Privacy Policy vs Terms and Conditions: What's the Difference?

Many small business owners treat these as one document. They are not. They answer different questions, for different reasons, and most businesses with a website need both. This guide explains the difference in plain English. It is general information for England and Wales, not legal advice.

The one-line answer

• A privacy policy tells people what you do with their personal data.
• Terms and conditions set out the rules of your deal: what you sell, the price, payment, delivery, cancellations, and what happens if something goes wrong.

What a privacy policy does

Under the UK GDPR, if you collect personal data from people you must give them certain information about it: who you are, what you collect, why, who you share it with, how long you keep it, and their rights (Articles 13 and 14, UK GDPR, on legislation.gov.uk). A privacy policy is the usual way to do this.

It is aimed at anyone whose data you handle: customers, website visitors, newsletter subscribers, job applicants.

It is required by law in practice for most businesses collecting personal data, because the information duty exists whether or not you have a document called a "policy". For a practical walk-through, see our GDPR checklist for small businesses.

What terms and conditions do

Terms and conditions are the contract between you and your customer. They typically cover:

• What you are selling or providing
• Prices, payment and invoices
• Delivery or service timing
• Cancellations, returns and refunds
• Limits on your responsibility
• How complaints and disputes are handled
• Which law applies (for most of our customers, the law of England and Wales)

Terms and conditions are not always required by law, but without them you rely on the default rules of the law, which may not suit your business. Written terms give both sides certainty.

Rules that affect your terms

If you sell to consumers (individuals buying for personal purposes), certain legal rules limit what you can say:

• The Consumer Rights Act 2015 deals with the quality of goods, services and digital content, and with unfair terms. Terms that are unfair to consumers may not be enforceable (legislation.gov.uk/ukpga/2015/15).
• For online and distance sales, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 deal with information you must give and cancellation rights.
• Businesses selling online must also give certain information about themselves under the Electronic Commerce (EC Directive) Regulations 2002.

If you sell only to other businesses, you have more freedom, though some fairness rules still apply.

Side-by-side

Do I need both?

Examples:

• Online shop: Yes, both. You collect customer data and sell goods.
• Consultant with a simple website and contact form: A privacy policy at least. Terms for your client work are best covered in a service agreement.
• Newsletter only: A privacy policy.
• Landlord or agent: Privacy information for tenants and applicants, and the tenancy agreement as the contract.

Common mistakes

• Using one combined page and calling it "Terms", with no real privacy information in it.
• Copying a big company's policy that talks about services you do not provide.
• Promising refunds or delivery times in your terms that you cannot meet.
• Not updating either document when the business changes.
• Hiding terms where customers cannot see them before buying.

How UKDocs AI helps

Answer simple questions about your business, and UKDocs AI prepares a draft Privacy Policy and Terms and Conditions for England and Wales. You review and adjust them, and take them to a solicitor if your situation is complex (for example, selling to vulnerable customers or handling sensitive data).