If you collect names, email addresses, payment details or usage data from customers, you're processing personal data and UK data protection law applies. That law is mainly the UK GDPR and the Data Protection Act 2018, both amended by the Data (Use and Access) Act 2025. Cookies and electronic marketing are covered by a separate set of rules, the Privacy and Electronic Communications Regulations 2003 (usually called PECR).
A common question is what your terms and conditions should say about data. The answer is usually less than people expect. Most of the work is done by your privacy notice, and by the contracts you have with the businesses that handle data for you.
Terms and conditions versus privacy notice
UK GDPR doesn't require data protection wording in your customer terms. It requires you to tell people, in a concise, transparent and easily accessible way, how you use their data. That is the job of a privacy notice. Your terms can point to it, but they shouldn't try to do its job, and they shouldn't present your use of data as something the customer agrees to by accepting the terms. Consent bundled into terms and conditions isn't valid consent under UK GDPR.
Where contract wording really matters is in business contracts where one party will handle personal data on the other's behalf. That is covered further down.
What your privacy notice must cover
When you collect personal data directly from people, you must tell them, among other things: who you are and how to contact you; what you use their data for and the lawful basis for each use; what your legitimate interests are, where you rely on them; who you share the data with; whether it goes outside the UK and on what safeguards; how long you keep it, or how you decide; what rights they have; that they can complain to the Information Commissioner's Office; and whether they are required to provide the data and what happens if they don't.
Specific beats vague. “We keep order records for six years after purchase to meet our tax and accounting obligations” tells people something. “We keep data for as long as necessary” tells them almost nothing.
Lawful basis: when consent is required
Every use of personal data needs a lawful basis. For an online business the main ones are usually contract (you need the address to deliver the order), legal obligation (keeping transaction records for tax) and legitimate interests (for example, preventing fraud). Consent is only one of six bases and often not the right one, because it must be freely given, specific, informed and unambiguous, given by a clear positive action (so no pre-ticked boxes), and as easy to withdraw as to give. Don't say you rely on consent for processing you would carry on with if the customer said no.
The Data (Use and Access) Act 2025 added a lawful basis for a short list of “recognised legitimate interests” set out in the legislation, where you don't need to carry out the usual balancing test against the individual's interests. It also names direct marketing as an example of processing that may be carried out for a legitimate interest. For ordinary commercial uses, though, you still need to do and record the usual legitimate interests assessment.
Individuals' rights and complaints
People have rights to access their data, to have it corrected, to have it erased in some circumstances, to object to some processing (and always to direct marketing), to restrict processing, and to data portability where it applies. These rights come from the law, so your terms can't take them away. What you can usefully do is explain how to exercise them.
A subject access request must normally be answered within one month, which can be extended by up to two further months for complex or numerous requests. Following the 2025 Act, you only have to carry out reasonable and proportionate searches, and if you genuinely need the requester to clarify what they're asking for, the time limit is paused until they do.
Since 19 June 2026, organisations have also had to give people a clear way to make a data protection complaint to them, such as an online form, acknowledge a complaint within 30 days, investigate it without undue delay while keeping the person informed, and tell them the outcome. If your privacy notice or website doesn't yet explain how to complain to you, add it.
Cookies and marketing emails
Cookies and similar tracking technologies are governed by PECR as well as UK GDPR. The general rule is that you need consent to store or access information on someone's device unless it is strictly necessary for the service they have asked for. A banner that makes accepting easy and refusing hard is unlikely to produce valid consent. The Data (Use and Access) Act 2025 introduced some exceptions, for example for certain cookies used to collect information for statistical purposes, but they come with conditions, so check the ICO's current guidance before relying on them.
Marketing emails to individuals generally need consent under PECR. The main exception, often called the soft opt-in, lets you email existing customers about your own similar products or services, provided you gave them a simple way to opt out when you collected their details and in every message.
Controllers and processors
The distinction that matters most in business contracts is between a controller and a processor. A controller decides why and how personal data is processed. A processor handles personal data on a controller's behalf and only on its instructions. If you run an online shop, you are the controller of your customer data, and your email platform, cloud host and payroll provider are likely to be your processors. Some suppliers, such as payment providers, may act as controllers in their own right for parts of what they do. The label in the contract doesn't decide the point; what actually happens does.
The distinction matters because the obligations differ. A controller carries primary responsibility for compliance. A processor has its own direct obligations, including on security, but it must only act on the controller's documented instructions.
What Article 28 processor terms must contain
Where a controller uses a processor, Article 28 of the UK GDPR requires a written contract. It has to set out the subject matter and duration of the processing, its nature and purpose, the types of personal data and categories of people involved, and the controller's obligations and rights. It must also require the processor to:
- process the data only on the controller's documented instructions
- make sure people authorised to process the data are under a duty of confidentiality
- take appropriate security measures
- use sub-processors only with the controller's authorisation and on equivalent contract terms
- help the controller respond to individuals exercising their rights
- help the controller with security, breach notification and data protection impact assessments
- delete or return the data at the end of the contract, unless the law requires it to be kept
- provide the information needed to show compliance, and allow and contribute to audits
If you're signing a supplier's standard terms, check that a data processing addendum is included and that it covers these points. If you're the processor, check the controller's version doesn't go further than Article 28 requires, for example with uncapped indemnities or unlimited audit rights at your cost.
Personal data breaches
If you suffer a personal data breach, you must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. Where it is likely to result in a high risk, you must also tell the people affected without undue delay. A processor must tell the controller without undue delay after becoming aware of a breach, and your processor contracts should set a practical timescale for that.
Checking your own documents
Check that your privacy notice covers the points above and is easy to find from your terms and your website, that your terms don't rely on acceptance of the terms as consent, that your cookie banner gives a genuine choice, that you have a way for people to complain, and that you have Article 28 terms in place with each processor. If you want your customer terms reviewed, including how they deal with personal data, you can upload them to QuickLegalCheck.
Related: what the terms and conditions review covers, and a complete sample report.