Is your business website collecting customer details? You might be breaking UK GDPR law without knowing it

I've been looking at a lot of small business websites recently as part of a project I'm working on and I want to share something that I think a lot of business owners aren't aware of.

If your website has a contact form, a quote request form, a newsletter signup, or a booking system, and most do, there's a good chance it's not fully GDPR compliant. And the consequences of that are more serious than most people realise.

Here are the most common issues I keep seeing:

Contact forms with no privacy notice link — Every form that collects personal data must link to your privacy policy and tell users what you'll do with their information. Most don't.

Pre-ticked marketing checkboxes — If you ask people to sign up to your newsletter, the checkbox cannot be ticked by default. Consent must be active. Pre-ticked boxes are explicitly prohibited.

Cookie banners with no reject option — You must make it as easy to reject cookies as it is to accept them. A banner with only an "Accept" button is non-compliant.

Google Analytics loading before consent — If you use any tracking or analytics tools, they cannot load until the user has actively consented. Many sites load them automatically on page load.

No privacy policy, or one that doesn't cover what you actually collect — Your privacy policy must list every type of data you collect, why you collect it, how long you keep it, and who you share it with.

The ICO has the power to issue fines of up to £17.5 million or 4% of annual turnover for serious violations. While large fines tend to make headlines, smaller businesses are increasingly receiving formal warnings and smaller penalties.

I'm building a tool called ClearlyCompliant that automatically audits your website and produces a plain English report, but honestly, use the checklist above to check your own site first. If you spot issues and want to know more, feel free to ask questions in the comments.