Plain English Beats a Copied Template: Writing a Privacy Note People Might Actually Read

There's a particular kind of page that appears on almost every small business website, usually at the bottom, usually in grey. It starts with "We are committed to safeguarding the privacy of our users" and then keeps going for two thousand words in a language no one has spoken since the 1990s.

Nine times out of ten, it was copied from somewhere. Possibly from a competitor. Possibly from a template site that came with the domain. Either way, it describes a business that isn't yours — with a data protection officer you don't have, a server in a country you've never visited, and a mailing list you've never run.

That's not just untidy. If someone reads it and believes it, it's misleading. And if a customer asks a simple question — "do you sell my email address?" — a copied notice gives them no useful answer at all.

What most UK small business sites genuinely need to say

The good news is that for the average sole trader, studio or shop, the honest answer is short. You're probably collecting a handful of things:

• Enquiry form details — name, email, maybe a phone number and a message.
• Order or booking details, if you sell anything online.
• Email addresses for a newsletter, if you run one.
• Basic analytics — how many people visited, which pages they looked at.
• Cookies from analytics, an embedded map, or a booking widget.

That's usually the whole picture. A notice that covers those five things, in plain sentences, will be more accurate than a template covering fifty things you don't do.

Three headings do most of the work:

1. What we collect and why — one line per item. "We ask for your email so we can reply to your enquiry."
2. Who else sees it — name the tools. If your form goes through a form service, say which. If you use an email platform, name it. If your site has an embedded map, mention it.
3. How long we keep it, and how to ask us to delete it — even "we keep enquiries for two years, then delete them" is a real answer.

Add a line on how to complain, an email address that someone monitors, and the date you last updated it. That's the core of it.

Cookies: keep the explanation boring

Cookie banners have a tendency to become the loudest thing on a small site, which is a strange outcome for a technical detail.

The practical position for most small business sites: if you only use cookies that are necessary for the site to work — remembering a basket, keeping a login session going — you don't need to ask permission first. If you're running analytics, that generally needs consent unless it's configured to be genuinely anonymous, so check what your tool is actually doing rather than assuming.

What you should avoid:

• A banner with no "reject" option, or one where rejecting is three clicks deeper than accepting.
• A banner that reappears on every page because the setting isn't being remembered.
• Loading an advertising pixel before anyone has clicked anything. This one catches people out, because it can come bundled with a plugin you installed for something else.

A useful exercise: open your own site in a private browser window, accept nothing, and see what still loads. If you're not sure what you're looking at, ask whoever built the site to walk you through it. Any decent developer should be able to point at each cookie and say what it does in one sentence. If they can't, that's worth knowing.

Where to put it, and how to make it findable

Put a link in the footer, on every page. Then, wherever you collect information, link to it directly in context:

• Under the contact form: "We'll only use these details to reply to you. See how we handle your data."
• At the newsletter signup: a one-line note about what they'll get and how to unsubscribe.
• At checkout, if you sell online: a short line pointing to the delivery and returns pages too — those get read far more often than privacy policies.

That contextual linking is where a short notice really earns its keep. Instead of hiding the whole thing behind a footer link nobody clicks, you answer the question at the moment it occurs to someone.

One practical tip: name the page something a normal person would search for. "Privacy" is fine. "Privacy policy" is fine. "Data protection statement" is not. Keep the title simple and save the formal language for the first line.

Keep it honest, and keep it alive

A privacy note is not a document you write once and frame. It's a description of what your website currently does, so it goes stale the moment you add a booking tool, switch email providers, or start running ads.

Our suggestion for small firms: diarise a five-minute review twice a year. Open the notice, open your site, and check the two still match. If you've added a new tool that collects data, add a line. If you've stopped using something, take the line out. Add the new date at the top.

That's it. No legal theatre, no borrowed paragraphs about international transfers you've never made. Just an accurate, readable page that treats visitors like adults — which, funnily enough, tends to do more for a small brand's credibility than any amount of formal wording ever will.

This is general guidance for business owners, not legal advice. If you handle sensitive information or sell to customers in several countries, it's worth a paid hour with someone qualified.