Website legal requirements UK: what a small business site has to show.

A UK business website has to do four things by law: say who is behind it, explain what it does with personal data, ask before it sets most non-essential cookies, and give customers set information before they buy online. For a five-page site for a plumber in Neath or a salon in Carmarthen, that comes down to a few lines of text in the right places and one decision about cookies. This guide lists what the rules ask for, where each one comes from, and a ten-minute check you can run on your own site. It is a plain-English summary, not legal advice.

What the law asks for, at a glance

What your site needs	Who it applies to	Where the rule comes from
Company name, number, registered office and where it is registered	Every limited company	Trading disclosures regulations 2015
Business name, a geographic address and an email address	Anyone trading online, sole traders included	Electronic Commerce Regulations 2002
VAT number	VAT-registered businesses	Electronic Commerce Regulations 2002
A privacy notice	Anyone collecting personal data, a contact form included	UK GDPR
Consent before non-exempt cookies	Any site using them	Privacy and Electronic Communications Regulations
Pre-order information and a right to cancel	Anyone taking orders online	Consumer Contracts Regulations 2013
Genuine reviews only	Anyone publishing reviews	Digital Markets, Competition and Consumers Act 2024

Nothing in that table requires a page called "terms and conditions". More on that below.

Your business details: the part most small sites get wrong

If you trade as a limited company, GOV.UK is specific. On your website you must show:

• the company's registered number
• its registered office address
• where the company is registered (England and Wales, Scotland or Northern Ireland)
• the fact that it is a limited company, usually by giving the full name including "Limited" or "Ltd"

This catches out businesses that trade under a different name from the company. If the sign above the door says one thing and the certificate of incorporation says another, the website needs both.

Sole traders have no company number to show, but the Electronic Commerce Regulations still apply to anyone offering a service online. They ask for your name, the geographic address where the business is established and contact details "including his electronic mail address", all in a form that is "easily, directly and permanently accessible". A contact form with no email address and no postal address does not meet that. If you are registered for VAT, the same regulation asks for the VAT number. If you belong to a regulated profession or a public trade register, it asks for those details too.

For a made-up company, the whole lot fits in two lines at the foot of every page:

Your Company Ltd · Registered in
England and Wales · Company no.
01234567 · Registered office:
1 Example Street, Neath SA11 1AA
VAT no. GB 123 4567 89
hello@yourcompany.example

One Welsh detail: most companies based in Wales are registered in "England and Wales". The Companies Act also lets a company be recorded as a Welsh company, meaning its registered office is to be situated in Wales. Your certificate of incorporation and your Companies House record show which you are, so copy the wording from there instead of guessing.

Prices: say whether VAT and delivery are included

The same regulations say that where you refer to prices, they must be indicated "clearly and unambiguously" and must show whether they include tax and delivery costs. A bare "from £500" does not do that.

This is why every price on our own site has "+VAT" beside it and the foot of every page says "All prices exclude VAT". We sell to businesses, so ex-VAT prices are what our customers expect. If you sell to the public, the price a customer sees should be the price they pay.

If you are planning a new site and want these details built in from the first draft, start a project and tell us how you trade. We quote a fixed price before any work starts.

A privacy notice, if you collect any personal data

A contact form collects a name, an email address and usually a phone number. That is personal data, so the site needs a privacy notice. The Information Commissioner's Office (ICO) lists what a small business should have to hand before writing one:

• your full contact details
• the types of personal data you collect
• where you got it, if not from the person
• why you have it and what you do with it
• your lawful basis
• who you share it with
• how long you keep it

It must also explain people's rights and how to complain. The ICO has a free privacy notice generator aimed at small businesses and sole traders, and for a brochure site with one enquiry form it is a sensible place to start.

Two practical points. First, the notice has to stay true. On 10 November 2026 we began logging the internet address of visitors who arrive from our adverts, to spot fraudulent clicks, and we updated our privacy page the same day to say so. A privacy notice written at launch and never touched again is usually wrong within a year, because the site has gained a booking tool, a newsletter or an analytics service since.

Second, there is a fee. Businesses and sole traders that process personal data must pay the ICO a data protection fee unless they are exempt. GOV.UK puts it at £52 or £78 a year for most organisations, and the ICO has a self-assessment that tells you whether you need to pay. Your name and address then appear on a public register, so if you work from home, GOV.UK suggests giving a PO box or alternative address.

Cookies: what changed, and what still needs a yes

The cookie rules were loosened by the Data (Use and Access) Act 2025, and the ICO finalised its guidance on 29 April 2026. There are now five exceptions to the rule that you must ask first. The two that matter to a small business site are these:

• Strictly necessary. Things the visitor's own request depends on, such as a shopping basket, a login, or remembering their cookie choice.
• Statistical purposes. Counting visits to improve your own site, which the ICO also calls the analytics exception.

The second one is narrower than it sounds. The ICO says it is about "how your service is used, not about who uses it". You must still tell visitors clearly what you are doing and give them a simple, free way to object. Any outside analytics provider may only act on your behalf, and the results must be aggregate figures that cannot identify anyone.

What the site does	Consent needed?
Remembers the basket or a login	No
Remembers the visitor's cookie choice	No
Counts page visits in aggregate, with a notice and a way to object	No
Measures whether a visitor clicked one of your adverts	Yes
Shares conversions with an advertising partner	Yes
Tracks people across other sites	Yes
Any online advertising purpose	Yes

The ICO is blunt about the last rows: the statistical exception "does not apply to purposes related to online advertising". So a business that runs Google Ads and wants to know which advert produced an enquiry still needs a yes from the visitor.

That is our own position. We run Google Analytics and measure our adverts, so our banner asks, with separate switches for analytics, marketing and preferences, and nothing non-essential loads until the visitor chooses. Our page counter from Vercel uses no cookies at all, and we keep it behind the same switch anyway.

A privacy notice written at launch and never touched again is usually wrong within a year.

If you take orders or payments online

Selling through the site brings a longer list. GOV.UK says that before an order is placed you must, among other things:

• make it clear the customer has to pay when they place the order, for example with a "pay now" button
• show how they can pay, the delivery options and the delivery cost
• list the steps involved in placing an order
• give the total price, or how it will be calculated
• give your email address, and your VAT number if you are registered
• make sure customers can store and reproduce your terms and conditions

After the order you must confirm the contract as soon as possible, and deliver goods within 30 days unless you have agreed otherwise.

Customers can cancel up to 14 days after delivery without giving a reason. If you do not tell them about that right, they can cancel at any time in the next 12 months. There are exceptions, including goods and services worth £42 or less, and extra rules for downloads and streaming. GOV.UK also warns that breaking the distance selling rules can lead to compensation, an unlimited fine or a prison sentence, so read the full guidance before you launch a shop. Our guide to ecommerce website design in Wales covers the build side.

Do you need a terms and conditions page?

For a site that only describes your services and takes enquiries, no law requires one. The legal work is done by your business details, your privacy notice and your cookie choices.

Once the site takes orders, terms stop being optional in practice. The information you must give before a sale has to live somewhere, and GOV.UK says customers must be able to store and reproduce your terms. A terms page is where returns, delivery, cancellation and complaints are set out.

Two cautions. Do not copy another business's terms: they describe someone else's business and they are someone else's copyright. Treat a template as a first draft. If real money rests on the wording, such as deposits, cancellations or bespoke goods, paying a solicitor to read it once is cheap next to one dispute.

Reviews and testimonials on your own site

Since the Digital Markets, Competition and Consumers Act 2024, fake reviews are banned outright. The Competition and Markets Authority's guidance covers three things: reviews that claim to be genuine and are not, reviews that hide the fact they were paid for or rewarded, and star ratings or review counts built on either.

It applies to any business that publishes reviews, "from any source", and that includes a testimonials section on your own website. You are expected to take "reasonable and proportionate steps" to keep fakes out. For a small business that means quoting real customers word for word, saying so if a review was given in return for a discount or a freebie, and never writing your own. The reviews on our site are quoted verbatim with the customer's name and business beside them. Our guide to getting Google reviews covers how to ask.

Accessibility is a legal duty too

The Equality Act 2010 expects service providers to make reasonable adjustments for disabled people, and that reaches websites. It is a subject of its own, covered in our guide to website accessibility and UK law.

A ten-minute check of your own site

Open your site on your phone and work down this list.

1. Scroll to the foot of the home page. Can you see the legal name of the business, an address and an email address? For a limited company, look for the company number, the registered office and where it is registered.
2. Look at any page with a price. Does it say whether VAT is included?
3. Find the privacy notice. Is it linked from every page, and does it mention every tool the site uses now, including the form, any booking system and any newsletter?
4. Open the site in a private window. Does a cookie banner appear before anything is switched on, and is saying no as easy as saying yes?
5. Read your testimonials. Could you name the customer behind each one?
6. If you sell online, place a test order. Is the total price, including delivery, clear before the pay button?

If any answer is no, the fix is usually a line of text. The responsibility is yours and not your web designer's, because it is your business that is named on the site. A good designer will still ask for these details at the start, and the first meeting is the place to settle who supplies what. Jason Berry of Smokin' Joints Carpentry wrote of his build: "From the first meeting to set the expectations through to design and completion, Jack made it simple for me."

Put the legal details in your website brief so every quote covers them. If you would like us to build the site, start a project or ring 07916 214 843. Our prices are published, from £675 +VAT, and there is no obligation. What a build includes is set out on our web design service page.