By business type

Disclaimer Generator for small businesses

Written for a website, a contact form, a mailing list and a card machine - and nothing more elaborate.

Generate your disclaimer Read the disclaimer guide

A small-business disclaimer earns its place where the site publishes guidance, quotes prices, or shows work that a customer might rely on. The point is to be specific about what is indicative and what is a commitment.

Small businesses are subject to the same transparency obligations as large ones, and they usually meet them with a copied policy that describes a company they are not. The result is a document that names cookies the site does not set, promises procedures nobody runs, and misses the one thing the business actually does with personal data.

The realistic processing set for a small business is short: enquiries through a form or an inbox, a customer list for invoicing, a mailing list if there is one, card payments through a terminal or gateway, and a website with analytics. Describing those five things accurately produces a better document than any template.

The obligations people underestimate are the ones outside the privacy policy: the ICO registration fee in the UK, retention of accounting records, and the fact that CCTV on business premises is processing with its own signage and access requirements.

What a disclaimer for a small business has to cover

That published prices, availability and lead times are indicative until confirmed
That guidance and articles are general information, not advice for a specific situation
Photographs and examples of previous work, and that results vary
Links to suppliers, partners and directories whose content you do not control
The carve-outs consumer law requires, including death, personal injury and fraud

How a small business actually moves personal data

Enquiries by form, email and phone

Name and contact details held in an inbox indefinitely unless someone decides otherwise.

Customer records and invoicing

Held in accounting software, retained for statutory periods.

Mailing lists

Often built informally from customers and enquiries, with no consent record behind them.

Card payments

Through a terminal or online gateway, with the provider handling card data.

Website analytics

Usually Google Analytics, installed once and never revisited.

CCTV on premises

Processing of images of identifiable people, with signage and retention duties attached.

Third parties the draft will ask you about

Xero, QuickBooks or Sage · SumUp, Zettle or Stripe · Google Workspace or Microsoft 365 · Mailchimp · a website host · a CCTV provider

The rules that apply

Transparency regardless of size

No small-business exemption in UK or EU data protection law. The obligations follow the processing.

ICO registration in the UK

Most businesses processing personal data by automated means must pay the annual data protection fee.

Marketing consent rules

PECR and equivalents apply to a mailing list of fifty as much as to one of fifty thousand.

CCTV and premises monitoring

Processing with its own signage, retention and subject access implications.

Accounting record retention

Statutory periods that justify keeping some customer data after the relationship ends.

What the generated disclaimer contains

Scope of what is being disclaimed
The specific content, advice or outcome the disclaimer covers, named rather than gestured at.
No professional relationship
A clear statement that publishing information does not create a professional, advisory or fiduciary relationship.
Accuracy and currency
That content is provided as-is, may date, and should be verified before it is relied on.
External links and third-party content
That you do not control or endorse what sits behind an outbound link.
Affiliate and sponsorship disclosure
Paid relationships disclosed up front, which is a legal requirement in its own right in the US, UK and EU.
Limitation of liability
The consequences you are not responsible for, drafted to survive the consumer law of the markets you publish into.

A realistic small-business checklist

List what you actually collect
Enquiries, customers, mailing list, payments, website, CCTV. Five or six lines.
Write the policy from that list
Rather than editing someone else’s.
Pay the ICO fee if you are UK-based
And set an annual reminder.
Fix the mailing list
Suppress anything you cannot evidence and re-collect consent.
Add a cookie notice if you run analytics
And make it actually block until consent.
Set retention for enquiries and CCTV
And apply it.

Where this usually goes wrong

A copied policy describing tools you do not use

The most common small-business failure, and easy for anyone to spot.

A mailing list built without consent records

Adding customers to a newsletter because they bought something is only permitted under narrow soft opt-in conditions.

Not paying the ICO fee

A separate legal duty from anything in the policy, checked against a public register.

Enquiry emails kept forever

There is no purpose after the enquiry is closed and any follow-up window has passed.

CCTV with no notice or retention rule

Signage is required, and footage kept indefinitely is difficult to justify.

Analytics running with no cookie notice

A small site with GA4 and no banner is the single most common finding in the UK.

Frequently asked questions

Does a small business need a privacy policy?

Yes if it processes personal data, which a contact form or a customer list already does. There is no exemption based on size or turnover in the UK or EU.

Do I need to register with the ICO?

Most UK businesses processing personal data by automated means do. The fee is tiered by size and turnover and is enforced separately from other obligations.

Can I email past customers about offers?

Only under the soft opt-in - your own similar products, to someone who bought from you, with an opt-out offered at the time and in every message - or with consent.

Do I need a cookie banner for a small website?

If it runs analytics or any third-party embed, in the UK and EU yes, and it needs to hold those tags until consent is given.

Does a disclaimer actually protect me?

It reduces exposure rather than removing it. A clear, prominent, specific disclaimer helps establish that a reader could not reasonably have treated your content as personalised advice; a vague one buried in a footer does very little.

Where should a disclaimer appear?

On its own page, and repeated at the point of risk - above the fold on the article, video description or calculator it applies to. Regulators care about proximity, not existence.

Do I need to disclose affiliate links?

Yes. The FTC endorsement guides, the UK CAP Code and the EU Unfair Commercial Practices Directive all require a clear, unavoidable disclosure before the link, not in a footer.