GDPR and cookies on a small business website
GDPR and cookies on a small business website: when cookies need consent under the 2026 rules, and how long to keep contact form data.
·
4 min read
Who actually owns your business domain name? Legally it's the registrant, the person or company named on the registration, and in practice it's whoever can log in to the registrar account. If either sits with someone who has left the business, get both moved into a company account before something breaks.
A domain is registered once, then forgotten. The designer who built your first site bought it in their own account. Or a staff member registered it with a personal email address and paid on their own card. Nobody notices while it renews quietly.
You find out when the site goes down or email stops arriving. Sometimes it's an expiry notice sent to an inbox nobody reads. Sometimes it's the day you try to move to a new provider and can't get the transfer code.
These are two different things, so check both.
A domain can be registered to your company while the login sits with a freelancer. Or the login can be yours while the registrant is a person who left years ago. Both are worth fixing.
Expiry is the obvious risk. For .uk domains, Nominet's published expiry process gives a 30-day grace period after expiry when the domain still works and can be renewed. After that it stops resolving, so the website and email on it stop. It can still be renewed until 90 days after expiry. Between 90 and 95 days it can't be renewed, and then it drops and anyone can register it.
The quieter risk is control. The registrant is the person with the right to the name. If that person is a former contractor who won't cooperate, you're negotiating rather than administering. Your email depends on the domain too, which is why offboarding staff from Microsoft 365 or Google Workspace should include domain logins. The records behind quotes landing in spam live in the same DNS.
Start with a company account at a registrar, opened with a shared company email address rather than one person's inbox.
For generic domains such as .com, ICANN's Transfer Policy sets the rules. The current registrar must give the registrant the authorisation (EPP) code and can't refuse just because of a payment dispute with them. It can deny a transfer within 60 days of registration or a previous transfer. Changing the registrant details triggers a 60-day transfer lock unless the registrant opted out beforehand. ICANN's change of registrant page suggests transferring to the new registrar first, then changing the registrant, to avoid that lock. The click-by-click side of a transfer is covered in moving off Wix or Squarespace.
For .uk, changing who holds the domain is a registrant transfer, done through the registrar. Nominet's fee schedule lists £10 plus VAT per domain for a transfer of registrant, charged to registrars. Your registrar may add its own fee. Moving between registrars is a separate step, and Nominet's registrar FAQ describes it moving to transfer authorisation codes, so ask your registrar which process applies today.
If the current registrant won't hand it over, Nominet runs a Dispute Resolution Service for .uk names. Nominet says you need rights in a matching or similar name, such as a trade mark, and from 7 July 2026 complaints go through WIPO. For generic domains, ICANN's change of registrant page points to the UDRP for abusive registrations. For anything contested, take legal advice.
Once the question "Who actually owns your business domain name?" has a clear answer, keep it that way:
Our website service includes domain registration and cloud hosting. Branded email on your own domain is part of it, with SSL certificate maintenance and backups. We handle the technical work, and you tell us what the site should say.
If you're not sure who holds your domain or its DNS, talk to an engineer. Send us the domain name and what you know about who set it up.
GDPR and cookies on a small business website: when cookies need consent under the 2026 rules, and how long to keep contact form data.
·
4 min read
The info@ inbox nobody owns is where a UK SME's enquiries sit with no named owner and no reply time.
·
4 min read
How to approach moving off Wix or Squarespace without losing your Google ranking, from exporting content to setting up 301 redirects.
·
4 min read
Why your quotes land in spam: SPF, DKIM and DMARC explained for business owners, and how to check your own domain with free tools.
·
3 min read
What the NCSC's China-linked botnet alert means for a small business: check the router and remote access kit you already own.
·
4 min read
What changes when a trades business moves from paper job sheets to a phone app, including how the app copes with no signal.
·
4 min read
A plain-English guide to Cyber Essentials for small businesses, covering what the scheme checks and when a contract will ask for it.
·
4 min read
Offboarding staff from Microsoft 365 or Google Workspace, step by step: cut access, revoke devices, keep mail and files, and stop paying for the licence.
·
4 min read
Office move IT checklist for London SMEs: internet lead times, surveys, cabling, network design, servers and security before and after moving.
·
4 min read
Online booking for clinics: when an off-the-shelf tool is enough, when to have one built, and what to watch for with each.
·
4 min read
Why your business doesn't show up on Google Maps: verification, categories, mismatched details, service areas, your website and reviews.
·
4 min read
How much does a small business website cost in the UK? What drives the price, how DIY, freelancer and agency compare, and how Eight Mile prices sites.
·
3 min read
Multi-site office network design for London SMEs: site-to-site links, consistent segmentation, accounts you keep.
·
3 min read