This article was last updated 0 months ago and may not represent current law.
The Information Commissioner’s Office (ICO) have a tool to help small businesses create privacy notices for their business.
The tool can be accessed here: https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/create-your-own-privacy-notice/
The ICO tool can help you create bespoke privacy notices for the benefit of your staff, external website visitors and suppliers. Articles 13 and 14 of the UK GDPR include the requirements for controllers to provide privacy information to data subjects (right to be informed).
The generator tool has been specifically designed for sole traders and start-ups, as well as small and medium-sized businesses and charities to help ease the cost and burden to them of complying with the UK GDPR’s fair processing, transparency and accountability requirements, and the right of data subjects to be provided with detailed information about the controller’s personal data collection and data processing activities.
The ICO updated the generator in July 2026 to take account of the Data (Use and Access) Act 2025. Since 19 June 2026 a privacy notice also has to tell people that they can complain to you about how you’ve handled their data, and if someone does complain you have to acknowledge it within 30 days, so if you made your notice before then it’s worth running it through the tool again.
I’ve taken a look at the privacy notices generated and for many businesses they may do the trick. However, given the fines the ICO can issue, it may be worth having an expert carry out a full data protection assessment for you.
Written by Steven Mather, a business solicitor acting on company sales and purchases. This is general information about the law, not legal advice on your situation. Law correct as at .
