---
title: "New business, no website: the UK compliance checklist"
description: "What a new UK company's website needs: company details in the footer, a real email address, an up-to-date privacy notice, and an honest cookie banner."
url: "https://automancer.uk/field-notes/new-business-website-legal-compliance-checklist/"
canonical: "https://automancer.uk/field-notes/new-business-website-legal-compliance-checklist/"
type: "BlogPosting"
author: "Waseem Ilyas"
datePublished: "2026-08-17T00:00:00.000Z"
---
You can incorporate a UK company online, before lunch, without speaking to
anybody. Working out what your website is then expected to carry takes rather
longer, which is why most new businesses skip it and hope.

We build sites for brand-new companies, so this is the list we work through
every time. It is not legal advice, and we are not the people to give you any.
It is what a working site needs in place before you start pointing traffic at
it.

## What does a new UK business website need to include?

Four facts about the company: its registered name, the part of the UK where it
is registered, its company number, and its registered office address. A real
way to reach you: your name, a geographic address, and a working email address,
not only a form. A privacy notice, if the site collects any personal data at
all, which a contact form does. And a cookie position that matches what your
analytics is actually configured to do. Worth knowing what is not on that list:
nothing obliges a business website to publish terms and conditions. They are a
good idea, not a box to tick.

## The footer nobody tells you about

The four company facts have to be available on the site. Nobody prescribes
where, so a site-wide footer or a clearly signposted legal-information page
both do the job, as long as a human can actually read it without a magnifying
glass.

It is tempting to file this under tidiness. It is not. Leaving it off is an
offence in itself, and the sharper risk sits in the contracts you make while
in breach: the other side can ask the court to throw out your claim on one. A
court can still let the case through where the defendant was not actually
prejudiced, so it is a risk rather than a certainty, but it is a risk you are
running on your own unpaid invoices for no reason at all. No incantation
required to avoid it: four facts, in a footer, ten minutes.

## The requirement almost nobody has heard of: a real email address

A commercial website is expected to publish a working email address, in a form
that is easy to find and stays put. A contact form on its own is generally not
treated as enough. The form is fine as the fast route, but a published address
needs to sit alongside it.

This is usually read to cover ordinary brochure sites too, not just online
shops, which is why so many otherwise tidy small-business sites are quietly
offside. It also has more teeth than it used to: since April 2025 the
Competition and Markets Authority can enforce these consumer-facing duties
directly, after two decades in which more or less nobody did.

## The data rules moved twice in 2026

If your site has an enquiry form, you are collecting personal data, and you
need a privacy notice that says who you are, what you are doing with the data,
your legal basis, who else sees it, how long you keep it, and what rights
people have. In plain language, where you collect the data, not buried three
clicks away.

One line changed in June 2026. Your notice now has to tell people they can
complain to you directly and not only to the Information Commissioner, and you
have to actually handle those complaints: make it easy to raise one,
acknowledge it inside a month, and respond without dragging it out. If your
notice was written before this summer it is missing a line it is now supposed
to carry. That is a five-minute edit, and it is the single most common thing we
find out of date on an existing site.

Cookies moved earlier in the year, so check the date on anything you read about
them, including this. You may have heard that analytics no longer needs
consent. It is narrower than that. The exemption covers analytics used only to
collect statistics about how your own site is used so you can improve it, where
the data is not passed on to anyone else, you tell visitors clearly what you
are doing, and you give them a simple free way to say no. Analytics that feeds
advertising, measures conversions for an ad platform, or follows individual
visitors around still needs consent, so a default install with the ad features
switched on is not covered. The penalty ceiling for getting this wrong went up
sharply in 2026, which is a good reason to know which of those two things your
tag is doing.

## From nothing to live and compliant, and why "later" is a bad plan

We took a brand-new UK travel agency from zero web presence to a live,
compliant marketing site: services sections, a tested working enquiry form,
WhatsApp and phone contact wiring, and the required trading-disclosure footer.
We handled domain purchase, DNS, HTTPS hosting and interim email routing too,
so they had a working front door and a working inbox from day one. That last
part is not incidental. The email requirement above is impossible to satisfy if
nobody has decided who reads the inbox yet. The write-up is in [the fast
websites case study](/work/fast-small-business-websites/), and it is hand-built,
so it costs essentially nothing to run.

"We'll add the legal stuff later" fails for a dull reason. Later is when you
have traffic. Disclosures, the privacy notice and cookie behaviour are cheapest
while the site is being built, because they are decisions about structure.
Retrofitting a consent mechanism onto a live site, or working out after the
fact whose data you have been collecting since March, costs real money and
produces a worse result.

## What I'd actually do about it

Open your own site and check three things. Are the four company facts in the
footer. Is there a real email address, not just a form. Does your privacy
notice mention the right to complain to you as well as to the ICO. If you
incorporated recently, all three are probably missing, and all three are an
afternoon's work rather than a project.

Leave the cookie question until you know what your analytics is actually
configured to do, because that determines the answer and nothing else does. And
whether you owe the ICO the annual data protection fee is worth ten minutes on
their registration self-assessment rather than a guess in either direction.

We publish real from-prices for our automation work on our [services
page](/services/), starting with an Automation Opportunity Audit from £450, and
we would rather tell you one honest page is enough than sell you eight. If you
want a straight answer about your own site, fill in [the form](/contact/).
Waseem reads it himself and emails you back, we promise a meeting within one
week, and a human makes every decision along the way.

*We build websites, we are not solicitors, and none of the above is legal
advice. It describes how we set up sites for new UK companies as at August
2026. If your situation is unusual, or a decision here carries consequences you
care about, take proper advice on it.*