Legal foundations for running a UK online business

A website can be created quickly, but its commercial process needs a clear legal foundation. The relevant questions depend on whether the business sells goods, services or digital content, serves consumers or businesses, and operates in one territory or several.

This guide maps eleven areas for a UK operation as reviewed on 30 October 2026. Use it to organise the decisions, evidence and primary guidance behind the website. It does not turn every online seller into the same legal model or suggest that a copied terms page resolves all obligations.

1. Choose and administer the business structure

A sole trader, partnership and limited company have different ownership, liability and administration arrangements. A limited company is incorporated through Companies House; a sole trader follows the relevant HMRC registration rules. Do not assume incorporation is mandatory for every small online activity.

Use accurate legal identity and contact details on the website and documents. Companies have specific trading-disclosure requirements. Keep access to statutory accounts and filing services under the business’s control, and follow current identity-verification and filing instructions where applicable.

2. Identify taxes and keep usable records

Tax treatment follows the structure and transactions, not simply the fact that orders arrive online. Income Tax, Corporation Tax, VAT, payroll and cross-border obligations can apply differently. Distinguish sales from profit and gross transactions from processor payouts.

Check the current VAT registration tests and the applicable Self Assessment or company filing requirements. Making Tax Digital has staged rules and qualifying conditions. Record invoices, refunds, fees and business expenses so the correct return can be prepared rather than reconstructing it from a bank balance.

3. Map personal information and privacy responsibilities

List what forms, orders, accounts and integrations collect, why it is needed, where it goes and who controls it. Identify the appropriate lawful basis, retention and access. Use supplier arrangements that address the actual controller and processor roles.

Provide privacy information matching the processing. Assess cookies and similar technologies under current ICO guidance, including any relevant exception conditions. Check whether the ICO fee is required or an exemption applies. Have a procedure for rights requests and potential personal-data breaches.

4. Protect intellectual property and respect others’ rights

Copyright, trade marks, patents and designs protect different things. UK copyright generally arises automatically in qualifying work and has no official registration requirement. Trade-mark registration involves the appropriate name or sign, classes and territory.

Check rights to photographs, fonts, software and commissioned content. Payment to a contractor does not automatically transfer all ownership. Agree assignments or licences expressly, including reuse, modification and source-file access. Keep evidence of permissions and avoid assuming an image found in search is free to use.

5. Write terms that describe the real contract

Identify the supplier, scope, price, delivery or performance, billing period, renewal, cancellation, support and dispute process as relevant. Separate business-to-business arrangements from consumer contracts where the rules differ. The order confirmation should reflect what was agreed.

Make terms accessible before commitment and available in a form the customer can retain where required. Do not rely on a footer link to conceal material conditions. A clause cannot safely be assumed to remove statutory rights merely because the customer ticked a box.

6. Build consumer rights into the journey

Provide clear pre-contract information and an unambiguous payment action for relevant online orders. Explain total pricing, delivery and cancellation accurately. The rules for goods, services and digital content differ, with exceptions and conditions that need to match the product.

For example, relevant distance-service cancellation periods normally run from contract conclusion, while goods have their own receipt-based rules. Digital supply can require express consent and acknowledgement for particular early-supply consequences. Use the current guidance and legislation rather than a blanket “no refunds” statement.

7. Use payments within the right regulatory boundary

Choose a provider supporting the merchant country, business type and methods. Use maintained integrations, strong account protection and authenticated payment notifications. Keep payment-card data within the provider’s intended handling and understand the responsibilities of the implementation.

Accepting payment for your own supply differs from operating a payment service or holding funds for others. If the model includes wallets, money movement, credit or other financial activity, check the relevant FCA boundary. A processor account does not automatically authorise a separate regulated service.

8. Keep advertising and reviews honest

Substantiate claims about price, performance, availability and comparisons. Show material conditions and identify commercial creator content clearly. A gifted product or affiliate relationship can require disclosure even without a conventional advertising invoice.

Do not commission fake reviews or conceal incentives. Review publishers need reasonable and proportionate controls against banned material and misleading review information. Keep permissions for testimonials and ensure any aggregate rating has a genuine, correctly presented basis.

9. Protect systems and define authorised access

Use supported software, individual accounts, appropriate permissions, strong authentication and tested separate backups. Define who can access customer information and how suppliers obtain temporary access. Keep secrets and sensitive data out of screenshots, public logs and repositories.

Security work should stay within explicit authorisation. Document the scope of penetration or load testing and coordinate with hosting and third-party services. Prepare incident responsibilities, evidence preservation and the relevant assessment or notification process instead of assuming technical controls prevent every breach.

10. Plan delivery, returns and cross-border trade

Explain realistic dispatch, delivery coverage and costs before purchase. Maintain a process for lost, damaged or returned goods. Customer obligations and the carrier contract are related but different; a failed delivery should have a clear business owner.

Check product safety, restrictions, customs and tax for the goods and destinations involved. Northern Ireland and international movements can have distinct requirements. A shipping plugin’s available country list is not proof that the business can lawfully and reliably deliver every product there.

11. Keep contracts and dispute handling usable

Use written agreements for developers, fulfilment providers and other material suppliers. Define deliverables, access, data, intellectual property, service boundaries, payment and termination. Record approved changes so a later disagreement does not depend on informal recollections.

Give customers a clear complaint route and keep a factual record of the issue, investigation and remedy. Use the relevant dispute process when needed. Avoid publishing private information or threatening unsupported legal action in a public response.

Make the review practical

Create a small obligation register with a primary source, owner, evidence and next review point. Revisit it when adding a new supplier, territory, subscription model or data integration. Those changes can affect several areas at once.

Walk through a complete transaction and compare the website, confirmation, operational record and actual fulfilment. Identify any mismatch before marketing brings more people into the process. Legal administration becomes more manageable when it follows the real business journey rather than existing as disconnected policy pages.

Keep evidence that the published process works

For each important obligation, identify a practical check: a retained contract confirmation, a verified cancellation route, an access review or a tested request process. Keep only the evidence needed and protect it appropriately. A policy page that describes an action nobody can perform is a warning that the operating model needs attention.

Review supplier changes before release. A new fulfilment company can affect delivery information and data sharing; a new payment product can affect checkout and complaints; a creator campaign can affect rights and advertising disclosure. Assign an owner to the combined review so these changes do not fall between separate teams.