Privacy notice or consent? What the GDPR actually asks of small businesses

The short answer: a privacy notice is information you owe people whenever you collect their personal data, and it does not need anyone's agreement. Consent is only one of the six lawful bases in Article 6(1) of the GDPR, and it is the right one only when you can give people a genuine choice. If you would process the data anyway, for example to answer a quote request, deliver an order or keep invoices, rely on the basis that actually fits and say so in your notice. This article covers the EU GDPR (Regulation (EU) 2016/679) and the UK GDPR, which use the same article numbers; UK differences are pointed out where they exist.

The right to be informed: in every case, and without consent

Articles 13 and 14 set out what you must tell people. When you collect data from the person directly, you provide the information "at the time when personal data are obtained" (Art. 13(1)). When you get it from somewhere else, such as a referral, a purchased list or a public profile, Article 14(3) sets three deadlines: within a reasonable period and at the latest within one month; at the latest at your first communication if you use the data to contact the person; and at the latest when the data are first disclosed if you plan to pass them on.

Article 12(1) adds how the information must be given: in a concise, transparent, intelligible and easily accessible form, using clear and plain language. It is provided free of charge (Art. 12(5)). Nothing in Articles 13 or 14 makes the person's agreement a condition. The duty is yours, and the reader does not have to accept anything.

The exceptions are narrow. You do not repeat information the person already has (Art. 13(4) and 14(5)(a)), and Article 14(5) lists a few more cases for data obtained from other sources. Read them carefully before relying on one.

Consent is one lawful basis, not the default

Under Article 6(1), processing is lawful only if at least one of the following applies:

(a) the person has given consent for one or more specific purposes,
(b) processing is necessary for a contract with the person, or to take steps at their request before entering into one,
(c) processing is necessary to comply with a legal obligation you are subject to,
(d) processing is necessary to protect someone's vital interests,
(e) processing is necessary for a task carried out in the public interest or in the exercise of official authority,
(f) processing is necessary for your legitimate interests or those of a third party, unless the person's interests or fundamental rights and freedoms override them, in particular where the person is a child.

The list is not a ranking. Article 6(1) only requires that at least one basis applies, and you pick the one that matches the purpose. When consent is the right basis, the bar is high. Article 4(11) defines consent as a "freely given, specific, informed and unambiguous indication" of the person's wishes, given by a statement or a clear affirmative action. Recital 32 adds that silence, pre-ticked boxes or inactivity do not count. You must be able to prove consent (Art. 7(1)), and people can withdraw it at any time; withdrawing must be as easy as giving it, and it does not make earlier processing unlawful (Art. 7(3)).

UK: The UK GDPR adds a further basis, "recognised legitimate interest" (Art. 6(1)(ea)), which applies only where a condition in its Annex 1 is met. Since February 5, 2026, UK GDPR Article 6(11) also names direct marketing as an example of processing that may be necessary for legitimate interests. The EU GDPR makes a similar point in recital 47. In both cases the balancing test of point (f) still applies.

The two most common mistakes

1. Asking for consent for everything

Asking for consent to process an order, send an invoice or keep accounting records can look like playing it safe. It backfires. If the person refuses or later withdraws, you would still process the data on another basis, so the choice you offered was never real. The UK regulator, the ICO, calls this "misleading and inherently unfair" in its guidance on consent. The GDPR points the same way: when judging whether consent is freely given, "utmost account" is taken of whether a contract or service is made conditional on consent to processing that is not necessary for it (Art. 7(4); recital 43).

There is a practical problem too. If you tell customers their invoice data rests on consent and someone withdraws it, you are left in an inconsistent position, because the law may require you to keep those records. That processing belongs under legal obligation (Art. 6(1)(c)) from the start.

2. Mixing the privacy notice with a consent request

A privacy notice is information, not a contract. Articles 13 and 14 do not ask the person to accept it, so a mandatory "I have read and agree to the privacy policy" checkbox adds nothing and blurs what, if anything, the person actually consented to. Consent has to relate to "one or more specific purposes" (Art. 6(1)(a)). If you do need consent for something, keep these points in mind:

When the consent request sits in a document that also covers other matters, it must be "clearly distinguishable from the other matters" (Art. 7(2)).
Separate purposes need separate choices. Recital 43 presumes consent is not freely given if people cannot consent separately to different processing operations where that would be appropriate.
Leave boxes unticked (recital 32).
Keep proof of what the person saw, when and how they agreed (Art. 7(1)).

Where you only need to inform, a short summary next to the form with a link to the full notice is enough to point people to it. The ICO recommends this kind of layered approach as good practice.

What must a privacy notice contain?

The lists in Article 13 (data collected from the person) and Article 14 (data obtained elsewhere) are almost the same:

What to include	Collected from the person	Obtained from elsewhere
Your identity and contact details (and your representative's, if any)	Art. 13(1)(a)	Art. 14(1)(a)
Contact details of your data protection officer, where applicable	Art. 13(1)(b)	Art. 14(1)(b)
The purposes and the legal basis for the processing	Art. 13(1)(c)	Art. 14(1)(c)
The legitimate interests pursued, if you rely on Art. 6(1)(f)	Art. 13(1)(d)	Art. 14(2)(b)
The categories of personal data	Not required	Art. 14(1)(d)
Recipients or categories of recipients	Art. 13(1)(e)	Art. 14(1)(e)
Transfers to a third country, and the adequacy decision or safeguards relied on	Art. 13(1)(f)	Art. 14(1)(f)
How long you keep the data, or the criteria for deciding	Art. 13(2)(a)	Art. 14(2)(a)
The rights of access, rectification, erasure, restriction, objection and portability	Art. 13(2)(b)	Art. 14(2)(c)
The right to withdraw consent, where consent is the basis	Art. 13(2)(c)	Art. 14(2)(d)
The right to lodge a complaint with a supervisory authority	Art. 13(2)(d)	Art. 14(2)(e)
Whether providing the data is a statutory or contractual requirement, and what happens if the person does not	Art. 13(2)(e)	Not required
The source of the data	Not required	Art. 14(2)(f)
Automated decision-making, including profiling, where it applies	Art. 13(2)(f)	Art. 14(2)(g)

"Legal basis" means the specific point of Article 6(1) you rely on, for each purpose. A sentence like "we process your data in accordance with applicable law" names none. If you use service providers outside the EU or the UK, list them among the recipients and give the transfer information as well.

UK: Since June 19, 2026, the UK GDPR also requires you to tell people about their right to complain to you under section 164A of the Data Protection Act 2018 (Art. 13(2)(ca) and 14(2)(da)), in addition to their right to complain to the UK regulator. Section 164A expects you to make complaining easy, for example with a complaint form that can be completed electronically, and to acknowledge a complaint within 30 days.

Applying it in three everyday processes

The examples below are a general framework. Which basis fits depends on your purpose and the data involved.

Website contact form

A visitor leaves a name, an email address and a message asking for a quote. Answering a quote request is typically a step taken at the person's request before entering into a contract (Art. 6(1)(b)); for general questions, legitimate interests (point (f)) may be the closer fit. What to do:

Place a short notice next to the form with a link to your full privacy notice.
Do not add a mandatory "I agree" checkbox for the notice.
If you also offer a newsletter on the same form, make it a separate, unticked option with its own purpose.
Keep form submissions only as long as your notice says you will (Art. 13(2)(a)).

Customers and prospects in your CRM

A customer's contact details and quote and order history are processed to conclude and perform the contract (point (b)). Invoices and accounting records usually fall under legal obligation (point (c)). Asking for consent for these records is the first mistake described above.

Prospects you add from another source, such as a partner's referral, an event attendee list or a public business profile, fall under Article 14. Tell them at the latest at your first contact, and include the categories of data and where you got them (Art. 14(1)(d) and 14(2)(f)). If you rely on legitimate interests, state what those interests are (Art. 14(2)(b)); the person can object on grounds relating to their particular situation (Art. 21(1)). Limiting which team members can see which records also reduces the risk to the people in your database.

Newsletters and email marketing

Marketing emails are subject to e-privacy rules on top of the GDPR: in the EU, the national laws implementing Article 13 of the ePrivacy Directive (2002/58/EC); in the UK, regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR).

The default is prior consent for marketing emails to individuals (Directive Art. 13(1); PECR reg. 22(2)).
Existing customers are the main exception: if you obtained their email address in the context of a sale, you may market your own similar products or services, provided they could refuse this easily and free of charge when you collected the address and can do so in every message (Directive Art. 13(2); PECR reg. 22(3)). In the UK, since February 5, 2026, charities have a comparable exception for their charitable purposes (PECR reg. 22(3A)).
The right to object to direct marketing is absolute: once someone objects, you stop using their data for marketing (GDPR Art. 21(2) and (3)). You must bring this right to their attention at the latest at your first communication, clearly and separately from other information (Art. 21(4)).
Every marketing email must identify the sender and include a valid address for opting out (Directive Art. 13(4)).

According to the ICO, if e-privacy law requires consent for a marketing message, consent is in practice also the right lawful basis under the UK GDPR. Note that these e-privacy consent rules protect individuals (Directive Art. 13(5); PECR reg. 22(1)); if you email business contacts, check how your country's rules treat corporate addresses. If you are unsure which basis applies to a specific process, consult a lawyer.

Short checklist

For every collection point (form, contract, CRM entry, phone call), have you written down the purpose and the Article 6(1) basis?
Have you removed consent requests for processing that relies on another basis?
Is your privacy notice presented as information, with any consent requests clearly separated and unticked?
Does your notice cover every item in the table above, including recipients, transfers and retention periods?
Do you tell prospects from other sources about your processing at the latest at your first contact?
Can you prove each consent you rely on (text shown, date, method)?
If you operate in the UK, does your notice mention the right to complain to you under section 164A?

Deciding which records you have to keep is covered in our article on registration and records of processing.

This article is for general information only and is not legal advice.

Collobr keeps customer records, quotes and conversations in one place, with role- and department-based permissions so each employee sees only their own data. Collobr currently hosts data in Turkey and an EU hosting option is in preparation; until then, list Collobr in your privacy notice as a provider outside the EU or the UK. Compare the plans and try it free for 14 days.