By country

Disclaimer Generator UK

UK GDPR, the Data Protection Act 2018 and PECR - drafted for the ICO, not for a generic "GDPR" audience.

Generate your disclaimer Read the disclaimer guide

UK disclaimers are constrained by the Unfair Contract Terms Act 1977 and the Consumer Rights Act 2015: you cannot exclude liability for death or personal injury from negligence at all, and you cannot exclude much else against a consumer unless the term passes a fairness test.

Since Brexit the UK runs its own data protection regime. UK GDPR sits alongside the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) govern cookies and marketing separately, and the Information Commissioner’s Office is the regulator you name in your policy - not the EDPB, and not "your local supervisory authority".

The Data (Use and Access) Act 2025 changed the enforcement arithmetic. PECR penalties, previously capped at £500,000, now run to UK GDPR levels - £17.5 million or 4% of global turnover. Cookie banners and marketing consent, historically the cheapest rules to ignore in the UK, became the most expensive.

A UK-facing policy also has to handle transfers in the opposite direction from an EU one. The UK issues its own adequacy decisions, uses the International Data Transfer Agreement or the Addendum to the EU SCCs rather than the SCCs alone, and has its own UK-US Data Bridge for certified American importers.

What a disclaimer in the UK has to cover

The specific content the disclaimer covers, named rather than described in general terms
A statement that no professional or advisory relationship is created
Affiliate and sponsored-content disclosure meeting the CAP Code and the Digital Markets, Competition and Consumers Act 2024
The carve-outs the law requires: death, personal injury, fraud and statutory rights

How the UK actually moves personal data

UK-resident customer and account records

Names, addresses, order history and support tickets held by a UK business are almost always processed under contract or legitimate interests - but the basis has to be stated per purpose, and marketing is a separate purpose with a separate basis.

Analytics and advertising identifiers

GA4, Meta and TikTok pixels and any server-side tagging all read or write to the device. Under PECR that needs consent before the tag fires, which is a stricter test than "we have a legitimate interest in analytics".

Payments through UK and EEA processors

Stripe, GoCardless, Worldpay and PayPal each act as independent controllers for fraud prevention, so the policy has to describe a hand-off, not just a sub-processor.

Transfers to US SaaS vendors

Most UK businesses send data to American hosting, email and support tools. Each destination needs a named mechanism: the UK-US Data Bridge for certified importers, otherwise the IDTA or the UK Addendum plus a transfer risk assessment.

Employee and applicant data

The ICO’s employment practices guidance treats recruitment records, monitoring and reference checks as high-scrutiny processing, and expects a separate privacy notice for staff rather than a line in the customer policy.

Cookie consent records

PECR compliance is proved by the consent log - timestamp, version of the banner, and the categories accepted. Without it, an ICO complaint is your word against the complainant’s.

Third parties the draft will ask you about

Stripe · GoCardless · Worldpay · Royal Mail and DPD · Google Analytics 4 · Mailchimp · HubSpot · AWS eu-west-2 (London) · Microsoft 365 · Xero

The rules that apply

UK GDPR + Data Protection Act 2018

The transparency duties in Articles 13 and 14, the lawful basis requirement in Article 6, and the DPA 2018 schedules that carry the UK-specific conditions for criminal-offence and special-category data.

PECR (as amended by the Data (Use and Access) Act 2025)

Consent before any non-essential storage or access on a device, and opt-in for electronic marketing outside the narrow soft opt-in. Penalties now match UK GDPR levels.

The ICO

Your named supervisory authority. Users must be told they can complain to the ICO, and the ICO expects a working contact route for you before that escalation.

Consumer Rights Act 2015 + Consumer Contracts Regulations 2013

Fourteen-day cancellation on distance sales, statutory quality rights that no policy can exclude, and the unfair-terms test that voids overreaching liability caps.

Online Safety Act 2023

If users can post or message each other, Ofcom-regulated duties on illegal content and children’s access apply, and your published rules and reporting route are part of the compliance record.

What the generated disclaimer contains

Scope of what is being disclaimed
The specific content, advice or outcome the disclaimer covers, named rather than gestured at.
No professional relationship
A clear statement that publishing information does not create a professional, advisory or fiduciary relationship.
Accuracy and currency
That content is provided as-is, may date, and should be verified before it is relied on.
External links and third-party content
That you do not control or endorse what sits behind an outbound link.
Affiliate and sponsorship disclosure
Paid relationships disclosed up front, which is a legal requirement in its own right in the US, UK and EU.
Limitation of liability
The consequences you are not responsible for, drafted to survive the consumer law of the markets you publish into.

Making a UK policy operational

Check whether you need to pay the ICO data protection fee
Most UK controllers must register and pay an annual fee of £52, £78 or £2,900 depending on size and turnover. It is a separate legal duty from publishing a policy and is enforced independently.
Decide whether you need an EU representative
If you also target EU customers, Article 27 of the EU GDPR may require an EU-based representative even though you are UK-established. Name them in the policy if so.
Record your lawful basis before you publish
The ICO expects the decision to predate the notice. Keep the legitimate interests assessment for each LI-based purpose on file.
Run a cookie scan and reconcile it against the banner
Compare what actually fires before consent against what the banner claims. Any tag firing pre-consent is the finding an ICO complaint will start from.
Set the breach clock
Seventy-two hours to the ICO from awareness, and without undue delay to individuals where the risk is high. The escalation path has to exist before the incident.

Where this usually goes wrong

Naming the EDPB or "the supervisory authority" instead of the ICO

A UK policy that never names the ICO reads as a copied EU document. It also fails the practical test of Article 13(2)(d): the person has to know where to complain.

Treating the EU SCCs as sufficient for UK transfers

The EU clauses alone do not cover a UK export. You need the UK Addendum bolted on, or the standalone IDTA. This is the single most common defect in UK policies copied from EU templates.

Relying on legitimate interests for analytics cookies

PECR requires consent for storage and access regardless of the GDPR basis for the processing that follows. The ICO wrote to the UK’s largest websites about exactly this pattern.

A cookie banner with no equally prominent reject

The ICO’s published position is that accept and reject must take the same number of clicks. A banner with "Accept all" and a buried "Manage settings" is the version that draws the letter.

Missing the soft opt-in conditions for email marketing

The B2C soft opt-in only applies to your own similar products, sold to someone who bought from you, with an opt-out offered at collection and in every message. Businesses routinely claim it for purchased lists, where it does not apply.

Frequently asked questions

Does UK GDPR still apply after Brexit?

Yes. UK GDPR was retained in domestic law and then amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It is a live UK statute enforced by the ICO, not a transitional arrangement.

Do I need both UK and EU GDPR compliance?

If you have customers in both, yes. They are separate laws with separate regulators. In practice one policy can serve both provided it names both regimes, both regulators and the correct transfer mechanism in each direction.

Do I have to register with the ICO?

Most organisations processing personal data by automated means must pay the annual data protection fee unless an exemption applies. Publishing a policy does not discharge that duty.

How much can the ICO fine a small business?

Up to £17.5 million or 4% of global annual turnover under UK GDPR, and since the Data (Use and Access) Act 2025 the same ceiling applies to PECR breaches such as cookie and marketing failures. In practice the ICO’s small-business enforcement is dominated by nuisance-marketing penalties in the tens of thousands.

Is a UK privacy policy different from an EU one?

Structurally no, substantively yes in three places: the regulator named, the transfer mechanism used, and the cookie rules cited - PECR rather than the ePrivacy Directive as implemented locally.

Does a disclaimer actually protect me?

It reduces exposure rather than removing it. A clear, prominent, specific disclaimer helps establish that a reader could not reasonably have treated your content as personalised advice; a vague one buried in a footer does very little.

Where should a disclaimer appear?

On its own page, and repeated at the point of risk - above the fold on the article, video description or calculator it applies to. Regulators care about proximity, not existence.

Do I need to disclose affiliate links?

Yes. The FTC endorsement guides, the UK CAP Code and the EU Unfair Commercial Practices Directive all require a clear, unavoidable disclosure before the link, not in a footer.