Does my website need a privacy notice?

Corven guide, 7 October 2026

If your website collects personal data from visitors, such as names and email addresses through a contact form or an order page, you must tell them how you use it at the time you collect it. That duty is in Article 13 of the UK GDPR, and a privacy notice is how most websites meet it.

What the notice must say

Article 13(1) requires the controller to give, at the time the data is obtained, its identity and contact details, the purposes of the processing and the legal basis for it, the legitimate interests relied on where that is the basis, the recipients or categories of recipients, and any intended transfer of the data outside the United Kingdom.

Article 13(2) adds the further information needed for fair and transparent processing. That includes how long the data will be kept, or the criteria used to decide, the right to ask for access, correction, erasure or restriction and to object, the right to withdraw consent where consent is the basis, the right to complain to the controller and to the Commission, and whether the visitor has to provide the data and what happens if they do not.

When it does not apply

Under Article 13(4), the duty does not apply to the extent that the person already has the information. In practice, a website that collects any personal data should have a notice that covers everything in Articles 13(1) and 13(2).

This guide is general information about the law of England and Wales. It is not advice on your situation.