A privacy and cookie notice for a small company website: what to state and who checks it

A small company website usually gets its privacy notice once, at launch. Someone copies a text from a template or from a larger competitor, adds the company name and moves on. Two years later the site has a new contact form, a newsletter box, an analytics script and an embedded video, and the notice still describes the old site.

That gap is the real problem. A long notice that does not match the site helps nobody: visitors cannot trust it, and the company cannot rely on it. This article describes a short way to keep the notice accurate, who should own it and what to check and when. It is written for owners and managers of companies with roughly five to fifty people. It is not legal advice, and the rules differ by country, so treat it as a working routine and confirm legal points with an adviser who knows your market.

Start with what the site really does

Before writing a word, make a list. Open the site as a visitor, with a clean browser, and note every place where information is collected or stored:

Forms. Contact form, quote request, newsletter signup, job application, booking. What fields does each one ask for, and where does the message go afterwards?
Analytics. Which tool counts visits, and does it set cookies or identify visitors?
Embedded content. Videos, maps, chat widgets, social buttons and booking tools. Each can load a third party's code, and some set their own cookies.
Advertising and tracking tags. Anything added by a marketing agency or a plugin that nobody remembers installing.
Cookies themselves. The browser's developer tools list the cookies a page sets. Write down the name, who sets it and what it is for.

This takes an hour for a small site. It is the most useful hour in the whole exercise, because it shows what the notice has to cover. It often also shows things the company did not know it was doing. If you keep a record of how enquiries are handled, as described in our article on a website contact form that gets answered, the form part of the list is already half done.

What the notice should say

Rules differ, but privacy laws in many places, including the EU and UK versions of GDPR, expect similar basics to be explained in plain language when personal data is collected. In practice, a small company notice covers these points:

Who you are. Company name, address and an email address that is read. If the company has appointed a data protection contact, include it.
What you collect. Group it by situation, not by legal category: "when you send us a message we receive your name, email and what you write"; "when you visit, we count page views."
Why you collect it. One sentence per purpose: to answer the enquiry, to send the newsletter you asked for, to understand which pages are useful.
Who else receives it. The email provider, the analytics tool, the hosting company, the booking service. Naming the kind of provider is often enough; naming the provider is clearer.
How long you keep it. A real period, such as "enquiries are deleted after two years unless they become a customer relationship." Do not write "as long as necessary" if you have not decided what that means.
What people can do. How to ask what you hold, correct it, delete it or object, and how to complain to the supervisory authority in your country.
Cookies. What kinds you use and for what, and how a visitor can change their choice.

Write it as if explaining to a customer on the phone. Short sentences, no borrowed legal phrases you cannot explain yourself. If a sentence in the notice describes something the company does not do, delete it.

Cookies: ask only where it is needed

Cookies deserve their own short section because the rules and the habits are different. In the EU, the ePrivacy rules generally expect consent before a site stores or reads information on a visitor's device, with exceptions for what is strictly necessary to provide the service the visitor asked for. The UK has similar rules. The details, and how strict regulators are, vary between countries.

A practical way to handle this:

Remove what you do not need. Every tag you remove is one less thing to explain and one less banner choice. Many small sites carry old tracking scripts with no one reading the reports.
Separate the necessary from the optional. A cookie that keeps a shopping basket or a login working is a different case from a cookie that measures advertising.
Make the choice real. If consent is required, the optional cookies should not load until the visitor agrees. A banner that only informs while the scripts already run does not do what it says. The European Data Protection Board's guidelines on consent explain what valid consent looks like.
Make saying no as easy as saying yes. Equal buttons, no pre-ticked boxes, and a way to change the decision later.
Test it. Visit the site with a clean browser, refuse the optional cookies and check that they are not set.

Regulators publish guidance on this. The UK Information Commissioner's Office, for example, has a clear page on storage and access technologies, and similar material exists in most EU countries.

One owner, one date

Notices go stale because nobody owns them. Give the job to one named person, usually whoever is responsible for the website or marketing, and put two things on the calendar:

A quarterly check. Fifteen minutes. Open the site, repeat the inventory quickly and compare it with the notice. Add a line to a short log: the date, who checked, what changed.
A check after every site change. New form, new plugin, new embedded tool, new analytics setup: before it goes live, ask "does the notice still match?" This fits well into the routine described in our article on website change requests: who decides and the weekly update slot.

The owner does not need to be a lawyer. Their job is to notice differences between the site and the text and to bring open questions to someone qualified. A useful habit is to keep a short list of such questions and take them to the adviser together, instead of one at a time.

Where the notice lives

Put a link to the notice in the footer of every page, and next to every form, with a sentence such as "We use your details to reply to your message. Details in our privacy notice." Link the cookie settings from the footer too, so a visitor can change their mind.

Keep the date of the last review at the top of the notice. If something important changes, for example a new provider that handles contact messages, say so at the top for a while. Keep the old versions in a folder; if someone asks what the notice said last year, you can answer.

It also helps to connect the notice to the weekly check of the site. Our piece on website uptime and form monitoring describes a short routine for confirming that forms still work. Adding one line there, "forms still link to the notice," costs nothing.

Common mistakes

Copying a template unchanged. It describes someone else's site.
Promising what you do not do. "We never share data" is not true if the contact form passes messages to an outside email provider.
A banner that does not control anything. If scripts load before the visitor chooses, the banner is decoration.
No owner. Without a name, nobody checks.
Forgetting third parties. Embedded videos, chat widgets and booking tools often set cookies of their own.
Treating it as a one-time task. Each change to the site is a chance for the notice to become wrong.

A first step

Set aside one hour this week. Open the site in a clean browser, write the inventory of forms, tools and cookies, and put it next to the current notice. Mark every difference. Then name an owner, set a date three months ahead and send the list of open legal questions to your adviser. That list is the start of a notice that fits the site you really run.