Website Legal Requirements: What UK Law Says
Website legal requirements get talked about like a minefield, usually by whoever is trying to sell you a "GDPR compliance package" on top of your build. Strip that away and there's a short, genuinely useful list of things UK law says your website has to show, whether you're a sole trader with one page or a limited company taking bookings online. Here's what actually applies, and what doesn't.
What are the website legal requirements for a limited company?
Your registered name, company number, the part of the UK you're registered in, and your registered office address, if you trade as a limited company. That comes from the Companies (Trading Disclosures) Regulations 2008. None of it has to sit on the homepage. Most sites put it in the footer or on the contact page, which satisfies the rule as long as a visitor can actually find it.
Sole traders and ordinary partnerships aren't companies in the legal sense, so this specific regulation doesn't reach them. That doesn't mean nothing applies. It means the next rule does instead.
What must a business show if it takes bookings or sells online?
Your name, the geographic address you're established at, and contact details including an email address that let someone reach you directly. That comes from the Electronic Commerce (EC Directive) Regulations 2002, and regulation 6 applies far wider than the name suggests. It covers any "information society service", which in practice means most business websites used to offer a service at someone's request, not just a checkout. If you're VAT registered, your VAT number goes on too. Quote a price anywhere on the site and it has to say plainly whether tax and delivery are included.
Unlike the trading disclosure rule above, this one doesn't care whether you're a limited company, a sole trader or a partnership. If your website lets someone request a quote, a booking or a sale, it applies.
Does this still apply to a simple one-page site with no checkout?
Usually, yes, more often than most trade business owners expect. Regulation 6 turns on whether you're offering a service "at someone's request", and a page that exists to get someone to fill in a form or ring for a quote is doing exactly that, whether or not any money changes hands on the site itself. A single-page site for a plumber or an electrician with a phone number and an enquiry form is squarely inside it, even with nothing to add to a basket.
What genuinely narrows down for a simple site is the trading disclosure rule above, which only bites if you're a limited company, and the cookie rule below, which only bites if you actually load a cookie. A truly static page with a phone number and nothing else loaded can clear most of this list without much effort at all.
Do you need a cookie notice?
Almost certainly, if the site runs anything beyond the bare minimum to display itself. The ICO's own guidance on cookies sets the rule under PECR: you need consent before setting a cookie or similar tracking technology, given before it's set rather than after, unless that cookie is strictly necessary for something the visitor actually asked for. Google Analytics, a Facebook pixel and most chat widgets don't clear that bar, because they're useful to you rather than necessary to the visitor. A basic essentials-only site, with nothing but the code needed to load the page, can genuinely skip the banner.
Do you need a privacy policy?
If the site collects any personal data, yes. A contact form, a booking widget, a newsletter signup and analytics all count, because each one gathers information that identifies or could identify a real person. UK GDPR's transparency duty means telling people what you collect, why, and roughly how long you keep it, in plain language rather than a page lifted wholesale from somewhere else. It doesn't need to be long. It needs to be honest and to actually describe what your site does, not a generic template that promises things you don't do and skips things you do.
Does your website need to be accessible by law?
Not to the specific standard, unless you're a public body. The Public Sector Bodies Accessibility Regulations 2018 require WCAG 2.2 conformance, but only for government and public sector websites, not private businesses. That said, the Equality Act 2010's duty to make reasonable adjustments for disabled customers isn't limited to a physical shop front, and has been read to extend to how a business provides a service online. In practice that means readable text, workable contrast and a site that doesn't rely on a mouse to use, well short of a full accessibility audit, but not nothing either.
What happens if you get it wrong?
Less than the scarier corners of the internet suggest, but it isn't nothing. Companies House can pursue a company and its officers over a trading disclosure failure, the ICO can investigate and fine over a cookie or data breach, and none of it tends to start with a spot check. It usually starts with a complaint: a customer who asked to see your terms and didn't get them, or a rival who reported a missing cookie notice out of spite. Getting the basics right costs an afternoon. Getting caught without them costs a lot more attention than the fix ever would have.
None of this needs a specialist compliance product bolted onto your build. A properly built site puts the company details in the footer, asks before it sets a cookie, and says plainly what it does with a form submission, because that's what the rules actually ask for. Setup here starts from £495 with hosting, security, backups and edits from £69 a month, and nothing is owed until you've seen the finished site. See the kind of sites the studio builds, or get a private preview before anything is owed.
Frequently asked questions
Do sole traders have to follow the Companies (Trading Disclosures) Regulations?
No. Those regulations name registered companies specifically, so a sole trader or an ordinary partnership isn't caught by them. The separate rule on showing your name, address and contact details still applies, because that one covers any business offering a service online, not only limited companies.
Do I need a cookie banner if I only use Google Analytics?
Yes, in almost every case. Analytics cookies read a visitor's device to track them across a visit, which the ICO treats as needing consent under PECR unless the cookie is strictly necessary for the site to function. A basic analytics setup is convenient for you, not necessary for the visitor, so it needs a genuine opt in.
Is a privacy policy a legal requirement for a simple one-page website?
It depends on what the page actually does. A truly static page with no form, no analytics and no embedded booking widget collects nothing, so there's little to explain. Add a contact form, a newsletter signup or an analytics script and you're collecting personal data, which brings UK GDPR's duty to tell people what happens to it.
Does my small business website have to meet accessibility standards?
Not the specific WCAG standard that public sector websites must meet under the 2018 Regulations, which only covers government and public bodies. The Equality Act 2010 still applies more broadly though, and its duty to make reasonable adjustments for disabled customers has been read by courts to extend to how a business provides a service, including online.
Who actually enforces these rules against a small business?
Companies House can act against a company and its officers for failing the trading disclosure rules, and the ICO can investigate and fine over cookie or data breaches, though in practice both start with a complaint or a routine sweep rather than picking on a single-page trade website. The more common cost is a customer or a rival reporting you, not a spot check.