The Unread Page That Still Counts: A 20-Minute Privacy Notice Sprint for UK Sole Traders

Most sole traders do not wake up excited about privacy notices. Fair enough. But if your website has a contact form, a booking link, a newsletter box or even a simple ‘email me’ button, you are collecting personal data. That means you need to tell people what you do with it. Not in a legalistic fog, and not buried in terms and conditions nobody opens. Just a clear page that does the job.

Think of it as the quiet compliance page behind your business. It will not win you customers on its own. But it keeps you straight when someone asks a perfectly reasonable question: ‘What happens to my details?’

First, the honest test: are you collecting personal data?

Personal data is anything that can identify a living person. A name, an email address, a phone number, a delivery address, an enquiry that includes their situation, a photo, an IP address — all of it counts.

You do not need a database the size of a supermarket to be in scope. A sole trader with a contact form and a spreadsheet of enquiries is handling personal data. So is a consultant whose website takes discovery-call bookings. So is a maker who receives custom order details by email.

You are the data controller for that information. You decide why it is collected and what happens to it. That is the role the privacy notice is explaining.

What a basic privacy notice actually needs to say

You do not need to sound like a law firm. You do need to cover the basics in plain English:

• Who you are and how to contact you about data
• What personal data you collect
• Why you collect it
• Your lawful basis for processing it — for example, contract, consent or legitimate interests
• How long you keep it
• Who you share it with, including tools and suppliers
• What rights people have
• How someone can complain to the Information Commissioner’s Office (ICO)
• How you use cookies, if you use them

That last point is often separate. A privacy notice is not a cookie banner. If your site uses analytics or marketing cookies, deal with those too, but do not let cookie confusion stop you publishing the notice.

The 20-minute fill-in-the-blanks structure

Use this as a starting point and adapt the wording to your business. Keep it on one page if you can.

Last updated: [date]

Who we are: [Trading name] is a sole trader based in [town/county]. For questions about your personal data, email [contact email].

What we collect: We collect [name, email address, phone number, enquiry details]. If you buy from us, we also collect [billing address, order details, payment confirmation].

Why we collect it: To reply to your enquiry, provide the service you have asked for, keep business and tax records, and — only if you have opted in — send occasional updates.

Our lawful basis: Where you buy from us, we process your data to perform our contract with you. For general enquiries, we rely on our legitimate interests in responding to potential customers. For marketing emails, we rely on your consent.

How long we keep it: Enquiries are kept for [X months]. Customer and financial records are kept for [X years] to meet accounting and tax requirements. Marketing details are kept until you unsubscribe.

Who we share it with: We use [email provider], [accounting software], [payment provider] and [other relevant tools]. We do not sell your personal data. We may share information with professional advisers where necessary, such as an accountant.

Your rights: You can ask for a copy of your data, ask us to correct it, ask us to delete it where the law allows, object to certain processing, or ask for it to be restricted. Email [contact email] to make a request. You can also complain to the ICO at ico.org.uk.

Cookies: [Link to cookie information, or state that the site uses only essential cookies if that is true.]

That is not a perfect legal document. It is a working, honest notice. Do not copy a template from a large company and leave in references to departments you do not have.

Where to put it so people can actually find it

A privacy notice hidden three clicks deep is not much of a notice. Put a link labelled ‘Privacy Notice’ in your website footer so it appears on every page. Then link to it at the point where people hand over information:

• Next to your contact form
• On your booking or checkout page
• Under your newsletter sign-up box
• In your email signature, if you collect data by email

You do not need a pop-up on every page. You do need the link to be obvious when someone is about to share something personal.

Keeping it accurate without rewriting your life

A privacy notice is not a one-off piece of homework. It should match what you actually do. If you switch email providers, add a booking tool, start sending a newsletter or change how long you keep records, update the notice.

A simple habit helps: once every six months, open the notice and read it next to a list of your tools. Ask three questions. What data comes in? Where does it go? How long does it stay? Update the date at the top when you make a change.

Also keep a small internal note — one page is plenty — listing your software, what it does and who can access it. That makes future updates much quicker and helps if anyone ever asks how you handle data.

The ICO question: registration or not?

There is a lot of confusion about ‘ICO registration’. In practice, most data controllers need to pay the ICO a data protection fee unless they are exempt. Being a sole trader is not, by itself, an exemption.

The exemptions are narrow. They can include processing only for staff administration, certain advertising or marketing activity for your own business, or accounts and records. But once you are collecting customer details through a website, managing enquiries, taking orders or building a marketing list, it is risky to assume you are exempt.

The sensible move is to use the ICO’s online fee self-assessment. It takes a few minutes and asks what you process and why. If you need to pay, the lowest tier is modest and it is an annual fee. If you are genuinely exempt, the checker will tell you. Either way, you have a clear answer rather than a vague worry.

Your 20-minute sprint

Here is the whole thing in one go:

• Minutes 0–3: List every place your website collects personal data and every tool those details go into.
• Minutes 4–10: Fill in the template above. Keep sentences short. Delete anything that is not true for you.
• Minutes 11–14: Publish the page and add links in your footer, forms and booking or checkout pages.
• Minutes 15–17: Run the ICO fee self-assessment and note the result.
• Minutes 18–20: Put a reminder in your diary for six months’ time to review it.

That is it. You have not become a privacy lawyer. You have done the sensible, practical thing: told people clearly what you do with their information, and given yourself a simple routine to keep it accurate.