By country

Terms & Conditions Generator UK

UK GDPR, the Data Protection Act 2018 and PECR - drafted for the ICO, not for a generic "GDPR" audience.

Generate your terms and conditions Read the terms and conditions guide

UK terms and conditions are read against the Consumer Rights Act 2015 and the Consumer Contracts Regulations 2013, both of which override anything in your document that tries to contract out of them. The drafting problem is not breadth, it is enforceability: a clause struck out as unfair leaves you with nothing where a narrower one would have held.

Since Brexit the UK runs its own data protection regime. UK GDPR sits alongside the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) govern cookies and marketing separately, and the Information Commissioner’s Office is the regulator you name in your policy - not the EDPB, and not "your local supervisory authority".

The Data (Use and Access) Act 2025 changed the enforcement arithmetic. PECR penalties, previously capped at £500,000, now run to UK GDPR levels - £17.5 million or 4% of global turnover. Cookie banners and marketing consent, historically the cheapest rules to ignore in the UK, became the most expensive.

A UK-facing policy also has to handle transfers in the opposite direction from an EU one. The UK issues its own adequacy decisions, uses the International Data Transfer Agreement or the Addendum to the EU SCCs rather than the SCCs alone, and has its own UK-US Data Bridge for certified American importers.

What a terms and conditions in the UK has to cover

Fourteen-day cancellation rights on distance sales, stated separately from any goodwill returns policy
The statutory quality rights - satisfactory quality, fit for purpose, as described - which cannot be excluded against consumers
A liability cap drafted against the Consumer Rights Act fairness test, with the non-excludable heads carved out
Governing law and jurisdiction, noting that a UK consumer keeps the right to sue in their local court
Where users can post content: complaint, takedown and appeal routes consistent with the Online Safety Act 2023

A "no refunds under any circumstances" clause is not merely unenforceable in the UK - advertising it is a misleading commercial practice under the Consumer Protection from Unfair Trading Regulations, enforceable by Trading Standards.

How the UK actually moves personal data

UK-resident customer and account records

Names, addresses, order history and support tickets held by a UK business are almost always processed under contract or legitimate interests - but the basis has to be stated per purpose, and marketing is a separate purpose with a separate basis.

Analytics and advertising identifiers

GA4, Meta and TikTok pixels and any server-side tagging all read or write to the device. Under PECR that needs consent before the tag fires, which is a stricter test than "we have a legitimate interest in analytics".

Payments through UK and EEA processors

Stripe, GoCardless, Worldpay and PayPal each act as independent controllers for fraud prevention, so the policy has to describe a hand-off, not just a sub-processor.

Transfers to US SaaS vendors

Most UK businesses send data to American hosting, email and support tools. Each destination needs a named mechanism: the UK-US Data Bridge for certified importers, otherwise the IDTA or the UK Addendum plus a transfer risk assessment.

Employee and applicant data

The ICO’s employment practices guidance treats recruitment records, monitoring and reference checks as high-scrutiny processing, and expects a separate privacy notice for staff rather than a line in the customer policy.

Cookie consent records

PECR compliance is proved by the consent log - timestamp, version of the banner, and the categories accepted. Without it, an ICO complaint is your word against the complainant’s.

Third parties the draft will ask you about

Stripe · GoCardless · Worldpay · Royal Mail and DPD · Google Analytics 4 · Mailchimp · HubSpot · AWS eu-west-2 (London) · Microsoft 365 · Xero

The rules that apply

UK GDPR + Data Protection Act 2018

The transparency duties in Articles 13 and 14, the lawful basis requirement in Article 6, and the DPA 2018 schedules that carry the UK-specific conditions for criminal-offence and special-category data.

PECR (as amended by the Data (Use and Access) Act 2025)

Consent before any non-essential storage or access on a device, and opt-in for electronic marketing outside the narrow soft opt-in. Penalties now match UK GDPR levels.

The ICO

Your named supervisory authority. Users must be told they can complain to the ICO, and the ICO expects a working contact route for you before that escalation.

Consumer Rights Act 2015 + Consumer Contracts Regulations 2013

Fourteen-day cancellation on distance sales, statutory quality rights that no policy can exclude, and the unfair-terms test that voids overreaching liability caps.

Online Safety Act 2023

If users can post or message each other, Ofcom-regulated duties on illegal content and children’s access apply, and your published rules and reporting route are part of the compliance record.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Making a UK policy operational

Check whether you need to pay the ICO data protection fee
Most UK controllers must register and pay an annual fee of £52, £78 or £2,900 depending on size and turnover. It is a separate legal duty from publishing a policy and is enforced independently.
Decide whether you need an EU representative
If you also target EU customers, Article 27 of the EU GDPR may require an EU-based representative even though you are UK-established. Name them in the policy if so.
Record your lawful basis before you publish
The ICO expects the decision to predate the notice. Keep the legitimate interests assessment for each LI-based purpose on file.
Run a cookie scan and reconcile it against the banner
Compare what actually fires before consent against what the banner claims. Any tag firing pre-consent is the finding an ICO complaint will start from.
Set the breach clock
Seventy-two hours to the ICO from awareness, and without undue delay to individuals where the risk is high. The escalation path has to exist before the incident.

Where this usually goes wrong

Naming the EDPB or "the supervisory authority" instead of the ICO

A UK policy that never names the ICO reads as a copied EU document. It also fails the practical test of Article 13(2)(d): the person has to know where to complain.

Treating the EU SCCs as sufficient for UK transfers

The EU clauses alone do not cover a UK export. You need the UK Addendum bolted on, or the standalone IDTA. This is the single most common defect in UK policies copied from EU templates.

Relying on legitimate interests for analytics cookies

PECR requires consent for storage and access regardless of the GDPR basis for the processing that follows. The ICO wrote to the UK’s largest websites about exactly this pattern.

A cookie banner with no equally prominent reject

The ICO’s published position is that accept and reject must take the same number of clicks. A banner with "Accept all" and a buried "Manage settings" is the version that draws the letter.

Missing the soft opt-in conditions for email marketing

The B2C soft opt-in only applies to your own similar products, sold to someone who bought from you, with an opt-out offered at collection and in every message. Businesses routinely claim it for purchased lists, where it does not apply.

Frequently asked questions

Does UK GDPR still apply after Brexit?

Yes. UK GDPR was retained in domestic law and then amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It is a live UK statute enforced by the ICO, not a transitional arrangement.

Do I need both UK and EU GDPR compliance?

If you have customers in both, yes. They are separate laws with separate regulators. In practice one policy can serve both provided it names both regimes, both regulators and the correct transfer mechanism in each direction.

Do I have to register with the ICO?

Most organisations processing personal data by automated means must pay the annual data protection fee unless an exemption applies. Publishing a policy does not discharge that duty.

How much can the ICO fine a small business?

Up to £17.5 million or 4% of global annual turnover under UK GDPR, and since the Data (Use and Access) Act 2025 the same ceiling applies to PECR breaches such as cookie and marketing failures. In practice the ICO’s small-business enforcement is dominated by nuisance-marketing penalties in the tens of thousands.

Is a UK privacy policy different from an EU one?

Structurally no, substantively yes in three places: the regulator named, the transfer mechanism used, and the cookie rules cited - PECR rather than the ePrivacy Directive as implemented locally.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.