UK GDPR Website Checklist for Small Businesses in 2026

If you run a small business website with a contact form, cookies or an email list, this website GDPR checklist UK guide is for you. The law changed in 2026, and some parts of your site may need a quick review.

You do not need to become a data protection expert. You do need to know what your website collects, what it tells people, and how someone can complain. This guide covers each of those in plain English.

This is general information, not legal advice.

What changed in 2026, in plain English

The Data (Use and Access) Act (often shortened to DUAA) amends existing UK data protection law. It does not replace it. The ICO said the next phase began on 5 February 2026, bringing most remaining data protection provisions into force. The exception was the complaints procedure requirement, due on 19 June 2026.

For a website owner, four changes matter most:

• Complaints: people can complain to you directly, and you need a process for it.
• Cookies: some low-risk cookies, including certain analytics, no longer need prior consent.
• Fines: the ICO can now issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR), which cover cookies and electronic marketing.
• Automated decisions: the rules were rewritten, which matters if you use AI tools.

Those fine levels are maximums. They are not what a typical small business should expect, but they show the ICO takes cookies and marketing seriously.

The new complaints process: what your website should offer

This is the change most likely to need action. Controllers must have clear and effective processes for handling data protection complaints, including letting people complain directly to them. If your website collects names, emails or enquiries, you are a controller.

What the process must do

In short, you must make it possible to complain. You must acknowledge receipt within 30 days, respond without undue delay, and tell the person the outcome without undue delay.

You do not need anything fancy. Options include complaint forms, a dedicated email address, telephone complaints, an online portal or live chat with escalation to a human. Existing complaints tools can be adapted, and no standalone data protection system is required.

One catch: organisations must accept complaints made through any channel, including to any member of staff. A complaint sent to a social media DM or a salesperson still counts. Make sure your team knows to pass these on.

What to put on your website

• A short "Data protection complaints" section in your privacy notice or footer-linked page.
• A named email address, such as privacy@yourdomain.co.uk, or a simple form.
• A sentence saying you will acknowledge complaints promptly. The legal limit is 30 days, but a few working days is kinder and safer.

Your privacy notice should also mention this right. Controllers must tell people about their right to complain in privacy notices and when responding to requests to exercise their rights. You should still mention the right to complain to the ICO as well.

Cookies and analytics: what the rule changes mean

Many owners hear "no more cookie banners". That is too simple. From 5 February 2026, consent is no longer required for certain cookies, including those used solely for statistics where only the website operator uses the data, and those that customise appearance or functionality.

There are conditions. If you rely on the statistics or appearance exceptions, you must give users a simple, free way to object.

Advertising is different. Where information is collected and shared with third parties for advertising purposes, consent is still required. That includes marketing pixels and remarketing tools.

A practical example

Say you run a plumbing business website with basic visitor statistics and a Facebook advertising pixel. The statistics may fit the new exception if you explain them and offer an opt-out. The advertising pixel still needs consent before it loads. So you might not need to remove your banner, but you may need to change what it controls.

Ask whoever manages your site to list every cookie and tool, what each does, and whether data goes to another company. Then update your cookie notice to match.

Contact forms, enquiry forms and chatbots: what data are you collecting?

Most data protection problems on small sites are simple. Forms collect more than needed, or nobody remembers where the data goes.

Walk through each form and chatbot and ask:

1. Do we need every field? If you never use a phone number, remove it.
2. Where does the submission go? It may reach an inbox, a CRM, a spreadsheet and a chatbot provider.
3. Is there a link to the privacy notice near the submit button?
4. Is the email marketing box unticked by default? Pre-ticked boxes are not valid consent.
5. How long do we keep enquiries? Set a sensible period and stick to it.

Free-text boxes and chatbots deserve extra care. People sometimes type health details or personal problems into them. Add a gentle note such as "Please don't include sensitive details here" where it fits.

Updating your privacy notice without a lawyer's jargon

A good privacy notice answers simple questions in plain English. It does not need to be long. Check that yours covers:

• Who you are and how to contact you (include your company number and registered address if you are a limited company).
• What personal data you collect and why.
• Who you share it with, such as your email platform, payment provider or hosting company.
• How long you keep it.
• People's rights, including how to complain to you and to the ICO.
• Which cookies you use and how to change preferences.

Use short sentences and headings. Write "we use your email address to reply to your enquiry" rather than "we process your data for the purpose of correspondence". Also check the date on the page. If it predates 2026, it probably lacks the complaints information.

Why the rules on automated decisions matter if you use AI tools

Most small business websites do not make big automated decisions. But AI tools are spreading, so it is worth a quick check.

Under the old rules, solely automated decisions with legal or similarly significant effects were prohibited unless a narrow list of conditions applied. The new regime is more flexible. Businesses may rely on lawful bases such as legitimate interests where no special category data is involved. They must still provide safeguards, including meaningful information about the decision, a chance to make representations, human intervention and the ability to challenge the outcome.

In practice, a chatbot answering opening-hours questions is low risk. A tool that automatically rejects applications, approves credit or denies refunds with no person involved is a different matter. If you use anything like that, make sure a real person can review decisions, and tell customers how to ask for that.

When to get proper legal advice

A checklist helps you spot gaps, but some situations need a professional. Consider speaking to a data protection solicitor or consultant if:

• You handle health, children's, financial or other sensitive information.
• You use AI tools to make decisions about people, such as hiring or credit.
• You send data outside the UK and are unsure of the rules.
• You have had a data breach or a complaint you are unsure how to handle.
• You work in a regulated sector with its own complaints rules.

A 15-minute website data check

Set a timer and work through this list. Note anything you cannot answer, and pass it to whoever looks after your site.

1. Minutes 1–3: Privacy notice. Is it easy to find in the footer? Does it mention the right to complain to you, and the ICO?
2. Minutes 4–6: Complaints route. Is there a clear email address or form? Who reads it, and who covers holidays?
3. Minutes 7–9: Cookies. Open your site in a private window. Does anything advertising-related load before someone chooses? Is there an easy way to object to analytics?
4. Minutes 10–12: Forms. Submit a test enquiry. Does it link to your privacy notice? Is marketing opt-in unticked?
5. Minutes 13–14: Tools. List chatbots, plugins and AI tools that touch visitor data. Do you know where that data goes?
6. Minute 15: Next steps. Write down three fixes and who will do them by when.

If you would like a hand reviewing your forms, cookie set-up or privacy pages, Envicblue can help with the website side of this. We will work through it in plain English. For legal questions, we would suggest speaking to a qualified adviser.

Frequently asked questions