What must a UK privacy policy contain?

Article 13 of the UK GDPR sets the list where personal data are collected from the data subject: the identity and contact details of the controller and any representative, the data protection officer's contact details, the purposes and legal basis for the processing, the legitimate interests where Article 6(1)(f) is relied on, the recipients or categories of recipient, and any third country transfer and its safeguards. Article 13(2) adds the retention period or the criteria for it, the data subject's rights, the right to withdraw consent, the right to make a complaint to the controller and to lodge a complaint with the supervisory authority, whether providing the data is a statutory or contractual requirement, and the existence of automated decision-making including profiling.

Did UK data protection and cookie law change recently?

Yes. The Data (Use and Access) Act 2025 amended both the UK GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003, with the relevant changes taking effect on 5 February 2026. Regulation 6 now provides that a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, except in the cases set out in a new Schedule A1, which lists consent, transmission, strict necessity, statistical purposes, appearance and functionality, and emergency geolocation.

Does a UK business have to register with the ICO?

It has to pay a data protection fee unless exempt. Section 137 of the Data Protection Act 2018 empowers the Secretary of State to make regulations requiring controllers to pay charges to the Commissioner, regardless of whether the Commissioner has provided or proposes to provide a service to the controller. The Information Commissioner's Office states that under the Data Protection (Charges and Information) Regulations 2018, organisations including sole traders that use personal information need to pay a data protection fee unless they are exempt.

Privacy Policy in the UK

A UK privacy notice is assembled from Article 13 of the UK GDPR, and its required content changed on 5 February 2026 when Data (Use and Access) Act 2025 amendments took effect, adding a right to complain to the controller itself. Cookies are handled separately under the Privacy and Electronic Communications Regulations 2003, which the same Act rewrote.

Download the UK drafting checklist (.docx)Where to read UK law

Governing law

Transparency obligations come from the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Cookies and similar technologies are governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003.

UK GDPR, Article 13

What a privacy policy has to contain in the UK

Where personal data are collected from the data subject the controller must give the identity and contact details of the controller and any representative, the data protection officer's contact details, the purposes and legal basis, the legitimate interests where Article 6(1)(f) is relied on, the recipients or categories of recipients, and any third country transfer and its safeguards.
UK GDPR, Article 13(1)
The controller must also give the retention period or the criteria for it, the rights of access, rectification, erasure and restriction, the right to withdraw consent, the right to make a complaint to the controller, the right to lodge a complaint with the supervisory authority, whether providing the data is a statutory or contractual requirement, and the existence of automated decision-making including profiling.
UK GDPR, Article 13(2)
A person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, except in the cases set out in Schedule A1. Regulation 6 was rewritten by the Data (Use and Access) Act 2025 with effect from 5 February 2026.
Privacy and Electronic Communications (EC Directive) Regulations 2003, reg. 6
Schedule A1 permits storage or access on consent given after clear and comprehensive information, for the sole purpose of carrying out the transmission of a communication, where strictly necessary for an information society service the user requested, and for statistical purposes or to adapt a website's appearance or functionality where the user gets clear information and a simple free means of objecting and has not objected.
Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1
The Secretary of State may by regulations require controllers to pay charges to the Information Commissioner, regardless of whether the Commissioner has provided or proposes to provide a service to the controller.
Data Protection Act 2018, s.137
The Information Commissioner's Office states that under the Data Protection (Charges and Information) Regulations 2018 organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt.
ICO, Data protection fee

What catches drafters out

Leaving a notice unrevised since before 5 February 2026. The UK GDPR Article 13(2) list now includes the right to make a complaint to the controller, which older notices do not mention.
UK GDPR, Article 13
Treating analytics cookies as automatically exempt. Schedule A1 permits statistical and appearance or functionality storage without consent only where the user is given clear and comprehensive information and a simple means of objecting free of charge, and has not objected.
Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1
Copying an EU GDPR notice. The UK text carries its own amendments, including those made by the Data (Use and Access) Act 2025 from 5 February 2026, so the two Article 13 lists no longer match.
Data (Use and Access) Act 2025