Most small business websites collect personal data in some way. A contact form, a newsletter sign-up, an online shop or a simple analytics tool – they all handle information about the people who visit. And that means data protection law applies, whatever the size of your business.
The rules have also changed this year. New legislation has relaxed some of the cookie rules, but it’s also made the penalties for getting things wrong far higher. So it’s a good time to check your website is doing what it should. Here’s a practical checklist to help you do just that.
Which rules apply to your website?
Two main pieces of law cover how UK websites handle personal data:
- UK GDPR covers how you collect, use and store personal information – names, email addresses, enquiry details and so on.
- PECR (the Privacy and Electronic Communications Regulations) covers cookies and similar tracking, plus marketing emails and texts.
Both have been updated by the Data (Use and Access) Act 2025, with the main changes for websites coming into force on 5 February 2026. Two changes matter most for small businesses.
First, some cookies no longer need consent. Analytics used purely to understand how people use your own website, and cookies that remember things like a visitor’s display preferences, can now be set without asking first – as long as you explain what they do and give people an easy way to opt out. Advertising and cross-site tracking cookies still need consent, though, and the analytics exemption is narrow. Tools that share data with a third party for their own purposes, such as Google Analytics, will generally still need consent.
Second, the fines are now much bigger. The maximum penalty for breaking the cookie and marketing email rules has gone from £500,000 to £17.5 million or 4% of global turnover, bringing it in line with UK GDPR. Small businesses aren’t likely to face fines anywhere near that, but it shows how seriously these rules are now taken.
Your website compliance checklist
1. An up-to-date privacy policy
Your privacy policy should explain, in plain English, what information you collect, why you collect it, who you share it with, how long you keep it and how people can exercise their rights. It needs to reflect what your website actually does today – not what it did when it was first built. If you’ve added a booking system, live chat or a new newsletter tool since then, your policy should mention it.
2. A cookie banner that works properly
If your website uses cookies that need consent, visitors must be able to accept or reject them just as easily. That means a clear “Reject” button alongside “Accept”, and no non-essential cookies loading before someone has made their choice. For any cookies you’re now relying on the new exemptions for, your cookie policy should explain what they do and how to opt out.
3. Contact forms that only ask for what you need
Every form field is personal data you’re responsible for. If you don’t need someone’s phone number or address to answer their enquiry, don’t ask for it. Link to your privacy policy near the submit button, and make sure enquiries aren’t sitting in old inboxes or databases for years after you’ve dealt with them.
4. Proper consent for marketing emails
If you want to add people to your mailing list, you’ll usually need their clear permission – an unticked box they choose to tick, not one that’s ticked for them. Signing up for one thing (like an enquiry or a purchase) shouldn’t automatically sign someone up for your newsletter, and every marketing email needs an easy way to unsubscribe.
5. Know your third-party tools
Most websites rely on outside services – analytics, embedded maps, YouTube videos, social media feeds, booking widgets and chat tools. Many of these set their own cookies or collect data. Make a list of what’s on your website and check each one is covered by your privacy policy and cookie banner.
6. Keep your website secure
Data protection law expects you to take reasonable steps to keep personal data safe. For a website, that means an SSL certificate (the padlock in the address bar), up-to-date software, strong passwords and regular backups. An outdated plugin is one of the most common ways websites get hacked. Our guide to why regular website maintenance matters covers this in more detail.
7. Have a way to handle complaints
From June 2026, businesses will need a clear process for handling data protection complaints. For most small businesses this can be simple – a named contact or email address in your privacy policy, and a commitment to acknowledge and respond to complaints promptly.
Common mistakes we see
When we look at websites, the same issues come up again and again:
- A cookie banner that doesn’t actually block anything. It looks the part, but analytics and tracking cookies load the moment someone lands on the page, before they’ve clicked a thing.
- A privacy policy copied from a template years ago. It mentions services the business no longer uses and misses the ones it does.
- No “Reject” option. Only an “Accept” button, or a reject option buried several clicks deep.
- Pre-ticked newsletter boxes. Or contact forms that quietly add everyone to the mailing list.
- Forgotten tracking code. Old analytics or advertising pixels left on the website from a campaign that ended long ago.
None of these are difficult to fix, but they’re easy to miss if nobody’s looked at your website with fresh eyes for a while.
Getting your website in good shape
Data protection can feel like one more thing on an already long list, but for most small business websites, getting it right comes down to a handful of sensible checks. And with the rules changing this year, it’s well worth taking a fresh look.
At 37 Digital, we build privacy into every website from the start, and we can review an existing website to make sure its cookie banner, forms and third-party tools are set up properly. For clients on our website maintenance and support plans, we keep an eye on things as your website grows and changes.
If you’d like a second pair of eyes on your website, get in touch and we’ll take a look.
This article is general guidance rather than legal advice. If you’re unsure about your obligations, the ICO website is a great place to start.
