What your website has to show, by law

If you trade through a limited company, the Companies Act 2006 and the Companies (Trading Disclosures) Regulations 2008 require your website to show your registered company name, your company number, and the country of registration, alongside the address of your registered office. This applies whether the site is a single page for a plumbing business or a ten-page brochure site for a consultancy, because the obligation attaches to the company, not to the size of the site.

What a limited company must show

• The company's full registered name, exactly as it appears on the Companies House register
• The company registration number
• The part of the UK where the company is registered (England and Wales, Scotland, or Northern Ireland)
• The address of the registered office

None of this needs a dedicated page. Most small companies put it in the website footer, alongside the contact page, so it appears on every page without cluttering any of them.

What a sole trader or partnership must show

If you trade under a name that isn't simply your own (so "Jane Fields Plumbing" rather than "Jane Fields"), Part 41 of the Companies Act 2006 requires you to state the name of the individual or partners behind the business, and an address in the UK where documents can be served on you. A sole trader operating under their own name has no separate disclosure to make here, though the identity and contact requirements under the E-Commerce Regulations 2002 still apply, and those are covered in their own section of this guide.

Where it needs to appear

The usual practice is to place this information in the footer or on a dedicated "legal" or "company information" page linked from the footer, so it's reachable from every page without a visitor having to search for it. Business correspondence, including invoices and order confirmations, needs to carry the same details, though that sits outside the scope of the website itself.

Getting the registered details right matters more than it might seem. Companies House and trading standards bodies can and do act on incomplete trading disclosures, and it's a five-minute fix to get right the first time compared with a correction after the fact. The Legal Essentials Checker asks about your legal form as one of its questions, and builds the rest of your list from the answer.

The E-Commerce Regulations 2002 apply to almost any UK business website that lets a visitor buy something, book something or send an enquiry. The regulations use the term information society service for this: a service provided at a distance, by electronic means, at the visitor's own request. In practice that covers a plumber's one-page site with a contact form just as much as a full online shop, so if a visitor can reach you or transact with you through the site, this checklist applies.

What the regulations require you to show

• Name: the trading name, and the legal name behind it if that's different (your own name if you're a sole trader, or the registered company name).
• Geographic address: a real postal address where you can be contacted.
• Email address: one that reaches a person.
• VAT number, if you're VAT registered.
• Membership details of any trade, professional or supervisory body you belong to, including your registration or membership number, if you work in a regulated profession.
• If you show prices anywhere on the site, the price must be clear and must say whether VAT and delivery are included.

Who this catches that other rules miss

The Companies Act disclosures covered elsewhere on this page apply to registered companies. This regulation is wider: it catches sole traders, clubs and community groups the moment their site does more than describe them, whether or not they have any other legal form requiring disclosure. A choir selling tickets through its site, or a wedding photographer taking booking enquiries, is caught in the same way a limited company is.

Where it needs to sit

The information does not need repeating on every page, but it does need to be reachable without a search, typically the footer or a linked contact or about page. If your enquiry form is the only way a visitor can reach you, it's worth reading how that form itself should handle the details a visitor gives you, covered on Enquiry Forms and Visitor Data, Done Properly.

What happens if it's missing

Trading Standards can act against a business that fails to provide this information, and in a dispute a missing address or email address weakens your position if a customer claims they could not contact you. There is no fixed penalty scale attached to the regulations themselves, but the practical risk is a contract or complaint that goes against you because you were, in effect, unreachable.

The Legal Essentials Checker asks a short set of questions about your site and returns which of these disclosures apply to you specifically. It works from the named regulations, not from general guesswork, but it can still get an edge case wrong, so treat its answer as a starting point rather than a substitute for checking the regulation itself where your situation is unusual.

UK GDPR (the UK General Data Protection Regulation) requires you to tell visitors, in plain language, what personal data your site collects, why, and what happens to it afterwards. That explanation is your privacy notice, and it needs to be published before you collect anything.

When a small site needs one

A contact form, a newsletter sign-up box, a booking widget, or an analytics tool that logs a visitor's IP address all count as processing personal data. If your site collects a name, an email address or anything else that identifies a person, you need a privacy notice, and that covers nearly every small business, club or event site with a way to get in touch.

What it has to cover

Articles 13 and 14 of UK GDPR set out the specific things a privacy notice must tell a visitor:

• who you are, including a contact address
• what personal data you collect and why
• your lawful basis for each use of that data, the specific legal ground under UK GDPR that permits you to hold it, such as consent, a contract, or a legitimate interest
• how long you keep the data
• who else sees it, such as a mailing list provider or a booking system
• the visitor's rights, including access to their data and its deletion
• how to complain to the ICO (the Information Commissioner's Office) if they think you have got it wrong

Where to start

The ICO publishes a model privacy notice at ico.org.uk, built around the same headings above. It won't fit your site without changes, since it is written for organisations in general rather than for a choir's booking form or a plumber's contact page, so treat it as a starting structure rather than a finished document.

The Legal Essentials Checker will tell you whether your particular setup needs a privacy notice at all, based on what your site actually collects; it identifies requirements from named regulations and does not replace professional advice for anything complicated. For what a contact form itself must do with the data once it arrives, see Enquiry Forms and Visitor Data, Done Properly.

A cookie is a small file a website stores on a visitor's device, used to remember something between one page and the next or between one visit and the next. It might hold a shopping basket, a login session, or a record of which pages someone has already seen. The same rules apply to similar technologies such as local storage and tracking pixels, even though the word "cookie" is the one everyone uses.

The rule that governs them

The Privacy and Electronic Communications Regulations 2003 (PECR) cover cookies and marketing communications, and sit alongside UK GDPR. Regulation 6 of PECR says you need the visitor's consent before you set any cookie that is not strictly necessary, and you need to tell them what the cookie does before you ask.

What strictly necessary actually means

A strictly necessary cookie is one the site cannot work without, for the specific thing the visitor is trying to do. Keeping someone logged in, remembering the contents of a basket, or making sure a form submits to the right place all count. Analytics does not, even when it only counts visits and never identifies anyone: the ICO's position is that analytics cookies serve the site owner's interest, so they need consent.

A community choir running a static site (one built from fixed HTML files) with a page of concert dates and a contact form has nothing that needs consent. Add a Google Analytics tag or embed a YouTube video, and both bring in cookies that are not strictly necessary, so a consent mechanism becomes required.

What the ICO's guidance requires in practice

• Visitors must be told what cookies the site sets and why, before any non-essential cookie is placed.
• Rejecting non-essential cookies must be as easy as accepting them: a banner with an obvious "accept" button and a buried or multi-click "reject" is not valid consent.
• Boxes must not be pre-ticked. Consent has to be an active choice.
• Continuing to browse the site cannot be treated as consent. Scrolling past a banner is not the same as clicking a button.
• A "cookie wall" that blocks access to the site until the visitor accepts cookies is unlikely to meet the ICO's standard, since the choice is not genuinely free.

Where a site collects any personal data through a cookie, such as an analytics ID tied to a visitor's browsing pattern, that processing also falls under UK GDPR, so it needs a lawful basis (the legal ground for processing personal data, such as consent or legitimate interest) alongside the PECR consent itself. The enquiry forms and data guide covers that overlap for contact forms specifically.

The ICO publishes detailed guidance on cookies and similar technologies at ico.org.uk, including worked examples of compliant and non-compliant banners. It is the source to check against if a specific case does not fit neatly into the categories above. For a shorter route to a personal checklist, the Legal Essentials Checker asks what your site actually does and flags where PECR consent is likely to apply, though it works from the rules as written and cannot judge a borderline case for you.

The Equality Act 2010 makes it unlawful for a service provider, including a website, to treat a disabled person less favourably, and it places a duty on you to make reasonable adjustments where a disabled visitor would otherwise be at a substantial disadvantage. It does not name a technical standard. Instead, a court asked to judge whether adjustments were reasonable would look at what was practical and affordable for a business your size, and would very likely use the Web Content Accessibility Guidelines (WCAG) as the benchmark for what a reasonable website looks like.

Who the 2018 regulations actually bind

The Public Sector Bodies Accessibility Regulations 2018 set a specific, enforceable standard: WCAG 2.2 Level AA, plus a published accessibility statement. They apply to public sector bodies, meaning government departments, councils, schools and NHS trusts. If you run or build a site for a public sector body, the 2018 regulations apply directly and the accessibility statement is a legal requirement.

Why the standard matters even when the regulations do not apply to you

For everyone else, WCAG 2.2 AA is not a legal minimum written into a named regulation, but it is the standard a tribunal would reach for under the Equality Act, and it is also, in practice, the standard that makes a site usable for a genuinely wider range of visitors, including anyone using a screen reader, a keyboard alone, or a phone in bright sunlight.

What Level AA asks for on a page like yours

A handful of criteria cover most of what goes wrong on a small site:

• Text against its background meets a contrast ratio of at least 4.5:1 for normal text (WCAG 1.4.3), which rules out light grey text on a white card.
• Images carry alt text describing what they show, or are marked decorative if they carry no information (WCAG 1.1.1).
• Every control works from a keyboard alone, without a mouse (WCAG 2.1.1), which is how many screen reader users navigate.
• Link text describes where the link goes (WCAG 2.4.4).
• Form fields carry a visible label (WCAG 1.3.1, 3.3.2).

None of this requires specialist software to check. A guide to fixing the common failures, worked through against these same criteria numbers, is at Making a Small Site Fast and Accessible.

The Consumer Contracts Regulations 2013 apply if you sell goods, services or digital content to a consumer online, by phone or by mail order, with no face-to-face contact at the point of sale. A website that takes bookings, sells products, or lets someone commission work without meeting them first counts as distance selling, whatever the trade.

They do not apply to sales between businesses, to anything agreed in person (a plumber quoting on-site, a market stall), or to services you provide free of charge. A site that only displays prices and takes enquiries by phone, with the actual sale happening in a conversation, sits outside the regulations until that changes.

What you must tell the buyer before they pay

The regulations require specific information to be given clearly, before the contract is made. As a minimum, that means:

• Your identity and geographic address, and the trading name if different
• A clear description of the goods, service or digital content
• The total price, including delivery and any other charges
• How and when payment and delivery will happen
• The existence of a right to cancel, and how to exercise it
• The minimum duration of the contract, where one applies

The right to cancel

A consumer buying at a distance has 14 days to change their mind, starting from the day they receive the goods, or from the day the contract is agreed for services and digital content. No reason is needed. If you fail to give the cancellation information above, that period extends automatically, up to a maximum of 12 months.

When cancellation does not apply

The right to cancel has recognised exceptions, and it is worth knowing them before you promise a blanket refund policy you cannot actually offer:

• Goods made to the customer's specification, or clearly personalised
• Perishable goods, such as fresh food or flowers
• Digital content downloaded immediately with the customer's express agreement, once download has started
• Sealed goods unsealed after delivery, where unsealing affects hygiene or health
• A service the customer has asked to be performed in full within the 14 days, once it is complete

A wedding photographer taking a booking deposit through a website is selling a bespoke, date-specific service. Setting out the cancellation terms plainly at booking avoids a dispute neither side wants close to the event.

Trading Standards enforces these regulations, and the Competition and Markets Authority (CMA) sets national guidance on consumer protection online. The Legal Essentials Checker flags whether distance selling information applies to your site based on what it does, though it works from the rules described here and does not replace legal advice for a contract you are unsure about. The full requirements checklist sits on the overview page, and the enquiry forms guide covers what happens once that information reaches you.