UK GDPR and Cookie Checklist for Websites
A UK small business website needs a privacy notice, forms that collect only what is necessary, contracts with anyone processing data for you, and cookie controls that follow PECR. Since 5 February 2026, strictly necessary cookies, and some analytics and preference cookies with clear information and an easy opt-out, can run without consent. Advertising and most third-party tracking still need consent first.
Two sets of rules apply to most UK websites. The UK GDPR and the Data Protection Act 2018 cover personal data in general: what you collect through forms, accounts and orders. The Privacy and Electronic Communications Regulations (PECR) cover cookies and similar technologies that store or read information on a visitor’s device.
This checklist is general information for small business websites, not legal advice. Where possible we link to the law itself on legislation.gov.uk. The Information Commissioner’s Office (ICO) is the regulator, and its guidance on cookies and similar technologies is worth reading alongside this page.
The two laws in one paragraph
GOV.UK’s data protection page sums up the UK GDPR principles: personal data must be used fairly, lawfully and transparently, for specified purposes, limited to what is necessary, kept accurate, kept no longer than needed, and kept secure. People have rights, including the right to be informed about how their data is used. PECR adds a separate rule for devices: under regulation 6, you must not store information on, or access information from, a visitor’s device unless an exception in Schedule A1 applies.
What changed for cookies in 2026
The Data (Use and Access) Act 2025 replaced regulation 6 and added Schedule A1. According to legislation.gov.uk, both took effect on 5 February 2026. The schedule sets out when storage or access is allowed:
| Purpose | Consent needed? | Conditions in Schedule A1 |
|---|---|---|
| Strictly necessary for a service the user asked for (security, fraud prevention, fault detection, logging in, remembering basket or form input) | No | Must be strictly necessary for the requested service |
| Statistics about how your service or website is used, to improve it | No, if conditions are met | Sole purpose is improvement; data not shared except with someone helping make those improvements; clear information; simple, free way to object |
| Adapting appearance or function to the user’s preferences, or enhancing appearance or function | No, if conditions are met | Sole purpose as stated; clear information; simple, free way to object |
| Anything else, including advertising, remarketing and cross-site tracking | Yes | Clear and comprehensive information, and consent |
The schedule also says consent can be given through browser settings or another application. That does not remove the need to give clear information.
What this means for analytics
The statistics exemption is narrower than it first looks. Check each condition against the tool you use:
- Is improving your own site or service the only purpose?
- Does the analytics provider use the data for its own purposes, or combine it with data from elsewhere? If so, the “not shared except to help with improvements” condition may not be met.
- Is the same tag also feeding advertising audiences or conversion tracking? Then the sole purpose test fails and you need consent.
- Do visitors get clear information and a simple, free way to object?
A self-hosted or privacy-focused analytics setup is easier to fit within the exemption than a tool connected to an advertising platform.
Cookie checklist
- Audit the site. List every cookie, local storage item, pixel and script, including ones set by plugins, chat widgets, embedded maps, videos and fonts.
- Sort each one by purpose using the table above.
- Block non-exempt items until consent. Advertising and tracking scripts must not load before the visitor agrees.
- Make refusing as easy as accepting. Consent must be freely given, specific, informed and unambiguous, as defined in Article 4(11) of the UK GDPR. Put “Reject” next to “Accept”, at the same level.
- Give an easy opt-out for exempt analytics and preferences, and honour it.
- Explain each purpose in plain English in a cookie notice, with the provider and how long the item lasts.
- Let people change their mind through a link in the footer.
- Re-check after every change. New plugins and embeds often add trackers silently.
UK GDPR checklist for a small business website
Privacy notice
- Publish a privacy notice linked from every page footer and from every form.
- Cover what Article 13 of the UK GDPR requires: who you are and how to contact you, what you collect and why, the lawful basis, who receives the data, any transfers outside the UK, how long you keep it, and people’s rights, including the right to complain to the ICO.
Forms
- Ask only for what you need. A contact form rarely needs a date of birth.
- Do not pre-tick marketing boxes. Keep marketing consent separate from the enquiry itself.
- Serve the whole site over HTTPS.
- Decide where submissions go, who can read them, and how long you keep them.
- Protect forms from spam without adding trackers that need consent.
Suppliers and contracts
- List everyone who processes personal data for you: web developer, hosting company, email provider, CRM, payment provider.
- Have a written contract with each that meets Article 28 of the UK GDPR. It must cover acting only on your documented instructions, confidentiality, security, use of sub-processors, help with people’s rights requests, and deleting or returning data at the end.
- Check where each supplier stores and accesses data. If data leaves the UK, a lawful transfer mechanism is needed.
Security and records
- Keep the CMS, theme and plugins updated.
- Use strong, unique passwords and two-factor sign-in for admin accounts.
- Take regular backups and test a restore.
- Know what you will do if data is lost or exposed.
Data protection fee
- Check whether you need to pay the ICO’s data protection fee. The government’s 2025 fee review set tier 1, for micro organisations with a maximum turnover of £632,000 or no more than 10 staff, at £52 a year, with £5 off for Direct Debit.
Common mistakes on small business sites
- A cookie banner that appears, but analytics and ad tags have already fired.
- A privacy notice copied from another business that describes systems you do not use.
- Embedded YouTube videos or Google Maps loading third-party cookies on every page.
- A web developer with full database access and no written processor contract.
- An old contact form plugin emailing submissions in plain text to a shared inbox.
How Hostlyx handles this on the sites we build
Hostlyx is a Zorixo Services company with a delivery team in Bengaluru, India. UK customers are invoiced in GBP by Zorixo Ventures Ltd, a UK company, through Stripe. When we build a website, we list the cookies and scripts it uses, load non-exempt ones only after consent, and set up forms to collect only what you need. We host on cPanel with HTTPS as standard; see web hosting. We do not give legal advice, so you remain responsible for your privacy notice and lawful bases.
If you want an existing site checked, or a new one built with this in place, contact us for a fixed written quote in GBP. Our small business website checklist covers the rest of what a launch needs.