The legally required and commercially important pages that govern the terms under which the website and business operate — including privacy policy, terms and conditions, cookie policy, accessibility statement and sector-specific compliance disclosures. They protect the business legally and build visitor trust.
A privacy policy (required under UK GDPR and the Data Protection Act 2018 for any site collecting personal data), a cookie policy (required under PECR for sites using non-essential cookies) and terms and conditions (not legally mandated but strongly advisable for any site selling goods or services).
Who is collecting data, what data is collected, the lawful basis for processing, how data is used, how long it is retained, with whom it is shared, the data subject’s rights under UK GDPR, how to exercise those rights and contact details for the data controller and the ICO.
A privacy policy covers all personal data processing by the organisation. A cookie policy specifically addresses the cookies and tracking technologies the website uses — what each cookie does, how long it persists, whether it is essential or non-essential and how the visitor can manage their preferences.
A legal agreement between the business and the website visitor or customer, covering: permitted use of the site and its content, purchase or service terms, payment terms, cancellation and refund rights, limitation of liability, intellectual property ownership and the governing law.
For straightforward business websites, policy templates drafted with legal input and customised accurately to the business’s actual data practices are typically sufficient. Businesses handling sensitive personal data, operating in regulated sectors or with complex commercial terms should commission bespoke policies from a qualified solicitor.
A page declaring the website’s accessibility compliance level (typically referencing WCAG 2.1 guidelines), identifying any known limitations and providing alternative contact options for users who cannot access content because of those limitations. Public sector websites are legally required to publish one; it is best practice for all businesses.
From the footer (making them consistently accessible from every page), from the cookie consent banner (linking directly to the cookie policy), from checkout or registration forms (linking to terms and privacy policy) and from any data collection point. They should never be buried or hard to find.
At minimum annually and whenever the business changes its data practices, adds new third-party tools, updates its product or service terms or when relevant legislation changes. Outdated policies that don’t reflect actual practice create greater legal risk than having no policy at all.
Generic templates carry risk if they don’t accurately reflect how the business actually collects and processes data. A policy stating data is not shared with third parties when Google Analytics and a CRM are in use misrepresents actual practice. Templates must be thoroughly customised to reflect real data flows.
