Do I need a privacy policy for a small website?

Yes, if the site collects any personal data at all — and a contact form counts, as do server logs and most analytics. Under UK and EU data protection law a privacy notice is mandatory whenever personal data is processed, regardless of how small the business is.

Is Google Analytics legal to use in the EU and UK?

It can be used lawfully, but it requires consent before it loads, an accurate privacy notice naming Google as a recipient, and a transfer mechanism for data leaving the UK or EU. Several European regulators have ruled specific implementations unlawful, which is a configuration question rather than a blanket ban.

What is a data processing agreement and do I need one?

A written contract with every third party that handles personal data on your behalf — your host, your email provider, your analytics tool. GDPR requires one for each, and you remain responsible for the data regardless of who is processing it.

Legal

What happens if my website is not GDPR compliant?

For a small business the realistic exposure is a complaint to the regulator, an investigation, and an order to fix it — with fines reserved mostly for serious or persistent cases. The more common practical cost is being blocked from advertising platforms and losing B2B clients whose procurement checks fail you.

Answered by Anas Bin Masud 201 words 3 sections

How problems usually surface

A visitor complains to the regulator about a cookie banner or a marketing email
A customer makes a subject access request you cannot answer within a month
A B2B prospect’s procurement process asks for your data handling and you have none documented
An advertising or payment platform rejects your account for missing policies
A breach occurs and the response obligations arrive all at once

The realistic first steps

Inventory what you collect, name every third party that receives it, write an accurate privacy notice, stop setting non-essential cookies before consent, and be able to delete someone on request. That covers the great majority of small-site exposure.

What actually attracts enforcement

Ignoring a subject access request, marketing without consent, and failing to report a qualifying breach. Regulators are considerably more interested in a business that would not cooperate than in one whose policy was out of date.

The longer version

This answer is deliberately short. If you want the full treatment, Buying a website: the questions that decide what you actually own covers it in about 5 minutes — free, ungated, written from client work.

Who answered this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. These answers come from those projects rather than from a content brief. More about how I work, or ask me something directly.