Do I need a privacy policy for a small website?

Yes, if the site collects any personal data at all — and a contact form counts, as do server logs and most analytics. Under UK and EU data protection law a privacy notice is mandatory whenever personal data is processed, regardless of how small the business is.

Is Google Analytics legal to use in the EU and UK?

It can be used lawfully, but it requires consent before it loads, an accurate privacy notice naming Google as a recipient, and a transfer mechanism for data leaving the UK or EU. Several European regulators have ruled specific implementations unlawful, which is a configuration question rather than a blanket ban.

Is reCAPTCHA a privacy problem?

It is a disclosure obligation at minimum. reCAPTCHA transmits visitor data to Google on every page it loads, which makes Google a recipient you must name in your privacy notice — and it means a third party profiles your visitors as the price of a contact form.

Legal

What is a data processing agreement and do I need one?

A written contract with every third party that handles personal data on your behalf — your host, your email provider, your analytics tool. GDPR requires one for each, and you remain responsible for the data regardless of who is processing it.

Answered by Anas Bin Masud 225 words 4 sections

Who counts as a processor on a small site

The hosting company storing your database and server logs
The transactional email service delivering form notifications
Your analytics provider, unless it collects nothing personal
Any backup, CDN or error-tracking service that touches user data
A freelance developer with access to live customer records

What the agreement must cover

That the processor acts only on your instructions, keeps the data secure, restricts onward sub-processors, assists with data subject requests, notifies you of breaches, and deletes or returns the data at the end of the relationship.

How to get them

Most reputable suppliers publish a standard agreement you accept rather than negotiate — usually inside the account settings. The work is not drafting them; it is writing down which services you actually use, which almost nobody has done.

Why the list matters more than the paperwork

An inventory of every service that touches customer data is the basis of an accurate privacy notice, the first thing anyone asks for after an incident, and the only way to answer a subject access request completely. It takes an hour.

The longer version

This answer is deliberately short. If you want the full treatment, Buying a website: the questions that decide what you actually own covers it in about 5 minutes — free, ungated, written from client work.

Who answered this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. These answers come from those projects rather than from a content brief. More about how I work, or ask me something directly.