UK GDPR and PECR Compliant Website

UK GDPR governs personal data. PECR governs storing or reading information on a visitor's device, which the ICO says includes cookies, tracking pixels, link decoration, device fingerprinting, web storage and scripts and tags. You must obtain prior consent to the UK GDPR standard unless an exception applies; the ICO says continuing to use a website is not valid consent and neither is a pre-ticked box. The strictly necessary exception covers storage that is essential to provide the service the user asks for, such as remembering the goods in a shopping basket. Online advertising purposes never fall under an exception. Where PECR requires consent and the information is personal data, the ICO says you should use consent as your UK GDPR lawful basis for the processing that follows.

The Data (Use and Access) Act 2025 amended PECR, and the law now lists five exceptions to the consent rule. One is the statistical purposes exception: storage or access whose sole purpose is to collect statistical information about the use of your service in order to improve it. It comes with conditions, including clear information and a simple, free way for users to object. The ICO published its final guidance on these rules in April 2026 and says its review of the rules for online advertising continues; advertising measurement still needs consent. The Act also allows the ICO to fine up to £17.5 million or 4% of global turnover under PECR. If you prefer certainty, we set analytics to run only after consent.

The ICO expects your privacy information to state your purposes and lawful basis, the recipients of the data including anyone processing it for you, and how long you keep it, and Article 13 of the UK GDPR requires this information at the time the data is collected. We align your forms with this: only the fields you need, a clear link to the notice at the point of collection, and no pre-ticked marketing boxes. Under Article 28, processing by a processor on your behalf must be governed by a contract in writing, which can be electronic. We prepare a list of the tools on your site that act as processors so you can check the contracts.

If you offer goods or services to people in the EU, the EU GDPR can apply to you alongside UK law (Article 3(2)), and each country adds its own rules for device storage. In Germany, § 25 TDDDG requires consent for storing or accessing information on a device unless access is strictly necessary to provide a service the user has expressly requested, and the guidance of the German supervisory authorities reads that exception strictly. In Belgium, the data protection authority says consent is required unless cookies are strictly necessary, and its checklist rules out an "accept all" button without an equally prominent "refuse all" option at the same level. We build one banner configuration per market where the rules differ.

We audit what your site sets and sends, configure or replace the consent tool, adjust forms and embeds, and document the result so your adviser can review it. We do not provide legal advice or sign off compliance. Costs depend on the size of the site and the number of third-party tools, so they are quoted on request; websites start from 300 € excl. VAT, see pricing. To begin, request a quote or get in touch, and see our wider services.

Is a cookie banner enough?

No. The banner must reflect what the site actually does. The ICO says consent must be a clear positive act, and continuing to browse is not valid consent.

Can I use analytics without consent?

Possibly. Since the Data (Use and Access) Act 2025, PECR has an exception for storage used solely for statistical purposes, with conditions such as a simple, free way to object. Advertising measurement always needs consent, so we check what your tool actually does.

Does the EU GDPR apply to my UK website?

It can, if you offer goods or services to people in the EU (Article 3(2) GDPR). Each EU country also has its own rules on device storage.

Do you give legal advice?

No. We implement the technical side and document it for your adviser.

What does it cost?

It depends on site size and third-party tools, so it is quoted on request.