UK Website Privacy Policy and Cookie Policy Solicitors
A website privacy policy is the public notice that explains what personal data a business collects, why, on what lawful basis, who it is shared with, how long it is kept and how individuals can exercise their rights; a cookie policy explains the cookies and similar technologies a site uses and how users can control them.
call 0207 100 2525 to speak to a specialist today. Available 24/7
Adam Bernard Solicitors drafts website privacy policies and cookie policies for UK businesses that comply with UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
Copied or generic policies are one of the most common compliance failures. They often describe processing the business does not carry out, and omit what it actually does.
Call 0207 100 2525 or book a free consultation — via Zoom, Teams, WhatsApp or Skype
What Must a Website Privacy Policy Include?
Under Articles 13 and 14 of the UK GDPR, a privacy policy must tell individuals who you are, what data you collect, your purposes and lawful bases, recipients, international transfers, retention periods and their rights, including the right to complain to the ICO. See the UK GDPR. A compliant website privacy policy should also:
Be concise, transparent and written in clear, plain language.
Explain any legitimate interests relied on.
Describe any automated decision-making.
Set out how to make a subject access request or other rights request.
Explain how to make a data protection complaint, which controllers must facilitate from 19 June 2026 under the Data (Use and Access) Act 2025.
Cookie Rules: PECR Regulation 6
Under regulation 6 of PECR, you must tell users about cookies and similar technologies and obtain their consent, unless the cookie is strictly necessary or falls within another exemption. See the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Consent must meet the UK GDPR standard: freely given, specific, informed and unambiguous, with “reject” as easy as “accept”.
New Cookie Exemptions in 2026
The Data (Use and Access) Act 2025 added new exemptions from cookie consent, including for some statistical (analytics) purposes and website appearance and functionality, provided users are given clear information and a simple way to object. The ICO published its final guidance on storage and access technologies in 2026. Advertising and tracking cookies still require consent. Fines for PECR breaches now align with UK GDPR levels for breaches from 5 February 2026, making cookie compliance a higher-risk issue.
What a Cookie Policy Should Include
A cookie policy should list the cookies and similar technologies used, their purpose, who sets them, how long they last and how users can manage consent. It should match what your consent banner and website actually do. We recommend a regular cookie audit, as marketing tools frequently add new trackers.
Privacy Policy vs Data Protection Policy
Your privacy policy is public-facing. Your internal data protection policy tells staff how to comply. Most businesses need both. Website users should also be bound by clear acceptable use policies and, if you sell online, e-commerce terms and conditions.
Other Privacy Notices You May Need
Employee and job applicant privacy notices.
Customer privacy notices for offline services.
CCTV notices.
Children’s privacy information, if your service is likely to be accessed by children.’
Privacy Policy Checklist
A website privacy policy is compliant only if it matches what your business actually does.
Before publishing, confirm that the policy:
Identifies your business correctly, including your registered company details.
Lists every category of personal data collected through the site and offline, if covered.
Gives a purpose and lawful basis for each type of processing.
Names, or describes by category, the recipients of the data, including processors.
Explains international transfers and the safeguards used.
States retention periods or the criteria used to set them.
Sets out all relevant individual rights and how to exercise them.
Explains how to complain to you and to the ICO.
Cookie Banners: Common Mistakes
The most common cookie mistakes are setting non-essential cookies before consent, making “reject” harder than “accept” and using pre-ticked boxes. Banners should offer equally prominent accept and reject options, explain the purposes clearly and allow users to change their choices easily. A regular audit ensures new marketing tags do not fire before consent.
How Adam Bernard Solicitors Can Help
We draft tailored website privacy policies and cookie policies after reviewing what your site and business actually do, update existing policies for the 2026 changes through our contract redrafting service, and advise on cookie banner design. See all our commercial contract services.
Call 0207 100 2525 (24/7) or book a free consultation to discuss your contract.
This page is for information only and does not constitute legal advice.
Frequently Asked Questions
Is a privacy policy a legal requirement for a UK website?
Do I need consent for analytics cookies in 2026?
What is the difference between a privacy policy and a cookie policy?
Can I copy another website's privacy policy?
What are the fines for cookie breaches?
Request to book a Free Consultation
Our Clients Share Their Success Stories.
Good service 👍 👌 many thanks for the great service you have provided to us. Our visa got approved just within 2 weeks only because of your hardwork and subject matter expertise. I am very thankful to you
For me, it was the attitude towards the job the lawyers displayed. Totally unmatched. I've been in and out of law firms because of the divorce with my wife and other related issues but Adam Bernard Solicitors was it for me guys. The best!
I want to thank Adam Benard team, they really helped me in my process of purchasing a property, their team are listen and respond to their customers fast. I really love your service, thanks alot.
Adam Bernard team helped me to purchase the best property for the best amount of time for the best money i have . i personally love dealing with them and i thank the team for all the efforts they made to make the task better .
