By country

Refund Policy Generator UK

UK GDPR, the Data Protection Act 2018 and PECR - drafted for the ICO, not for a generic "GDPR" audience.

Generate your refund policy Read the refund policy guide

A UK refund policy is really two documents in one: the statutory rights a consumer has whatever you write, and the commercial policy you offer on top. Regulators and the courts read them in that order, so the document should too.

Since Brexit the UK runs its own data protection regime. UK GDPR sits alongside the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) govern cookies and marketing separately, and the Information Commissioner’s Office is the regulator you name in your policy - not the EDPB, and not "your local supervisory authority".

The Data (Use and Access) Act 2025 changed the enforcement arithmetic. PECR penalties, previously capped at £500,000, now run to UK GDPR levels - £17.5 million or 4% of global turnover. Cookie banners and marketing consent, historically the cheapest rules to ignore in the UK, became the most expensive.

A UK-facing policy also has to handle transfers in the opposite direction from an EU one. The UK issues its own adequacy decisions, uses the International Data Transfer Agreement or the Addendum to the EU SCCs rather than the SCCs alone, and has its own UK-US Data Bridge for certified American importers.

What a refund policy in the UK has to cover

The 14-day cancellation right under the Consumer Contracts Regulations 2013 and when the clock starts
The 30-day short-term right to reject faulty goods under the Consumer Rights Act 2015
Who pays return postage, split between faulty goods and change of mind
The permitted exclusions - personalised goods, sealed hygiene items, digital content where the right was expressly waived
A refund deadline of 14 days from receiving the goods back or proof of return

How the UK actually moves personal data

UK-resident customer and account records

Names, addresses, order history and support tickets held by a UK business are almost always processed under contract or legitimate interests - but the basis has to be stated per purpose, and marketing is a separate purpose with a separate basis.

Analytics and advertising identifiers

GA4, Meta and TikTok pixels and any server-side tagging all read or write to the device. Under PECR that needs consent before the tag fires, which is a stricter test than "we have a legitimate interest in analytics".

Payments through UK and EEA processors

Stripe, GoCardless, Worldpay and PayPal each act as independent controllers for fraud prevention, so the policy has to describe a hand-off, not just a sub-processor.

Transfers to US SaaS vendors

Most UK businesses send data to American hosting, email and support tools. Each destination needs a named mechanism: the UK-US Data Bridge for certified importers, otherwise the IDTA or the UK Addendum plus a transfer risk assessment.

Employee and applicant data

The ICO’s employment practices guidance treats recruitment records, monitoring and reference checks as high-scrutiny processing, and expects a separate privacy notice for staff rather than a line in the customer policy.

Cookie consent records

PECR compliance is proved by the consent log - timestamp, version of the banner, and the categories accepted. Without it, an ICO complaint is your word against the complainant’s.

Third parties the draft will ask you about

Stripe · GoCardless · Worldpay · Royal Mail and DPD · Google Analytics 4 · Mailchimp · HubSpot · AWS eu-west-2 (London) · Microsoft 365 · Xero

The rules that apply

UK GDPR + Data Protection Act 2018

The transparency duties in Articles 13 and 14, the lawful basis requirement in Article 6, and the DPA 2018 schedules that carry the UK-specific conditions for criminal-offence and special-category data.

PECR (as amended by the Data (Use and Access) Act 2025)

Consent before any non-essential storage or access on a device, and opt-in for electronic marketing outside the narrow soft opt-in. Penalties now match UK GDPR levels.

The ICO

Your named supervisory authority. Users must be told they can complain to the ICO, and the ICO expects a working contact route for you before that escalation.

Consumer Rights Act 2015 + Consumer Contracts Regulations 2013

Fourteen-day cancellation on distance sales, statutory quality rights that no policy can exclude, and the unfair-terms test that voids overreaching liability caps.

Online Safety Act 2023

If users can post or message each other, Ofcom-regulated duties on illegal content and children’s access apply, and your published rules and reporting route are part of the compliance record.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

Making a UK policy operational

Check whether you need to pay the ICO data protection fee
Most UK controllers must register and pay an annual fee of £52, £78 or £2,900 depending on size and turnover. It is a separate legal duty from publishing a policy and is enforced independently.
Decide whether you need an EU representative
If you also target EU customers, Article 27 of the EU GDPR may require an EU-based representative even though you are UK-established. Name them in the policy if so.
Record your lawful basis before you publish
The ICO expects the decision to predate the notice. Keep the legitimate interests assessment for each LI-based purpose on file.
Run a cookie scan and reconcile it against the banner
Compare what actually fires before consent against what the banner claims. Any tag firing pre-consent is the finding an ICO complaint will start from.
Set the breach clock
Seventy-two hours to the ICO from awareness, and without undue delay to individuals where the risk is high. The escalation path has to exist before the incident.

Where this usually goes wrong

Naming the EDPB or "the supervisory authority" instead of the ICO

A UK policy that never names the ICO reads as a copied EU document. It also fails the practical test of Article 13(2)(d): the person has to know where to complain.

Treating the EU SCCs as sufficient for UK transfers

The EU clauses alone do not cover a UK export. You need the UK Addendum bolted on, or the standalone IDTA. This is the single most common defect in UK policies copied from EU templates.

Relying on legitimate interests for analytics cookies

PECR requires consent for storage and access regardless of the GDPR basis for the processing that follows. The ICO wrote to the UK’s largest websites about exactly this pattern.

A cookie banner with no equally prominent reject

The ICO’s published position is that accept and reject must take the same number of clicks. A banner with "Accept all" and a buried "Manage settings" is the version that draws the letter.

Missing the soft opt-in conditions for email marketing

The B2C soft opt-in only applies to your own similar products, sold to someone who bought from you, with an opt-out offered at collection and in every message. Businesses routinely claim it for purchased lists, where it does not apply.

Frequently asked questions

Does UK GDPR still apply after Brexit?

Yes. UK GDPR was retained in domestic law and then amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It is a live UK statute enforced by the ICO, not a transitional arrangement.

Do I need both UK and EU GDPR compliance?

If you have customers in both, yes. They are separate laws with separate regulators. In practice one policy can serve both provided it names both regimes, both regulators and the correct transfer mechanism in each direction.

Do I have to register with the ICO?

Most organisations processing personal data by automated means must pay the annual data protection fee unless an exemption applies. Publishing a policy does not discharge that duty.

How much can the ICO fine a small business?

Up to £17.5 million or 4% of global annual turnover under UK GDPR, and since the Data (Use and Access) Act 2025 the same ceiling applies to PECR breaches such as cookie and marketing failures. In practice the ICO’s small-business enforcement is dominated by nuisance-marketing penalties in the tens of thousands.

Is a UK privacy policy different from an EU one?

Structurally no, substantively yes in three places: the regulator named, the transfer mechanism used, and the cookie rules cited - PECR rather than the ePrivacy Directive as implemented locally.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.