If your website collects any personal information, names, email addresses, postal addresses, even IP addresses, UK GDPR requires you to have a privacy policy. This applies to almost every business website, not just online shops.
What has to be in it
A proper privacy policy needs to set out what personal information you are collecting, what purpose you are collecting it for, how long you will keep it, and who, if anyone, you share it with.
Only collect what you need
UK GDPR only allows you to collect information that is actually necessary for the service you are providing. Asking a customer for their age when you are selling a product with no age restriction, for example, is not something you are entitled to ask for.
What happens if you do not comply
Non-compliance can carry fines of up to 4% of turnover, which makes getting this right worth the effort.
Getting it right
- Use a proper generator built for the job, such as Termageddon, rather than a generic free template
- Display the policy prominently, usually linked from the footer of every page
- Keep it updated as regulations change
- Be wary of free templates: they are rarely specific to your jurisdiction or business model, and they do not update themselves when the law changes
If you are not sure whether your current policy covers what it needs to, we are happy to take a look.