Contact forms, newsletter sign-ups, analytics, embedded maps and videos, social media buttons. Each one can collect personal data or place cookies on your visitors' devices. UK law says you must tell people what you collect, and ask first before using non-essential cookies.
If your site collects names, email addresses or even IP addresses, UK GDPR applies. A single contact form is enough.
The Data (Use and Access) Act 2025 raised the maximum fine for breaking the UK cookie rules to £17.5 million or 4% of annual turnover, in line with UK GDPR. The ICO says it takes a risk-based approach, but the rules are the same whatever your size.
Add a plugin, a tracking script or a new form and your cookies change. A policy written once and forgotten stops being accurate.
A banner styled to match your site, giving visitors a clear choice about non-essential cookies.
Cookies are scanned and sorted, and non-essential scripts are held back until a visitor agrees. No custom code needed.
Visitors can change their cookie choices at any time from your site.
Generated from the cookies your site actually uses, and updated when they change.
Built around what your site really collects, such as enquiry forms, orders and analytics, and designed around UK GDPR requirements.
For sites that sell, take bookings or give advice online.
You go through Termly's setup wizard, which asks about your business, what your website collects and who your customers are.
Termly builds your privacy policy, cookie policy and cookie banner around your answers.
Once you've finished, I connect everything to your website and switch it on.
The scanner picks up new cookies automatically and updates your banner and policies.
From sole trader to large corporate businesses, if visitors can send you a message, buy something or sign up, your website is collecting personal data, and UK GDPR applies.
Yes, if your site collects personal data. That includes names and email addresses, and online identifiers such as IP addresses and cookie IDs can count too. Size doesn't matter, and a contact form or analytics can be enough. It applies to business-to-business sites as well, because the data is about people.
You need consent before setting any cookie that isn't strictly necessary, and the ICO is clear that carrying on browsing doesn't count as consent. Under recent UK law changes, some low-risk cookies, such as certain analytics, may no longer need consent, but you must be transparent and offer a simple way to opt out. Advertising and marketing cookies still need consent. If your site uses any of these, you will usually still need a banner.
Almost certainly. The ICO says any business that holds personal data, such as names and email addresses, needs to give people privacy information, and there are very few exceptions. It covers who you are, what you collect and why, your lawful basis, who you share it with, how long you keep it, people's rights and how to complain.
A privacy policy covers the personal data your business handles. A cookie policy explains which cookies and similar technologies your site uses and why. If your site uses non-essential cookies, you need to tell visitors about them as well as get their consent.
A generic template is a starting point, but it can't know which cookies your site actually sets or what your forms collect. A tool that scans your site and asks about your business can reflect what you really do, and be kept up to date as things change.
The Data (Use and Access) Act 2025 raised the maximum fine for breaking the UK cookie rules to £17.5 million or 4% of annual turnover, in line with UK GDPR. These are ceilings, not typical outcomes. The ICO says it takes a risk-based approach, and it usually starts with guidance and enquiries before fines.
Many do. Organisations that use personal data, sole traders included, must pay the ICO's annual data protection fee unless they are exempt. The amount depends on your size. The ICO has a short online check at ico.org.uk to tell you.
The UK has its own version, UK GDPR, which works alongside the Data Protection Act 2018. If you offer goods or services to people in the EU, EU GDPR may apply to you too. The EU has also not relaxed its cookie rules.
No. I build and manage the technical side of compliance. For legal questions about your business, speak to a solicitor.
The answers above are general information about UK data protection law, checked against ICO guidance in October 2026. They are not legal advice, and the law and guidance change. SushiWP and Termly are not law firms, and no tool or service can guarantee compliance. Whether your website meets the law depends on your business, so take legal advice if you are unsure.
Tell me a little about your website and what you're after. I'll reply personally and we'll take it from there.
