GDPR and data protection
Any form that collects personal data needs a lawful basis, a privacy notice, and secure handling. You must be able to export or delete someone's data on request. Consent must be documented, not assumed.
Cookies and consent
Non-essential cookies (analytics, marketing) require informed, active consent before they load, not a banner that pre-ticks boxes. A compliant consent tool and a cookie policy are expected.
Accessibility (WCAG 2.1 AA)
Public-sector bodies must meet WCAG 2.1 AA by law; for private businesses it's a legal risk under the Equality Act 2010 if a disabled user can't use your site. Good practice, alt text, keyboard navigation, contrast, clear structure, protects you and widens your market.
Company information
UK limited companies must display registered name, number and address on the website. Other rules apply to specific sectors, e.g. care and financial services. We advise checking your sector's requirements.
Frequently asked questions
Do I legally need an accessible website?
Public-sector sites must meet WCAG 2.1 AA by law. Private businesses face legal risk under the Equality Act 2010 and reputational risk. Accessibility is also good for SEO and conversions.
What makes a cookie banner compliant?
Non-essential cookies must not load until the user actively consents. Pre-ticked boxes and 'continue browsing implies consent' are not compliant.
Related services
