Terms & Privacy generatorUnited Kingdom
Website Privacy Policy (UK GDPR / DPA 2018)
A website and services privacy policy compliant with the UK GDPR and the Data Protection Act 2018, setting out lawful bases, data subject rights, retention, international transfers, and ICO complaint routes.
What is a Website Privacy Policy?
A Website Privacy Policy (UK GDPR / DPA 2018) is a website and services privacy policy compliant with the UK GDPR and the Data Protection Act 2018, setting out lawful bases, data subject rights, retention, international transfers, and ICO complaint routes.
Any organisation operating a UK-facing website or app that collects personal data, since UK GDPR Articles 13-14 legally require it to give a transparent privacy notice.
Website Privacy Policy template, current for 2026
Refreshed for 2026 with UK GDPR lawful bases, the full set of data subject rights, ICO as the supervisory authority, PECR cookie consent, international transfer safeguards (UK IDTA / addendum to the EU SCCs), and a reference to the Data (Use and Access) Act reforms for solicitor review.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Website Privacy Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Who is the data controller (the organisation whose privacy policy this is)? The controller decides why and how personal data is processed. This is the legal entity named throughout the policy and to the ICO.
- How would you describe the controller's legal form? (optional) A short descriptor of the entity's legal form, inserted after its name in the opening clause (for example 'private limited company' or 'limited liability partnership'). Leave blank to omit.
- Controller's company / registration number (optional) The Companies House (or equivalent registry) number identifying the controller. Publishing it aids transparency. Leave blank to omit.
- Under which jurisdiction's laws is the controller organised? (optional) The place of incorporation or organisation of the controlling entity, inserted into the opening clause. Leave blank to omit.
- What trading name, brand, or website does this policy cover? Users identify the policy by the brand or site they interacted with, which may differ from the registered legal name.
- What is the primary website URL this policy governs? The policy must state which website(s) and services it applies to so its scope is clear.
- What is the effective / last-updated date of this policy? UK GDPR transparency requires users to see when the policy was last revised.
- ICO registration reference / data protection fee number (optional) Most UK controllers must register with the ICO and pay the annual data protection fee under the Data Protection (Charges and Information) Regulations 2018. Publishing the reference adds transparency and reassures users. Leave blank to omit.
- Has the organisation appointed a Data Protection Officer (DPO) or a privacy contact? A statutory DPO is only mandatory in certain cases; otherwise a named privacy contact still satisfies the duty to provide accessible contact details.
- Name or title of the DPO / privacy contact Data subjects need a specific person or role to address rights requests and queries to.
- Privacy / data-protection contact email address UK GDPR requires an easy channel for data subjects to exercise rights and raise concerns.
- Contact phone number (optional) An optional secondary channel some users prefer for enquiries.
- Does the organisation need an EU (Article 27 EU GDPR) representative? If you offer goods/services to, or monitor, individuals in the EEA without an EU establishment, you must appoint an EU representative in addition to UK compliance.
- EU representative name and address The EU representative's details must be published so EEA data subjects and supervisory authorities can contact them.
- Which categories of personal data does the website/service collect? Article 13/14 transparency requires you to tell people the categories of data processed. Pick all that apply.
- Does the site process special category or criminal-offence data? Health, race, religion, biometric, sexual-orientation and criminal-offence data need an Article 9/10 condition and extra safeguards, so they must be disclosed separately.
- Describe the special category / criminal-offence data and why it is processed You must identify the specific data and the lawful Article 9/10 condition relied on (e.g. explicit consent, legal claims).
- How is personal data collected? Transparency requires disclosing whether data comes directly from the user, automatically, or from third parties.
- If data comes from third parties, list the sources and data involved Article 14 requires naming the source categories when data is not obtained directly from the individual.
- Select the processing purposes and their lawful bases to include Each purpose must map to an Article 6 lawful basis. Pick every purpose that applies; the template pairs each with its basis.
- Describe the legitimate interests relied on (if any) Where you rely on legitimate interests you must state what those interests are so users can assess the balancing test.
- Is providing personal data a statutory or contractual requirement, or is it voluntary? UK GDPR Article 13(2)(e) requires you to tell users whether they are obliged to provide their data and the consequences of not doing so. Choose the option that matches how the Website works.
- Does the website use cookies or similar technologies? PECR requires consent for non-essential cookies and clear information about all cookies used.
- Describe the cookie categories used and any analytics/marketing tools Users should know which categories (strictly necessary, functional, analytics, advertising) and providers are involved.
- How can users withdraw consent (for cookies and marketing)? The law requires that withdrawing consent be as easy as giving it. Describe the mechanism so users know exactly how to opt out.
- Is there a separate cookie policy / consent banner? If cookie details live in a separate document, the privacy policy should cross-reference it.
- Who receives or has access to personal data? Article 13 requires disclosing the recipients or categories of recipients of the data.
- Name key processors / sub-processors (optional) Naming specific processors increases transparency and trust; otherwise the categories above suffice.
- Are personal data transferred outside the UK? International transfers require a transparency statement and an appropriate safeguard (adequacy, IDTA, or UK Addendum to the SCCs).
- Which transfer safeguards do you rely on? Where you transfer to non-adequate countries you must name the mechanism (IDTA, UK Addendum, or a limited exception).
- Which countries or regions do data get transferred to? (optional) Naming destinations helps users understand where their data goes.
- How do you want to express data retention? UK GDPR requires stating the retention period or the criteria used to determine it.
- Set out your retention periods or criteria Be concrete, for example enquiry data for 24 months, client files for 7 years post-matter, and marketing data until consent is withdrawn.
- If you do direct marketing, which channels and controls apply? PECR governs electronic marketing. Users need to know how to opt out and if the soft opt-in applies.
- Is there any solely automated decision-making or profiling with legal/significant effect? Under the Data (Use and Access) Act 2025, significant decisions based solely on automated processing are permitted only with safeguards (information, human intervention, ability to make representations and to contest), with tighter rules for special category data; this must be disclosed.
- Describe the automated decision-making / profiling and its logic and effects Article 13(2)(f) requires meaningful information about the logic and the significance/consequences for the individual.
- Is the service directed at, or likely to process data of, children? The Age Appropriate Design Code and UK GDPR impose additional duties where children's data is processed. For online services offered directly to a child, section 9 of the DPA 2018 sets the age at which a child can consent for themselves at 13.
- At what age do you treat a child as able to consent to an online service? Section 9 of the Data Protection Act 2018 sets this threshold at 13 for information society services offered directly to a child. Below this age you must seek verifiable parental consent. Leave at 13 unless you have a specific, counsel-approved reason to set it higher.
- Include an invitation for users to raise concerns with you before the ICO? The Data (Use and Access) Act 2025 requires controllers to facilitate complaints made to them. You may also invite users to contact you first, but you cannot require it before they approach the ICO.
- Which UK jurisdiction governs this policy? Sets the governing law and courts for any dispute about the policy.
Frequently asked
About the Website Privacy Policy and how HDAi works.
What is a Website Privacy Policy (UK GDPR / DPA 2018)? +
A Website Privacy Policy (UK GDPR / DPA 2018) is a website and services privacy policy compliant with the UK GDPR and the Data Protection Act 2018, setting out lawful bases, data subject rights, retention, international transfers, and ICO complaint routes. Any organisation operating a UK-facing website or app that collects personal data needs one, because UK GDPR Articles 13-14 require a transparent privacy notice.
Is HDAi's Website Privacy Policy (UK GDPR / DPA 2018) legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it; how far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Website Privacy Policy (UK GDPR / DPA 2018)? +
You can generate and download the Website Privacy Policy (UK GDPR / DPA 2018) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Website Privacy Policy (UK GDPR / DPA 2018) current for 2026? +
Refreshed for 2026 with UK GDPR lawful bases, the full set of data subject rights, ICO as the supervisory authority, PECR cookie consent, international transfer safeguards (UK IDTA / addendum to the EU SCCs), and a reference to the Data (Use and Access) Act reforms for solicitor review.
How long does the Website Privacy Policy (UK GDPR / DPA 2018) take? +
Estimated time about 20 min (40 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Website Privacy Policy (UK GDPR / DPA 2018) work in the United Kingdom? +
Yes. This version is drafted for United Kingdom law and terminology. It is not a relabeled U.S. form. A licensed attorney coordinates with locally admitted counsel where required.
Other jurisdictions
The same document, drafted for another jurisdiction’s law.
Terms & Privacy
Related generators
Data-Subject-Request (DSR) Handling Procedure · Website Privacy Policy (Singapore, PDPA) · Email & Marketing Consent (CAN-SPAM + Opt-In) · Website Privacy Policy (DIFC) · All 124 →