Most small business owners add a privacy policy only after something reminds them: an ad platform rejects their campaign, a customer asks, or they read about fines. The short answer to the question in the title is yes, almost always. Here's why, and what a sensible policy for a small business actually contains.

This article is general information, not legal advice. If you handle sensitive information such as health or financial data, or sell online across several countries, ask a lawyer to review your policy.

Why you probably need one

You need a privacy policy whenever your website collects personal information: anything that identifies a person. For a typical small business site that means:

  • a contact or quote form (name, email, phone, message)
  • a booking or appointment request
  • a newsletter sign-up
  • analytics or advertising tools that log visitors' IP addresses

If your site has even one of these, the laws below are likely to apply.

The laws most small businesses meet

  • GDPR (European Union) and UK GDPR. If people in the EU or UK can use your site, you must tell them what you collect, why, how long you keep it and what rights they have, at the moment you collect it. A clear privacy policy linked next to your forms does exactly that.
  • California (CalOPPA). Any commercial website that collects personal information from California residents must post a privacy policy, regardless of company size.
  • Other countries. Canada, Brazil, Australia, South Africa, Turkey and many others have similar rules. The core expectation is the same everywhere: be open about what you collect and why.
  • Platforms. Google Ads, Meta ads and most analytics tools require a privacy policy on any site that uses them, even where local law doesn't.

What to put in it

A good small business privacy policy is short and specific. Cover these points in plain language:

  1. Who you are and how to contact you.
  2. What you collect: form details, booking details and basic technical data such as IP address.
  3. Why: to reply to enquiries, handle bookings and keep the site secure. Say clearly if you never sell data or use it for advertising.
  4. Who else handles it: your hosting or website platform, email provider, WhatsApp or any booking tool.
  5. Cookies: which ones you use. If you only use essential cookies, say so.
  6. How long you keep it, and that you delete it afterwards.
  7. People's rights: to see, correct or delete their information, and how to ask.
  8. The date it was last updated.

Avoid copying a long policy from a large company. It will describe things you don't do, which is worse than saying too little.

Only if you use non-essential cookies, such as advertising pixels or some analytics tools, and have visitors in the EU or UK. Cookies that keep a site working (for example, keeping someone signed in) don't need consent. If your site uses no tracking at all, a sentence in your privacy policy saying so is enough.

What about terms of use?

Terms of use (or terms and conditions) are rarely required by law for a simple business website, but they are worth having. They let you say that prices and opening hours can change, that a booking request isn't confirmed until you confirm it, that your photos and text belong to you, and how far your liability goes. If you take payments or sell products online, you will also need clear refund and delivery terms.

Where to show them

  • Link both pages in your website footer, on every page.
  • Put a short line near your forms, for example: "We use your details only to reply to you. See our Privacy Policy."
  • Keep them in the same language as the rest of your site.

How OnePrompts handles this

Every website built with OnePrompts gets a privacy policy and terms of use page automatically, in the same design as the rest of the site and linked from its footer. They are written for what your site really does (they mention booking forms or WhatsApp only if your site has them), fill in your business name and contact details, and are available in 10 languages. Treat them as a solid starting point: if your business has special requirements, adapt them or have them reviewed.

For the rest of your launch checklist, see what every small business website needs and our local SEO checklist.