Guest Blog: Connor Griffiths, Solicitor
We are delighted to have Connor Griffiths as our first guest to take over the BIPC Northamptonshire blog. Connor is a solicitor of England and Wales (SRA No. 821297) and the founder of Bracton, which publishes solicitor-drafted legal templates and guides for small businesses and landlords. Its privacy policy, cookie policy and website terms templates are free, need no account, and are updated for the 2026 changes: bracton.org/free-legal-templates.
In this guest blog, Connor talks us through what all businesses need to have in place legally before they start trading. Some industries will have additional legal requirements so please make sure you check what legislation applies to you before you start trading.
What you need in place before you start trading - and what changed in 2026
Most of the start-up checklists circulating online were written before this year. Three things changed in 2026, and a business following the old advice will get at least one of them wrong. The one almost everybody misses applies to sole traders exactly as it applies to companies.
Here is what actually has to be in place before you trade, what moved this year, and - just as usefully - what you are being sold that the law does not require.
What changed in 2026?
Cookies. The Data (Use and Access) Act 2025 changed which cookies need consent from 5 February 2026. Two further kinds of use are now exempt: collecting aggregate statistics about how your site is used in order to improve it, and adapting how your site looks or works to a visitor's preferences. Both exemptions come with conditions - you must tell visitors what you are doing and give them a simple, free way to object. Everything else, including all advertising, still needs consent. The ICO replaced its guidance on cookies and similar technologies on 29 April 2026, so anything written before that date describes the old position.
Data protection complaints. This is the one that catches people. Since 19 June 2026, section 164A of the Data Protection Act 2018 has required every organisation that handles personal data to operate a complaints process. There is no exemption for small businesses or sole traders. If your website has a contact form, you are a controller of what it collects, and you are covered.
The duty has four parts:
make complaining easy
acknowledge a complaint within 30 days of receiving it
investigate without undue delay
tell the person the outcome - including that they can take the matter to the Information Commissioner's Office if they remain unhappy.
Your privacy notice must now also tell people they can complain to you, how to do it, and that the ICO route exists. That is a statutory requirement rather than good practice. A privacy policy written before 19 June 2026 almost certainly does not say it, and a policy copied from a free source online probably still does not.
The checklist
Your business details, on your website. Every business website must show your name, the geographic address where you are established, and contact details including an email address. That comes from the Electronic Commerce (EC Directive) Regulations 2002, and it applies to anyone providing an online service - including a business that only promotes itself through a website. A contact form on its own does not meet it; an email address has to be there. Add your VAT number if you are registered, and your regulator if you work in a regulated profession. The information has to be easily, directly and permanently accessible.
If you are a sole trader, the name you show must be your own, even if you trade under a business name.
If you are a company, four more things. Your registered name, your registered number, your registered office address, and the part of the UK in which you are registered, all shown on your website. Failure to make these trading disclosures is a criminal offence for the company, which is a surprising amount of risk to be carrying for the sake of a footer. A short company information block in the footer, or a page linked from every page, deals with both sets of requirements at once.
A privacy policy, if you collect personal information. Almost every business website does. A contact form collects names and email addresses. A mailing list collects contact details and a record of consent. A site with neither usually still keeps server logs containing visitors' IP addresses, and replying to an enquiry means handling that person's details.
The policy has to describe what your business actually does. One copied from another business describes someone else's processing, which is worse than having nothing - it is a document making specific claims about you that are not true.
Cookie information, but only if you use anything beyond the strictly necessary. Note the condition. If your site uses only strictly necessary technologies, you do not need a cookie banner at all. If you use analytics, be careful: most analytics tools as they are typically installed, Google Analytics included, are unlikely to meet the new statistics exemption.
A complaints process that actually exists. A paragraph in your privacy policy announcing a route, with nothing behind it, is worse than silence - you have told people a process exists that does not. If you already handle customer complaints, you can usually extend that process rather than build a second one, provided people outside the business can find it and use it, and provided it meets the 30-day acknowledgement.
What you do not need
New businesses get oversold on this, so it is worth being plain about what the law does not require.
A disclaimer is not a legal requirement. Website terms and conditions are not legally required for an informational or brochure site - they are sensible, because they set the rules for using your site and limit your liability for its content, but no law compels them. You do not need a standalone complaints page. You do not need an electronic complaints form specifically: the Act offers one as an example of how to comply, not as a requirement. And you do not have to acknowledge a complaint within five working days, whatever you may have been told. Thirty days is the legal limit; anything faster is good practice rather than duty.
One further correction is worth making, because it is now circulating widely. Some guidance published this year says people must complain to the business before they can go to the ICO. That is wrong. A power along those lines was proposed in an earlier bill which fell at the 2024 general election, and it was not carried into the Act. People can go straight to the regulator, and it is better to design your process on that basis.
If you sell online
Everything above assumes an informational or brochure website. If you sell to consumers through your site, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require pre-contract information and, in most cases, a cancellation period, and the Electronic Commerce Regulations set out what you must say about how an order is placed and confirmed. You will need terms of sale written for that. Templates written for brochure sites do not cover it.
The short version
Before you trade you need:
your name, address and email on the site
your company details too if you are a company
a privacy policy that describes what you actually do and now mentions the right to complain to you
cookie information if you use more than the strictly necessary
a complaints process that a real person could actually use
That is the legal floor. Most of what else you will be sold is optional.
Comments