Privacy Policy for Small Businesses - What Do You Actually Need?
You don't need a complicated privacy policy. You need one that explains what your business actually does with people's information.
If you run a small business, you've probably wondered whether you need a privacy policy, what it should include and whether you can simply download a free template.
The good news? It doesn't have to be complicated.
But it does need to be right.
Does my small business need a privacy policy?
If your business collects or uses personal information, UK data protection law will generally require you to explain how that information is used.
That might include information about:
Customers and potential customers
Employees and job applicants
Suppliers and business contacts
People making enquiries through your website
Subscribers to your mailing list
The information you provide is commonly called a privacy notice, although many people know it as a privacy policy.
And here's something businesses often overlook:
You can need a privacy notice even if you don't have a website.
If you're collecting personal information through emails, booking systems, paper forms or face-to-face enquiries, you still need to consider how you explain your use of that information.
What should a privacy policy include?
Your privacy notice should explain, in straightforward language:
What information you collect
Names, contact details, booking information, payment records or anything else that identifies an individual.
Why you collect it
For example, to provide a service, respond to enquiries, manage bookings or meet legal obligations.
Your lawful basis for using it
UK GDPR requires an appropriate lawful basis for processing personal information. This isn't always consent.
Who you share it with
This could include payment providers, accountants, booking platforms, software suppliers or other organisations.
How long you keep it
You should explain your retention periods or how you decide when information is no longer needed.
People's rights
Including how they can request access to their information, ask for corrections or raise concerns.
How to contact you
People need to know who is responsible for their information and how to get in touch.
Depending on your business, your notice may also need to explain international transfers, automated decisions and other relevant processing.
Can I just use a free privacy policy template?
You can use a template as a starting point, but it needs to accurately reflect your business.
A template won't automatically know:
Which systems you use to manage customers.
Whether you send marketing emails.
What information your website collects.
Which third parties receive personal information.
How long you retain customer records.
Whether you process more sensitive information.
A privacy policy copied from another website could describe activities you don't carry out or miss activities you do.
The important thing isn't how impressive your privacy policy looks. It's whether it's accurate.
Does my website need a cookie policy too?
If your website uses cookies or similar technologies, you may need to provide information about them and obtain consent for certain types.
A privacy notice and a cookie notice serve different purposes.
Your website provider or cookie management service may already offer tools to help you manage cookies and consent. It's worth checking how these work before drafting additional documents.
Get a privacy policy written for your business
At Novo Data Services, we make data protection feel simple.
Instead of asking you to complete pages of complicated legal questions, we'll start by understanding what your business does and how you use personal information.
We'll prepare a draft privacy notice and come back to you to check the details before finalising it.
No unnecessary jargon. No generic copy-and-paste policy.
Your business. Your privacy policy.
£149 + VAT
A professionally drafted privacy notice tailored to your business.
Need something more complex? If your business processes sensitive information, operates in multiple countries or has unusual data-sharing arrangements, we'll discuss any additional work and costs before proceeding.