Website Legal Requirements UK: What You Must Show
Nobody starts a business because they were excited about compliance. You wanted to fit kitchens, or cut hair, or bake things. Then somewhere between registering the company and getting the website up, a nagging voice starts asking whether you’re supposed to have a privacy policy, and whether that cookie banner everyone has is actually the law or just something websites do.
The honest answer is that the list is shorter than you fear and duller than you’d hope. Here’s what a normal UK small business site actually has to show, in plain terms.
One thing first, said once and meant: this is general information from a web company, not legal advice. The authoritative sources are the ICO for privacy and cookies, Companies House for company details, and gov.uk for consumer rules — all free to read, and none of them will sell you anything.
Who you are: the business identity rules
This is the one most small sites get wrong, and it’s the easiest to fix.
If you’re a limited company, UK company law requires your website to state four things:
- your registered company name (the full one, “Ltd” and all — not just your trading name)
- your company registration number
- your place of registration — for most people, “Registered in England and Wales”
- your registered office address
Note that word website. Plenty of owners put this on their invoices and assume that’s the job done; it has to be on the site too. It doesn’t have to be prominent — a small block in the footer, or a line on a “Legal” page, is the near-universal convention and it’s fine.
If you’re a sole trader or a partnership trading under a name that isn’t simply your own — so “Riverside Joinery” rather than “Tom Wilkinson” — you generally need to show your own name and an address where documents can be sent to you. That address is for correspondence — it doesn’t have to be where you work, and if you run the business from your kitchen table you aren’t obliged to publish your home address. A serviced address is a normal and legitimate way round it.
If you’re VAT registered, your VAT number goes on the site as well.
If your trade is regulated — gas, electrics, financial advice, lettings, anything with a licence or a registration number — say which body regulates you and quote your number. That’s both a requirement in most of those trades and, frankly, a selling point.
Add a real contact route while you’re at it: an email address that a human reads. There’s a good argument for that being a proper business address rather than a Gmail one, which we’ve made at length in do I need a business email address.
Your privacy notice
If your website collects any personal data at all, you need a privacy notice under UK GDPR.
And “collects personal data” catches almost everyone. A contact form collects it. So does a mailing list sign-up, and so does analytics software, in most configurations. A genuinely static brochure with no forms, no analytics and no embeds arguably doesn’t process personal data at all — but that’s rarer than you’d think, and the notice costs you nothing.
A privacy notice should tell people, in language they can actually follow:
- who you are and how to contact you
- what personal data you collect, and how
- why you collect it, and what your lawful basis is
- who else sees it — your email provider, your booking system, your accountant’s software
- how long you keep it
- what rights people have over their data, and how to complain to the ICO
One warning: don’t copy a big company’s privacy policy, and be wary of generators that spit out ten pages of American boilerplate mentioning CCPA and Delaware. Both describe someone else’s systems, not yours. A short, true, one-page notice beats a long, borrowed, false one every time — and the ICO publishes template material aimed at small organisations, which is the sensible starting point.
Cookies, and the banner nobody enjoys
The rule under PECR is that you need consent before setting non-essential cookies. Essential ones — the thing that remembers what’s in a basket, or keeps you logged in — don’t need consent.
The catch is that analytics cookies count as non-essential. So do the ones dropped by an embedded YouTube video, a Facebook pixel, a live chat widget, or an embedded map. Most sites have at least one of those, which is why most sites have a banner.
But the flip side is genuinely worth knowing: if your site sets no non-essential cookies, you don’t need a cookie banner at all. A clean brochure site with no tracking, no pixels and no third-party embeds can legitimately go without one. If you do add analytics later, that’s when the banner arrives.
If you do need one, it has to work properly: no pre-ticked boxes, refusing must be as easy as accepting, and nothing non-essential fires until someone agrees. A banner with only an “Accept” button isn’t compliant, it’s just decorative.
If you sell or take bookings online
Selling to consumers at a distance brings in a further set of rules. The short version: before someone pays, they need to know the total price including delivery, who they’re buying from, how to cancel, and what your returns process is. Most consumer distance sales carry a 14-day cancellation right, with exceptions for things like personalised goods. That’s a whole article in itself and gov.uk covers it well — and if you only take enquiries rather than payments, none of it applies to you.
The quick version
| Thing | Who needs it |
|---|---|
| Registered name, number, place of registration, registered office | Every limited company |
| Your name + an address for correspondence | Sole traders and partnerships trading under a business name |
| VAT number | Anyone VAT registered |
| Regulator or licence number | Regulated trades |
| Privacy notice | Anyone whose site collects personal data — so, nearly everyone |
| Cookie consent banner | Only if you set non-essential cookies |
| Terms, cancellation and returns info | Anyone selling or taking payment online |
| Accessible design | Not a tick-box for most private businesses, but you have duties under the Equality Act and it’s the right thing to do anyway |
That last row deserves a sentence. Accessibility isn’t a document you add, it’s how the site is built — readable text, sensible contrast, keyboard navigation, alt text on images. It overlaps almost entirely with building properly for phones, which you want anyway.
Doing it once, properly
Practically, all of this lives in three places: a footer block with your business details, a privacy page, and — only if you need it — a cookie banner. Half an hour of work, and then it’s done for as long as your details don’t change.
Here’s where we declare our interest, because we’re about to mention what we do. When our team designs and builds a site, the footer details, the privacy page and the cookie handling go in as standard — configured for your actual setup, not pasted from someone else’s. We build from your Google Business Profile, on a free .co.uk domain, live within 48 hours of the domain being registered, with no build cost. Our checklist for getting a new UK business online is the wider picture, and you can claim a free website when you’re ready.
If you already have a site, do this now: open it, scroll to the bottom, and see whether your company number is there. It takes ten seconds, and for a surprising number of British business websites the answer is no.