A UK business website can look perfectly legitimate while missing information that the law expects visitors to find. The essentials are less about adding a row of legal links and more about answering three practical questions: who operates this site, what happens to visitors’ information, and what rights do customers have when they buy?
The legal requirements for a business website in the UK depend on the business structure, whether personal data is collected, and whether goods or services are sold online. A brochure site and an online shop will not need identical notices.
Identify the business behind the website
Start with the legal identity, not the brand logo.
Limited company disclosure
Under the UK trading-disclosure rules, a limited company must show its registered name on its website, together with its registered number, registered office address and the part of the UK in which it is registered.
For example, a company trading as “Harbour Studio” should identify the registered company behind that name. A contact form alone is not a substitute for the required company disclosure. Check that the details match the current Companies House record, particularly after an address change.
Sole traders and online service providers
Sole traders have different company-disclosure obligations, but should not hide their legal identity behind a trading name. Business-name rules can require disclosure of the proprietor’s name and an address for service of documents. Online businesses covered by the Electronic Commerce Regulations must also make certain identifying and contact information easily, directly and permanently accessible, including a geographic address and email contact.
A guide to UK business structures is a useful companion when deciding which identity details apply to your organisation.
Explain how personal information is used
Under the UK GDPR and Data Protection Act 2018, a business that handles personal data will generally need to give individuals appropriate privacy information. Names submitted through an enquiry form, customer email addresses and identifiable website analytics can all be relevant.
A privacy notice should explain who controls the data, why it is collected, the lawful basis used, how long it is retained, who receives it, relevant international transfers, and individuals’ rights, including how to complain to the Information Commissioner’s Office. Explain the actual practices of the business rather than copying a generic policy.
Timing matters. Where you collect information directly, make the notice available when it is collected. Put a clear reference beside enquiry, signup or checkout forms, rather than relying solely on a footer link. A practical next read is a privacy notice checklist for small businesses.
Handle privacy and cookies according to their purpose
Cookie rules are found mainly in the Privacy and Electronic Communications Regulations, or PECR. They cover more than conventional cookies: other technologies that store or access information on a visitor’s device can be included.
Visitors must receive clear information about these technologies. Consent is generally required unless a specific exception applies. Essential functions such as keeping a shopping basket working can fall within an exception. Following changes introduced by the Data (Use and Access) Act, narrowly defined statistical and appearance-related purposes may also qualify without consent, but require clear information and a simple, free way to object.
Tracking people for behavioural advertising or profiling generally requires consent before the relevant technology operates. A banner with only an “Accept” option is unlikely to provide a valid choice where consent is required.
Audit what third-party tools actually load, not merely what the cookie policy claims. Recheck the setup after installing advertising pixels, video embeds or new analytics features.
Give online customers the information they need
Businesses taking orders online have additional responsibilities under consumer and e-commerce law. Before a customer commits to an eligible distance contract, they usually need clear information about the goods or services, the full price including applicable taxes, delivery charges, payment arrangements, cancellation rights and how to contact the trader.
For many consumer distance purchases, the statutory cancellation period is 14 days, although its starting point and exceptions differ for goods, services and digital content. Do not promise an unconditional right to cancel every purchase, or tell customers that sale items automatically lose statutory rights.
The checkout must make the obligation to pay unmistakable. Customers should be able to correct input errors, understand the ordering steps and receive confirmation in a form they can keep. Extra paid options generally need express agreement rather than pre-ticked boxes.
A website terms and conditions checklist can help identify missing customer-facing information.
Make marketing claims and contact routes trustworthy
Advertising and pricing claims should be accurate and capable of substantiation. Do not disguise compulsory fees until checkout, invent countdown deadlines or describe a discount in a misleading way.
Email marketing has separate PECR requirements. Marketing messages to individual subscribers normally need consent unless the limited existing-customer exception applies, and recipients need an easy opt-out.
Provide a working email address and an effective way to contact the business. Depending on the service, further regulatory information may be required, including VAT details or professional authorisations.
Consider accessibility and keep notices current
Private businesses providing services to the public must consider their duties under the Equality Act 2010, including reasonable adjustments for disabled people. This can affect the usability of online forms, purchasing journeys and access to important information. The public-sector website accessibility regulations do not automatically apply to every private company.
Review the website after changes to trading identity, data practices, payment methods or suppliers. A quarterly check can catch an outdated registered address, a dormant contact mailbox or a new marketing tool missing from the privacy information.
Frequently asked questions
Does every UK business website need terms and conditions?
There is no universal rule requiring a page called “Terms and Conditions” on every brochure website. Businesses selling online must, however, give applicable contractual and consumer information. Written terms can be a useful way of presenting some of it.
Must a UK limited company show its registered address?
Yes. Its website must display its registered office address, along with the registered name, number and jurisdiction of registration. A trading or correspondence address does not automatically replace this requirement.
Do all UK websites need a cookie banner?
No. The legal test concerns the technologies used and their purposes, not the presence of a banner. Some uses are exempt from consent, while others need informed consent before activation. Clear information remains essential.
Is a privacy policy enough for GDPR compliance?
No. A privacy notice addresses transparency, but lawful processing also requires appropriate legal grounds, safeguards, retention practices and respect for individual rights.
Conclusion
Good website legal notices reflect the business people are actually dealing with. Confirm your trading identity, explain data use honestly, assess each cookie purpose and show customers key terms before payment. Then revisit those disclosures whenever operations change. A short, accurate set of notices is more useful than a lengthy collection of outdated templates.
