices.

What to check on your website

Here’s a practical website-focused checklist you can use.

  1. Privacy Policy

Your website should have a clear, up-to-date Privacy Policy that explains:

  • What personal data you collect
  • How and why you collect it
  • How long you keep it
  • Who you share it with (e.g. email providers, payment processors)
  • How users can contact you about their data

It should be easy to find (usually in the footer) and written in plain English.

  1. Cookie Usage & Consent

If your website uses:

  • Analytics (e.g. Google Analytics)
  • Marketing or tracking tools
  • Embedded content (videos, maps, social feeds)

…you may need a cookie consent banner that:

  • Explains what cookies are used
  • Allows users to accept or reject non-essential cookies
  • Doesn’t set tracking cookies before consent is given

Simply saying “we use cookies” is not enough.

  1. Contact & Enquiry Forms

Check that your forms:

  • Only ask for information you genuinely need
  • Clearly explain what the data will be used for
  • Do not automatically add users to mailing lists without consent

If you use a checkbox for marketing consent, it should not be pre-ticked.

  1. Email Marketing & Sign-ups
  • If you collect email addresses for marketing:
  • Make sure users actively opt in
  • Explain what they’re signing up for
  • Provide an easy way to unsubscribe

You should also be able to show how and when consent was given.

  1. Data Security

Your website should:

  • Use HTTPS (a secure SSL certificate)
  • Keep WordPress, themes, and plugins up to date
  • Use strong passwords and limited admin access

UK GDPR requires you to take “appropriate security measures”. For most websites, this means basic, sensible security hygiene.

  1. Third-party Tools & Integrations

Be aware of any tools connected to your website, such as:

  • Email marketing platforms
  • Booking systems
  • Payment providers
  • CRM systems

You should know:

  • What data is shared
  • Why it’s shared
  • That the provider also meets data protection standards

What happens if you don’t comply?

For most small businesses, the biggest risks aren’t fines, they are:

  • Loss of trust
  • Complaints
  • Being asked to fix issues under pressure
  • Looking unprofessional or careless with data

Getting the basics right protects both your business and your customers.

UK GDPR hasn’t gone away. It applies to most businesses, and your website plays a central role in compliance.

The good news is that for the majority of businesses, compliance is achievable with clear policies, sensible forms, and good website setup, not legal complexity.

If you are unsure whether your website meets the mark, a review can quickly highlight what’s fine and what needs adjusting.

Bec Lee

By Bec Lee

Bright Website Design

Bec is the founder of Bright Website Design, a Wilmslow-based website design agency specialising in building beautiful, high-performing WordPress websites for small & medium businesses.

With a reputation for being straightforward, technically sharp, and genuinely invested in her clients’ success, Bec has built websites for businesses of all shapes and sizes, from local Cheshire traders to companies operating across Europe.

Let’s Connect