Guide · Updated October 2026

What Does GDPR Mean for My Small Business Website?

General information on how GDPR affects small business websites: contact forms, cookies, analytics, privacy policies and data security. Not legal advice.

Short answer: If your website collects personal data from people in the UK or EU, such as names and emails through a contact form, GDPR (and the UK GDPR) applies. In practice that means telling people what you collect and why, only collecting what you need, keeping it secure, getting consent for non-essential cookies, and respecting people's rights. This is general information, not legal advice.

Does GDPR apply to my business?

GDPR is EU law, and the UK has its own near-identical version. It applies to organisations based in the UK or EU, and can also apply to businesses elsewhere that offer goods or services to people there or monitor their behaviour. Being small does not exempt you, although some record-keeping duties are lighter. If you serve only customers outside the UK and EU, other local privacy laws may apply instead, and many follow similar principles.

Where your website collects personal data

Personal data is anything that identifies a person. On a typical small business site, it shows up in more places than owners expect:

Contact and quote request forms.
Newsletter sign-ups.
Booking and payment systems.
Analytics tools that use cookies or IP addresses.
Embedded videos, maps and social media widgets that set third-party cookies.
Live chat tools.

The core principles in plain English

Have a lawful reason: for example, replying to an enquiry someone sent you, or consent for marketing emails.
Be transparent: explain in a privacy policy what you collect, why, how long you keep it and who you share it with.
Collect the minimum: a quote form rarely needs a date of birth.
Keep it accurate and do not keep it forever: set a sensible retention period.
Keep it secure: HTTPS, strong passwords, and trustworthy software providers.

SSL, secure forms and privacy pages set up from day one. Start with SiteDrum.

SiteDrum builds fast, mobile-first websites from $99 setup and $15 a month, with hosting, security, Google setup and support included. Already have a site that is slow or broken? Try Website Rescue or run our free speed test.

Practical steps for your website

Publish a clear privacy policy

Link it in your footer and next to forms. It should name your business, list the data you collect, explain why, say who processes it (like your email or booking provider) and tell people how to contact you about their data.

Handle cookies properly

Cookies that are strictly necessary for the site to work do not need consent. Analytics, advertising and many embedded tools usually do under UK and EU rules, which is why cookie banners exist. A good banner lets people accept or reject equally easily and does not load non-essential cookies before a choice is made.

Separate marketing consent

If you want to add enquirers to a mailing list, use an unticked opt-in checkbox. Do not assume that sending an enquiry means agreeing to newsletters.

Use HTTPS everywhere

A form that submits over plain HTTP sends personal data unprotected. An SSL certificate fixes that.

Check your suppliers

Your form tool, email platform and booking system process data for you. Choose reputable ones that offer data processing terms.

Respecting people's rights

People can ask to see the data you hold on them, correct it or have it deleted in many cases. Make sure you know where enquiry data ends up (your inbox, a CRM, a spreadsheet) so you can respond within the required timeframe.

In the UK, many businesses that process personal data also need to pay a data protection fee to the ICO. Check the ICO's guidance to see whether it applies to you.

All SiteDrum sites come with SSL and secure forms as standard. If you want to tidy up an existing site, contact us.

The bottom line

GDPR on a small business website comes down to transparency, minimal collection, proper cookie consent and security. Publish a clear privacy policy, use HTTPS, ask for marketing consent separately, and know where your data goes. For anything specific to your situation, take professional advice. This is general information, not legal advice.

Frequently asked questions

Does GDPR apply to small businesses?

Yes. GDPR and UK GDPR apply regardless of size if you process personal data of people in the UK or EU, though some obligations are lighter for small organisations. This is general information, not legal advice.

Do I need a cookie banner for GDPR?

If you use non-essential cookies such as analytics or advertising, UK and EU rules generally require consent, which is usually collected through a cookie banner.

Is a contact form covered by GDPR?

Yes. Names, emails and phone numbers are personal data, so explain how you use them in your privacy policy and keep them secure.

Do I need to pay the ICO fee?

Many UK businesses that process personal data must pay a data protection fee. Check the ICO website to see whether your business is exempt.

Want a website that brings you customers?

Tell us what you do on WhatsApp and we will send a fixed quote and a free mockup.

Get my free mockup

Our products

Starter website$99 setup, $15 a month Business website$249 setup, $29 a month Premium website$499 setup, $59 a month Website RescueFix a slow, broken or hacked site Free speed testCheck your site in seconds Sample websitesSee designs for your industry

Website design near you

Website design in London Website design in New York Website design in Toronto Website design in Southampton Website design in Wellington Website design in Sheffield Website design in Singapore Website design in Glasgow Website design in Seattle Website design in Manila All cities →

SiteDrum home · All guides · Sitemap · Contact us