Does my small business website need a privacy policy?
The short answer
Almost certainly, if it collects any personal information: contact forms, newsletter sign-ups, orders, accounts, or analytics and advertising tools. Privacy laws such as the GDPR, the UK GDPR, the Australian Privacy Act and California’s privacy laws require you to explain what you collect, why, who you share it with and how people can exercise their rights.
Applies in EU · UK · Australia · California
Personal information is anything that can identify a person: a name, an email address, an IP address, a cookie ID or a location. Most websites collect some, even if it’s only through a contact form or analytics.
What a privacy policy should cover
- Who you are and how to contact you.
- What personal information you collect, and how (forms, orders, cookies, analytics).
- Why you collect it, and your legal basis where the GDPR or UK GDPR applies.
- Who you share it with, such as your email, payment and hosting providers, and whether it leaves the country.
- How long you keep it, and how people can access, correct or delete it.
Where the main rules come from
| Where your customers are | What applies |
|---|---|
| EU | GDPR Article 13 lists what you must tell people when you collect their data. |
| UK | The UK GDPR has the same requirements, with the same article numbers. |
| Australia | APP 1 requires a clear, up-to-date privacy policy. Businesses with annual turnover of A$3 million or less are generally exempt — but not health service providers. |
| California | CalOPPA requires any commercial website that collects personally identifiable information from California residents to post a privacy policy, whatever the business’s size or location. Larger businesses also have CCPA/CPRA duties. |
Even where a law doesn’t strictly require one, many services you rely on do: analytics, advertising and payment providers generally require a privacy notice on websites that use them.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- Personal data
- Any information about an identifiable person — names, emails, addresses, health notes, photos. Privacy laws control how you collect, store and protect it.
- GDPR (European Union)
- Europe’s privacy law. It applies if you handle personal data of people in the EU — even if your business is elsewhere.
- Australian Privacy Act
- Australia’s main privacy law, built around 13 Australian Privacy Principles. Health businesses are covered whatever their size.
- CCPA/CPRA (California)
- California’s privacy law: residents can see, delete and correct their data and stop it being sold.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.