Does my website need a cookie banner, a privacy notice and an ICO fee? A plain-English guide for UK small businesses
What the ICO says about cookie consent, what a privacy notice must contain and how to find out if you need to pay the data protection fee, for sole traders and small firms.
By Logic NI3 min read
Three questions come up whenever someone builds a website for a small business: do I need a cookie banner, do I need a privacy policy, and do I need to register with the ICO? This guide gives the plain-English answers, based on the Information Commissioner's Office (ICO) pages. It is general information, not legal advice.
The ICO has noted that some of its guidance is under review following the Data (Use and Access) Act 2025, and says it is consulting on revised cookie guidance. Check the ICO's own pages for the latest.
Do I need a cookie banner?
The ICO's guidance on cookies says that you must tell people if you set cookies, clearly explain what they do and why, and get the user's consent. Consent must be actively and clearly given, which the ICO says must be more than simply continuing to use the website. It also says you cannot set non-essential cookies on your homepage before the user has consented.
There is an exemption for cookies that are strictly necessary to provide something the user has asked for. The ICO's examples of cookies unlikely to need consent include:
- cookies that remember the goods a user adds to an online basket;
- session cookies providing security that is essential to meet data protection security requirements;
- load-balancing cookies.
Cookies that are helpful or convenient but not essential still need consent, according to the ICO.
| Cookie type | Usually needs consent? |
|---|---|
| Basket or login cookies the user asked for | Generally not, if strictly necessary |
| Security cookies essential for the service | Generally not |
| Advertising and tracking cookies | Yes |
| Preference cookies that are convenient but not essential | Yes, according to the ICO |
| Analytics cookies | Check the ICO's current position. The page we read did not say analytics cookies are exempt, and the ICO says it is consulting on revised guidance |
A site that sets no non-essential cookies does not need a consent banner. Some small sites are built that way on purpose.
Do I need a privacy notice?
If your website collects personal data, for example through a contact or enquiry form, the UK GDPR requires you to give people privacy information. The ICO's checklist of what to provide includes:
- your name and contact details;
- the purposes of the processing;
- the lawful basis for it;
- who you share the data with;
- how long you keep it;
- people's rights, including to complain to the ICO;
- any other items that apply to your situation, such as international transfers.
The ICO's guidance sets no specific retention period for enquiry data. You decide, and you must be able to justify it.
Do I need to pay the ICO data protection fee?
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. Whether you must pay, and how much, depends on your circumstances. The ICO offers a self-assessment on its website that tells you whether you need to pay and how much.
We could not read the fee amounts or exemption list from the ICO pages available to us, so we do not state them. Use the ICO's self-assessment rather than a third-party site. Be careful with companies offering to "register" you for a fee, and go to the ICO's own site.
A simple checklist
- List what your website collects: forms, bookings, newsletter sign-ups, payments.
- List the cookies and scripts it sets, including analytics, maps and embedded videos.
- Put a clear privacy notice on the site, covering the points above.
- If you set non-essential cookies, use a consent tool that does not set them until the visitor agrees.
- Use the ICO self-assessment to check the data protection fee.
- Keep enquiry data only as long as you need it, and delete it afterwards.
Where Logic NI fits
We build sites with a clear privacy notice and a sensible approach to cookies, and we can explain what a site collects. We are not lawyers, so for specific legal questions take advice. See our web design and website maintenance, our guide to AI and UK GDPR, or get in touch.