Free UK privacy policy generator.
Answer a few questions about your business and the generator puts together a privacy policy for your UK website, built from clauses I've written for each answer and updated for the Data (Use and Access) Act 2025. It's a starting point to check and adapt, not legal advice.
A starting point, not legal advice. The policy is put together from clauses I've written, chosen by your answers. Check it against what your business really does, and ask a solicitor if you handle sensitive information such as health records.
How it works
- Tell it about your business. Your name, address and the email address people should use for privacy questions.
- Answer a few questions about what you do with people's information: enquiries, customers, online payments, accounts, marketing emails, analytics and the companies that handle data for you.
- Copy or download your policy. Each section is chosen from clauses I've written for your answers, so it only covers what applies to you. Nothing is written by AI, and nothing you type leaves your browser.
Why you need a privacy policy
If your website collects any personal information, from a contact form to a newsletter sign-up to analytics, UK data protection law says you have to tell people what you do with it. A clear privacy policy is how most businesses do that.
It also helps people trust you. A policy that explains plainly what happens to someone's details reads very differently from pages of copied legal wording that obviously doesn't fit the business.
What your policy will cover
The generator only includes sections that apply to your answers. Depending on what you choose, your policy covers:
- Who you are and how to contact you about privacy
- What information you collect
- What you use it for, with the lawful basis for each use
- Marketing emails, and the rules you're following
- Cookies and analytics
- Who you share information with
- Transfers outside the UK, and how they're protected
- How long you keep information
- How you keep it secure
- People's rights, and how to use them
- How to complain, to you first and then to the regulator
- A "last updated" date
What changed with the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 updated UK data protection law in stages. The changes that affect most small business privacy policies are now in force, and the generator includes them:
- Complaints come to you first. Since 19 June 2026, you must give people a way to make a data protection complaint, acknowledge it within 30 days, look into it and tell them the outcome. People can still complain to the regulator, but it usually expects them to give you the chance to put things right first.
- Recognised legitimate interests. Since 5 February 2026, a new lawful basis covers a short list of purposes, such as reporting a crime to the police or protecting someone at risk of harm, without the usual balancing test.
- Some cookies no longer need consent. Since 5 February 2026, cookies used only to collect statistics about how your website is used, so you can improve it, or to remember a visitor's settings, don't need consent first. You must still explain them and give people a simple, free way to switch them off.
- Charities can use the soft opt-in. Since 5 February 2026, charities can email supporters and people who've shown an interest in their work without separate consent, as long as they offered a chance to opt out.
- A new structure for the regulator. From 30 September 2026, the Information Commissioner is replaced by the Information Commission, which is still known as the ICO. The policy uses the ICO name and mentions the new one, so it stays clear either way.
Marketing emails: consent or the soft opt-in
The Privacy and Electronic Communications Regulations (PECR) set the rules for marketing emails and texts. You can send them to people who've opted in, which means they actively agreed, for example by ticking an unticked box.
There's one exception, the "soft opt-in". You can email people who've bought from you, or asked about buying from you, about your own similar products and services, as long as you gave them a chance to opt out when you collected their details and in every message afterwards. Charities can now do the same for their supporters. Anyone else needs to have opted in.
Whichever you use, people can always tell you to stop, and you must.
Cookies and analytics
Your policy has to describe the cookies and similar technologies your website uses. The generator gives you four options for analytics:
- No analytics.
- Cookie-free analytics, such as Plausible or Fathom, which don't store anything on visitors' devices. I use Plausible on this site, so there's no cookie banner.
- Analytics cookies used only to improve your site. These can now be set without consent, but only if the information is used just for statistics about your own site, the provider doesn't use it for its own purposes, and visitors have a simple way to switch it off.
- Analytics cookies that need consent, such as Google Analytics behind a cookie banner. The policy doesn't claim this data is anonymous, because it usually isn't: tools like this collect cookie IDs and details about each visitor's device.
Advertising cookies and tracking pixels always need consent. If you're not sure what your website uses, ask whoever built it. The ICO's guidance on cookies and similar technologies goes into more detail.
Sending data outside the UK
Many everyday tools store or access data outside the UK. Mailchimp, Google Analytics and many other popular services are run from the US. That's allowed, but the transfer has to be protected. For most small businesses it will be one of these:
- UK adequacy regulations, which cover the European Economic Area and US companies that have signed up to the UK Extension to the EU-US Data Privacy Framework.
- The International Data Transfer Agreement (IDTA), or the UK Addendum to the EU's standard contractual clauses. Large providers usually include one of these in their data processing terms.
If you're not sure, answer "yes, or I'm not sure". The policy then explains how transfers are protected, and you can check your providers' terms.
Before you publish it
The policy is a starting point, not legal advice. Before you put it on your website:
- Read every section and change anything that doesn't match what your business does.
- Check your retention periods are ones you'll stick to.
- Set up the things it promises, such as an unsubscribe link in your emails, a cookie settings link if you use cookies, and a way to handle complaints.
- Delete the note at the top, which reminds you to do these checks.
- Get legal advice if you handle health, financial or other sensitive information, work with children's data or CCTV, or work in a regulated industry.
The generator can't see your website or your suppliers' terms, so it relies on your answers. If you're unsure about anything, the ICO's advice for small organisations is free and easy to read.
Last reviewed
Questions people ask
Does my business need a privacy policy?
Almost certainly, if you have a website. UK data protection law gives people the right to be told what you do with their personal information, and a contact form, an email address, a mailing list or analytics all involve personal information. A privacy policy on your website is the usual way to tell them.
What must a UK privacy policy include?
Who you are and how to contact you, what personal information you collect, what you use it for and the lawful basis for each use, who you share it with, whether it leaves the UK and how it's protected, how long you keep it, people's rights, and how to complain, both to you and to the regulator. The generator covers each of these for the answers you give.
Is this a GDPR privacy policy generator?
Yes, for the UK version of the GDPR. The clauses are written for UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, which is the law that applies to UK businesses. If you also sell to people in the EU, the EU's own GDPR can apply as well, and you may need a representative there, so check with a solicitor.
Is the policy this tool creates legally compliant?
It's a starting point, not legal advice. Whether a policy is accurate depends on what your business does, which a form can't fully know. Read every section, change anything that doesn't match how you work, and speak to a solicitor if you handle sensitive information such as health records, or work in a regulated industry.
Do I need a data protection officer?
Most small businesses don't. You need one if you're a public authority, if your core activities involve monitoring people regularly and on a large scale, or if they involve large amounts of sensitive information such as health data or criminal records. Even without one, someone in the business should be responsible for data protection.
What are the lawful bases for using personal information?
Consent, contract, legal obligation, vital interests, public task and legitimate interests. Since February 2026 there's also 'recognised legitimate interests', a short list of purposes such as preventing crime and safeguarding, where the law has already done the balancing test for you. Most small businesses rely on contract, legal obligation, legitimate interests and, for some marketing and cookies, consent. Your policy should say which basis applies to each use, not just list them all.
How long should I keep customer information?
Only as long as you need it. Companies must keep financial records for six years from the end of the financial year they relate to, and sole traders and partnerships for at least five years after the 31 January Self Assessment deadline. Marketing preferences last until someone unsubscribes, and you should then keep their email address on a do-not-contact list. For enquiries that never turn into work, a year or two is common. Pick periods you can stick to, and write them in your policy.
Do I need to mention cookies in my privacy policy?
Yes. You need to tell people about any cookies or similar technologies your website uses. Most still need consent before they're set, but cookies that are strictly necessary for the site to work don't, and since February 2026 nor do cookies used only to collect statistics to improve your site or to remember someone's settings, as long as you explain them and give people a simple way to switch them off. Advertising cookies always need consent.
Do I need a data protection complaints process?
Yes. Since 19 June 2026, every organisation that handles personal information must give people a way to make a data protection complaint, acknowledge it within 30 days, look into it and tell them the outcome. Your privacy policy is a good place to explain how.
How often should I update my privacy policy?
Whenever something changes: a new supplier, a new way of collecting information, or a change in the law. Otherwise, read it through once a year. Update the 'last updated' date each time, and tell people directly about changes that affect them significantly.
Want a second pair of eyes?
The tool gives you a start. If you'd like honest advice on your website, tell me what you're working on. No obligation.