Do I need a privacy policy?

And here's something that surprises a lot of small business owners:

You don't need a website to need a privacy notice.

Whether you're a hairdresser keeping appointment details, a tradesperson storing customer addresses, a café employing staff or a consultant maintaining client records, you're likely to have responsibilities under UK data protection law.

What is a privacy policy?

A privacy policy, more accurately called a privacy notice, explains how your business collects, uses, stores and shares personal information.

Under the UK GDPR, individuals have a right to be informed about how their personal data is used.

That means you can't simply collect information and assume people know what you're doing with it.

Your privacy notice helps people understand how their information is handled and what rights they have.

What should my privacy notice include?

Your privacy notice should explain:

Who you are: Your business name and contact details.

What information you collect: Such as names, email addresses, telephone numbers, payment details or employee information.

Why you collect it: For example, providing services, managing bookings, processing payments or employing staff.

Your lawful basis: The legal reason you're permitted to use the information.

Who you share it with: Such as accountants, payment providers, IT suppliers or other relevant organisations.

How long you keep it: Your retention periods, or how you determine them.

Whether information goes overseas: Including relevant international transfers and safeguards.

People's rights: Including how individuals can request access to their information or raise a complaint.

Additional information may be required depending on your activities, including where you obtain personal data from someone other than the individual concerned.

The important thing is that your notice reflects what your business actually does.

What is a lawful basis?

Under the UK GDPR, you need a valid lawful basis for processing personal data.

There are six lawful bases:

Consent: The individual has given valid consent for a specific purpose.

Contract: You need the information to fulfil a contract with the individual or take steps they have requested before entering one.

Legal obligation: You need to process the information to comply with a legal requirement.

Vital interests: Processing is necessary to protect someone's life.

Public task: Processing is necessary for an applicable public-interest task or official authority.

Legitimate interests: Processing is necessary for a legitimate interest, provided the relevant legal conditions are met and individuals' interests, rights and freedoms do not override it.

Not every business will use all six, and different activities may require different lawful bases.

For example, using a customer's address to deliver something they've ordered may be necessary for a contract, while retaining certain financial records may be necessary to comply with a legal obligation.

Consent isn't automatically required every time you collect personal data. The important thing is identifying the correct lawful basis for each purpose and explaining it clearly.

What if I don't have a website?

You still need to provide privacy information where the law requires it.

This is one of the biggest misconceptions we encounter with small businesses.

A privacy notice isn't a website requirement. It's a data protection requirement.

If you collect personal information through telephone calls, paper forms, emails, face-to-face appointments or handwritten booking diaries, the obligation to be transparent still applies.

The good news is that you don't need a website to provide a privacy notice.

You could:

Display a printed privacy notice in your premises.

Include it with customer registration or booking forms.

Attach it to emails or provide it as a PDF.

Give customers a printed copy when they provide their details.

Explain key information verbally and make the full notice easily available.

For example, a beauty salon taking appointments by telephone might explain where customers can obtain its privacy notice and keep printed copies available at reception.

A tradesperson could provide privacy information alongside a quotation or booking confirmation.

The important thing isn't where your privacy notice lives. It's whether people receive the information they need, at the appropriate time, in a way they can understand.

When should I give somebody my privacy notice?

Generally, you should provide privacy information when you collect personal data directly from someone.

If you obtain their information from another source, different timing rules apply. In many cases, you must provide the information within a reasonable period and no later than one month, although there are exceptions.

And here's another common misconception: putting a privacy notice on your website isn't necessarily enough.

You should actively make people aware of it and ensure they can access it easily.

Do I need a separate employee privacy notice?

If you employ people, you'll generally need to explain how you use their personal data too.

Employee information may include bank details, salary information, absence records, emergency contacts, performance information and sometimes sensitive health information.

The purposes, lawful bases, retention arrangements and recipients may be different from those relating to customers.

A separate employee privacy notice is often the clearest way to explain this.

Can I copy another business's privacy policy?

You can look at examples to understand how privacy notices are structured, but copying another business's notice is unlikely to be appropriate.

Their suppliers, systems, lawful bases, retention periods and processing activities may be completely different from yours.

For example, your notice shouldn't claim that you never share personal information with third parties if you use an external payroll provider, accountant or cloud-based customer management system.

A privacy notice should describe your actual activities, not what another business happens to do.

Is a privacy notice the same as a Data Protection Policy?

No. They serve different purposes.

A privacy notice tells individuals how their personal data is used.

A Data Protection Policy explains how your organisation manages personal data internally, including responsibilities, standards and procedures.

You may need both, but having one doesn't automatically replace the other.

How Novo can help

At Novo Data Services, we help businesses understand their data protection responsibilities without unnecessary complexity.

We can prepare privacy notices tailored to how your business actually collects and uses personal information, whether you have a website or not.

We also offer a GDPR Ready Pack (£495 + VAT) containing ten tailored policies and practical documents to help businesses establish appropriate internal data protection arrangements.

Privacy notices are available separately because they need to reflect your specific processing activities and how you communicate with the people whose information you hold.

Making data protection feel simple.