Getting a website right under UK GDPR means knowing what personal data it collects, having a lawful basis for each use, explaining it in a clear privacy notice, getting consent before setting non-essential cookies, and keeping data secure for no longer than you need it. Most of the work is ordinary engineering and housekeeping rather than legal drafting.
This is general information, not legal advice. The main rules come from UK GDPR, the Data Protection Act 2018 and, for cookies and electronic marketing, the Privacy and Electronic Communications Regulations (PECR), all regulated by the Information Commissioner's Office (ICO). The Data (Use and Access) Act 2025 amends parts of this framework in stages, so check current ICO guidance and ask your legal adviser what applies to you.
Step 1: map the personal data your site touches
Personal data is anything that identifies a person directly or indirectly. On a typical website that includes form submissions, accounts, orders, chat transcripts, IP addresses in server logs and identifiers set by analytics or advertising cookies.
List each item in a simple table: what is collected, why, where it is stored, which suppliers can see it and how long it is kept. Include where form submissions end up, such as a shared inbox or CRM.
Then record the lawful basis for each purpose. For websites the usual ones are consent, contract (for example, processing an order) and legitimate interests. If you rely on legitimate interests, write a short assessment balancing your interest against what visitors would reasonably expect.
Step 2: publish a privacy notice people can read
Link your privacy notice from every page and each form, and write it for your actual site rather than from a generic template. It should cover the following.
Who you are: your organisation's name and contact details, and your data protection contact if you have one.
What and why: the categories of data you collect, the purposes and the lawful basis for each.
Who receives it: suppliers and other recipients, and whether data leaves the UK.
How long: retention periods, or the criteria you use to set them.
Rights: how people can access, correct, delete or object to the use of their data, and their right to complain to the ICO.
Step 3: cookies and consent that actually work
Under PECR, you need consent before storing or reading non-essential cookies and similar technologies on a visitor's device. Strictly necessary cookies, such as those that keep a basket or login session working, are exempt. Advertising pixels, heatmaps and most analytics need consent unless a specific exemption applies.
A consent banner meets the standard when refusing is as easy as accepting, nothing is pre-selected, categories are explained plainly and people can change their choice later. The banner must also control the scripts. A common failure is a banner that looks correct while tags in a tag manager or theme still fire on page load.
To test, open the site in a private window, refuse everything, then check the browser's developer tools for cookies and third-party requests. Repeat after every new plugin, marketing tag or theme update.
Step 4: forms, accounts and marketing
Collect only what you need. A contact form rarely needs a date of birth or a home address, and every extra field is data you must protect, explain and eventually delete.
Keep marketing consent separate. Use an unticked checkbox for newsletters, do not bundle it with accepting your terms, and record when and how consent was given. PECR's soft opt-in can allow some marketing to existing customers, but only with a clear opt-out at collection and in every message.
Check where submissions land. Many form plugins also store a copy in the website database, so old enquiries can sit on the server for years.
Step 5: security, hosting and suppliers
UK GDPR requires appropriate technical and organisational measures, scaled to how sensitive the data is and how much you hold. For most websites, check these areas.
Transport: HTTPS on every page, with redirects from plain HTTP.
Access: individual admin accounts, multi-factor authentication, and prompt removal of old users and unused plugins.
Updates: regular patching of the CMS, themes, plugins and server software, plus encrypted backups you have tested.
Suppliers: a written data processing agreement with each processor, such as your host, form service, CRM or email platform.
Transfers: if data is stored or accessed outside the UK, a valid mechanism such as UK adequacy regulations or the International Data Transfer Agreement. UK or EU hosting regions reduce, but rarely remove, the transfers you need to manage.
Step 6: retention, rights requests and breaches
Set a retention period for each type of data and automate deletion where you can. A scheduled job that removes old form entries is more reliable than a calendar reminder.
People can ask for a copy of their data, or for it to be corrected or erased. You generally have one month to respond to a subject access request, so decide in advance who handles requests, how to verify identity and which systems to search.
If a breach is likely to put people's rights and freedoms at risk, you must report it to the ICO within 72 hours of becoming aware of it. Keep an internal log of all incidents, including those you decide not to report.
Common mistakes and trade-offs
Copied privacy notices: a notice taken from another site describes someone else's tools and purposes, not yours.
Treating the banner as design: consent is mostly a script-loading problem that needs testing, not styling.
Blaming the supplier: as the controller, your organisation stays accountable even when a developer or host processes data for you.
Over-collecting for analytics: some tools can run with fewer identifiers, at the cost of less detail, so decide which reports you actually use.
Forgetting new features: live chat, an AI assistant or a booking tool changes your data map. Review the checklist before launch, and carry out a data protection impact assessment where processing is likely to be high risk.
How Softweb Planet can help
Softweb Planet builds and maintains websites and web applications, from WordPress sites to custom platforms, with UK GDPR in mind. We can review how your site loads scripts, stores form data and controls admin access, then fix what we find, working within your compliance requirements and alongside your legal adviser.
Every engagement starts with a discovery call, followed by a written proposal and scope. You get a named lead and working software to review every one to two weeks. Related services include Web Application Development, Cloud Security and Quality Engineering & Testing.