UK GDPR and Data Protection Act 2018
Publish a privacy notice that names who you are, what you collect on every form, why, how long you keep it and how people use their rights; link it from every form.
What your website and marketing must show to stay compliant in technology
The rules that apply to a UK technology business, turned into what your site, ads and social posts must show, or must not say. Each point links to the regulator or the legislation it comes from.
General guidance, not legal advice. Rules change and depend on your circumstances; check the linked source or take advice from a qualified adviser before relying on any point.
Technology rules
Cyber Essentials and Cyber Essentials Plus
Show the Cyber Essentials badge only while the certificate is current, and only for the scope certified.
Source: Cyber Essentials
ISO 27001 information security
Say "ISO 27001 certified" only with a current certificate from an accredited body, and state its scope.
Source: ISO/IEC 27001
SOC 2 where serving US clients
Check what this rule requires you to display or avoid saying, and keep the site consistent with it.
We are confirming the primary source for this point.
PECR electronic marketing
Ask for consent before non-essential cookies or analytics run, and before emailing or texting individuals for marketing; give an unsubscribe in every message.
Professional indemnity insurance
Check what this rule requires you to display or avoid saying, and keep the site consistent with it.
We are confirming the primary source for this point.
IR35 off payroll for contractors
Do not promise an "outside IR35" outcome in marketing; status depends on the facts of each engagement.
Source: Off-payroll working (IR35)
ICO registration as data controller processor
Pay the data protection fee if it applies to you, and name the controller (legal entity) in the privacy notice.
Every UK business site
Whatever the sector, these apply to almost every business website.
Company and trading details
A limited company's site must show its registered name, company number, place of registration and registered office address.
Source: Company and trading details
Privacy notice
Say who you are, what each form collects, why, how long you keep it and how people use their rights.
Source: Privacy notice
Cookie consent
Non-essential cookies and analytics wait for consent, and refusing is as easy as accepting.
Source: Cookie consent
Honest claims
Every claim, review and comparison is true, evidenced and not misleading (CAP Code).
Source: Honest claims
Genuine reviews
No fake, bought or selectively hidden reviews (DMCC Act 2024).
Source: Genuine reviews
See how your site measures up
The free grader checks your site against the visible signals buyers, search engines and AI assistants look for, including several of the points above.
Grade my website Technology websites