Start with a general picture, then check the official guidance
This guide is a general overview, not legal advice. The UK's data protection rules are set out in the UK GDPR and the Data Protection Act 2018, and the rules on cookies and electronic marketing are in the Privacy and Electronic Communications Regulations, usually called PECR. The regulator is the Information Commissioner's Office, which publishes practical guidance for small organisations at ico.org.uk. The rules have been updated in recent years, so always check the ICO's current guidance, or speak to an adviser, for your own situation.
For most small business websites, the work comes down to knowing what personal data the site collects, having a reason to collect it, telling people about it clearly, keeping it secure and not keeping it longer than needed.
Step one: map what your site collects
You cannot describe what you do with data until you know what the site collects. Go through it systematically:
- Forms: contact, quote, booking, newsletter sign-up, job applications.
- User accounts: admin users, customers, members.
- Comments: names, emails and IP addresses stored by WordPress.
- Cookies and tracking: analytics, advertising pixels, embedded videos, maps, chat widgets and social buttons.
- Plugins: security plugins that log IP addresses, form plugins that store entries, email marketing integrations.
- Server logs and backups: your host's access logs and backup copies, which contain the same data as the site.
For each item, note what data it collects, why, where it is stored and who else can access it. This list becomes the basis of your privacy notice.
Contact forms and enquiries
Forms are the main way most business sites collect personal data. A few general principles apply:
- Ask only for what you need to deal with the enquiry. Extra fields mean extra data to protect.
- Explain what happens next near the form, with a link to your privacy notice.
- Keep marketing separate. If you want to add people to a mailing list, use a separate, unticked opt-in. Responding to an enquiry and sending marketing are different purposes, and PECR has specific rules for electronic marketing.
- Set a retention period for stored entries and delete old ones. Many form plugins can do this automatically.
- Protect the notifications. Form emails sit in inboxes indefinitely. Consider whether sensitive details should be included in the email at all.
The guide to WordPress contact forms covers the technical side of storage, spam and delivery.
Cookies and consent
Under PECR, you generally need consent before setting cookies or similar technologies that are not strictly necessary for the service the visitor asked for. Advertising and many tracking tools fall into that category. Strictly necessary cookies, such as those keeping a shopping basket or login working, do not need consent, though you should still explain them. Recent changes to the law have introduced some exemptions for certain low-risk uses, so check the ICO's current cookie guidance for what applies to your tools.
Practical steps for WordPress:
- Audit what is set. Open your site in a private window, use your browser's developer tools to view cookies and requests, and note what loads before anyone clicks anything.
- Remove what you do not need. Every tracking script you drop is one less thing to explain and seek consent for.
- Use a consent tool that actually blocks non-essential scripts until consent is given. A banner that informs but loads everything regardless does not do the job.
- Make refusing as easy as accepting, and let people change their choice later.
- Watch embeds. Embedded videos, maps and social feeds can set third-party cookies. Many consent tools can hold them back until the visitor agrees.
Plugins, processors and where data is stored
When a plugin or service handles personal data on your behalf, such as your host, an email marketing service, a form service or an analytics provider, it is usually acting as a processor. UK GDPR expects a written contract with processors. Most reputable providers include data processing terms in their standard agreements; check they exist and keep a copy.
Data location matters too. UK GDPR places conditions on transferring personal data outside the UK. Some destinations are covered by UK adequacy arrangements, and other transfers need appropriate safeguards. Ask your host and each service where data is stored and how transfers are covered, and record the answers. The ICO's guidance on international transfers explains the options.
Choose plugins with care. A plugin that sends data to its developer's servers, loads remote fonts or scripts, or stores detailed logs may need to be mentioned in your privacy notice. The guide on WordPress plugins every site needs helps keep that list short.
Security, breaches and the rest of your obligations
UK GDPR requires appropriate security for personal data. On a WordPress site, that means keeping software updated, using strong passwords and two-factor login, limiting admin accounts, using HTTPS, and keeping backups secure. See keep your WordPress site secure.
Other points to check with the ICO's guidance:
- Privacy notice: a clear page explaining what you collect, why, your lawful basis, how long you keep it, who you share it with and people's rights.
- Data protection fee: many organisations that process personal data must pay a fee to the ICO unless an exemption applies. The ICO has a self-assessment tool.
- Personal data breaches: some breaches must be reported to the ICO within 72 hours of becoming aware of them. Know in advance how you would recognise and handle one.
- Individuals' rights: people can ask for a copy of their data, or for it to be corrected or deleted. Know where their data lives on your site so you can respond.
A short review checklist
- List every form, plugin, script and service that touches personal data.
- Update your privacy notice to match.
- Check your cookie tool blocks non-essential scripts until consent.
- Confirm processor terms and data locations with your host and services.
- Set retention periods and delete old form entries and inactive accounts.
- Review the list whenever you add a plugin or service.
If you host with WP Web Hosting, the WP Managed plan keeps WordPress, theme and plugin updates done for you, which supports the security side, and enquiries land as client records in BonusFlow, so you have one place to find a person's details when they ask.
Frequently asked
Does my WordPress site need a cookie banner?
If it sets cookies or uses similar tracking that is not strictly necessary, you generally need consent under PECR. Check the ICO's current cookie guidance, as some low-risk uses may now be exempt.
Do I need a privacy notice for a simple contact form?
Yes. If the form collects personal data, people should be told what you do with it, why and for how long. A clear privacy notice linked near the form is the usual approach.
Does my web host need to be in the UK?
Not necessarily, but transfers of personal data outside the UK must be covered by adequacy arrangements or appropriate safeguards. Ask your host where data is stored and check the ICO's transfer guidance.
Is this guide legal advice?
No. It is a general overview. For your own situation, check the official ICO guidance or speak to a qualified adviser.
Your WordPress site, sorted.
Sign up in a minute. WordPress and Elementor are ready when you log in.
Get started