A practice website in the UK needs two things from the law: a privacy notice that says what happens to the details a visitor sends, and a cookie banner that sets nothing non-essential until the visitor agrees. Here is what each has to say and do, and what the Data (Use and Access) Act 2025 changed for a small practice.
Key points
- The privacy notice covers the Article 13 items: who you are, what you collect and why, the lawful basis, who receives it, transfers abroad, retention, rights and how to complain.
- Health details do not belong in a contact form: they are special category data and need a separate Article 9 condition.
- Nothing non-essential is set before the visitor consents, rejecting is as easy as accepting, and the choice can be changed later.
- The 2025 Act added a complaints duty and two narrow cookie exceptions; it did not remove the need for a notice, a lawful basis or consent.
What the privacy notice has to say
Article 13 of the UK GDPR lists what a person must be told when you collect their details from them, and the ICO’s guidance on the right to be informed turns the list into a table. For a practice website:
- The controller. The practice’s legal name, address and a contact for data questions.
- What is collected, and why. Usually a name, a way to reply and the text of an enquiry, collected to answer it; analytics, if any, is a second purpose with its own entry.
- The lawful basis. The ICO’s guide now names seven; an enquiry is usually handled under legitimate interests, or as a step the person asked for before a contract, and the notice says which.
- Who receives the data. By name, or by categories as specific as you can make them, including the companies that process data for you: the form service and the mailbox provider.
- Transfers outside the UK. If either is run from the United States, the enquiry leaves the UK. The notice says so and names the safeguard: the UK Extension to the EU-US Data Privacy Framework where the company is certified for it, otherwise the appropriate safeguards you put in place after a transfer risk assessment.
- How long it is kept. A period, or the rule used to decide one. “As long as necessary” is neither.
- The person’s rights. Access, correction, erasure, restriction, objection and portability, withdrawal where consent is the basis, and the right to object, brought to the person’s attention separately.
- How to complain. To the practice, which the Act now requires to offer a route, and to the ICO, with its contact details.
The notice sits beside the form’s send button and is one of the fixed pages a private practice website needs before launch.
Why health details should stay out of the contact form
Data about health is special category data, which the ICO treats as needing more protection; processing it needs an Article 9 condition on top of the lawful basis.
Two conditions fit a practice: explicit consent, and processing for diagnosis, care or treatment under a professional bound by confidentiality. Relying on the second for a web form puts the form service and the mailbox inside that chain of confidentiality. The plain course is to ask for a name, a way to reply and the subject, to say on the form that medical details should be left out, and to take the clinical conversation to the phone or the appointment.
A patient review that mentions a condition is health data too; the rules for patient reviews on a medical website cover the rest.
What the cookie rules require
The rule for cookies is regulation 6 of the Privacy and Electronic Communications Regulations, substituted on 5 February 2026 by the Data (Use and Access) Act: nothing is stored on or read from a visitor’s device unless the visitor has been given clear and comprehensive information about the purpose and has consented. The exceptions sit in a schedule under the regulation: storage strictly necessary for a service the visitor asked for; and, new in 2026, statistics about use of the site and settings that change how it looks or works, each as the sole purpose, with clear information and a simple way to object.
The ICO’s guidance on storage and access technologies, finalised on 29 April 2026, turns that into a page.
- Nothing that needs consent is set before the visitor acts; scrolling, or ignoring the banner, is not consent.
- A reject button beside the accept button.
- An analytics tool is inside the statistics exception when improving your own site is its sole purpose and the provider uses the data for nothing else; anything that serves advertising is never exempt, so for most practices analytics waits for consent.
- A settings link lets the visitor change the choice, withdrawal removes what was set, and the site works in full on Decline.
Which script loads when is settled in the development of the site.
What the Data (Use and Access) Act changed, and what it did not
The ICO’s summary lists the changes, all in force by 19 June 2026. Four matter for a practice website: the complaints duty (help people complain, an electronic form if there is no other route, acknowledgement within 30 days, an answer without undue delay); the two cookie exceptions above; subject access searches that are reasonable and proportionate; and recognised legitimate interests, a new basis that a practice website rarely touches.
What the Act did not do is the longer list: it amends the UK GDPR, the Data Protection Act 2018 and PECR and replaces none of them, so a lawful basis is still needed for every purpose, special category data still needs its own condition, the notice is still required, and consent is still needed for anything a cookie does outside the narrow exceptions. A notice written in 2024 needs the complaints route added and its cookie section checked.
Common questions
Does a practice need a cookie banner if it runs no analytics?
If the site sets nothing beyond what is strictly necessary, there is nothing to consent to and no banner is needed. An embedded video, a map or a review widget usually brings its own cookies, and with the first of them the banner is needed again.
Can the notice be copied from another practice?
The headings are the same; the facts are not. Your providers, your basis, your retention period and your transfer safeguard are yours, and a copied page names someone else’s.
Is analytics now allowed without consent?
Within the statistics exception, yes: statistics as the sole purpose, clear information, a simple way to object, and a third-party tool that uses the data for nothing else. A tool that also serves its provider’s advertising business does not fit.
This article explains the rules in general terms and is not legal advice.
This is part of the development work on every website we look after.
References
- Article 13: Information to be provided where personal data are collected from the data subject (UK GDPR), legislation.gov.uk, The National Archives (2016) — legislation.gov.uk · Accessed 2026-10-11
- Regulation 6: Storing information in the terminal equipment of a subscriber or user (PECR 2003), legislation.gov.uk, The National Archives (2003) — legislation.gov.uk · Accessed 2026-10-11
- What privacy information should we provide?, Information Commissioner's Office — ico.org.uk · Accessed 2026-10-11
- What is special category data?, Information Commissioner's Office — ico.org.uk · Accessed 2026-10-11
- A guide to lawful basis, Information Commissioner's Office (2026) — ico.org.uk · Accessed 2026-10-11
- Guidance on the use of storage and access technologies, Information Commissioner's Office (2026) — ico.org.uk · Accessed 2026-10-11
- How does the UK Extension to the EU-US Data Privacy Framework work?, Information Commissioner's Office (2026) — ico.org.uk · Accessed 2026-10-11
- The Data Use and Access Act 2025 (DUAA): what does it mean for organisations?, Information Commissioner's Office (2025) — ico.org.uk · Accessed 2026-10-11