What must be on a business website: NIP, KRS, GDPR

Small business owners often ask what must be on a business website so that they don’t get themselves into trouble. The answer depends on the legal form of the business and on what the website does: whether it only shows the offer, collects data from a form, or sells.

This guide gives you a checklist you can get through in half an hour. You will learn which company details to put in the footer, when a privacy policy and terms and conditions are needed, and what to check with a lawyer. This is neither legal nor tax advice, and I describe the situation as of 31 October 2026.

Step 1: work out what kind of website you have

Everything else depends on this. Answer four questions:

1. Does the website have a contact form, sign-ups or bookings?
2. Do you sell products or services through it and accept payments?
3. Does it load third-party tools: analytics, advertising pixels, chat, maps?
4. Do you have user accounts or a newsletter?

The more “yes” answers, the more documents. A simple brochure website without a form has the shortest list. A store has the longest.

Step 2: company details in the footer

Every provider of services by electronic means must give identifying details: an email address, a first and last name or a business name (firma), and an address. This follows from Article 5 of the Act on Providing Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną). In addition, a company that offers goods or services through its website must state in the offer at least its business name, its NIP (Polish tax identification number) and its registered office or address (Article 20(3) of the Entrepreneurs’ Law, Prawo przedsiębiorców). You can find the current texts of the acts in the ISAP legal database (Internetowy System Aktów Prawnych) at isap.sejm.gov.pl.

In practice, in the footer and on the Contact page you put:

• the company name in full,
• the registered address (or the place where the business is carried out),
• the NIP,
• an email and phone number for contact,
• the KRS number (the National Court Register, Krajowy Rejestr Sądowy), if the company is entered in the KRS (capital companies must give it, see step 3).

For a sole proprietorship (JDG, jednoosobowa działalność gospodarcza), your first and last name with the business name, an address, a NIP and contact details are usually enough. Article 5 does not require you to give your CEIDG entry (Centralna Ewidencja i Informacja o Działalności Gospodarczej, the Polish register of sole proprietorships). If, however, you sell to consumers at a distance, before the contract is concluded you must also inform them about the authority that registered the business and the registration number (Article 12 of the Consumer Rights Act, ustawa o prawach konsumenta). For a sole proprietorship, this usually means giving the CEIDG entry and the NIP.

Step 3: limited liability companies and other companies give more

A limited liability company (spółka z ograniczoną odpowiedzialnością, sp. z o.o.) has additional requirements. Article 206 of the Commercial Companies Code (Kodeks spółek handlowych, KSH) covers, among other things, the details shown on letters and websites. According to it, a company’s website should include:

The simplest way is a single line in the footer. Copy the details exactly from a current extract from the KRS, not from memory: the name, address and capital change more often than you would think. A limited liability company states the amount of its share capital and, if it belongs to a group of companies, the designation of that group. A company formed online using the standard articles of association (S24) that has not yet paid up its capital adds a note that the required contributions have not been made. Similar obligations apply to a joint-stock company (spółka akcyjna; Article 374 KSH, which also requires the paid-up capital), a simple joint-stock company (prosta spółka akcyjna) and a limited joint-stock partnership (spółka komandytowo-akcyjna). These rules do not cover general partnerships (spółka jawna), professional partnerships (spółka partnerska) and limited partnerships (spółka komandytowa), but they provide the details from step 2.

Step 4: privacy policy and the GDPR notice

When you collect personal data, and a contact form does, you must tell the person, among other things, who the controller is, for what purpose and on what legal basis you process the data, how long you keep it, and what rights they have, including the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, Urząd Ochrony Danych Osobowych). This follows from Article 13 of the GDPR. You will find the official explanations at uodo.gov.pl.

Do it in two places:

1. A short notice under the form, visible before you click “Send”.
2. A full privacy policy at a separate address, which the notice links to.

An example of a short notice to adapt:

The controller of your data is [company name], [address]. We process it to reply to your message. You will find details and information about your rights in the [privacy policy].

In the policy, describe the real tools: where you keep the data, who processes it (hosting, email, a booking system, chat) and how long you keep it. When customer data is to be stored on a server in the EU, I handle that in the Customer data in the EU service.

Step 5: cookies and third-party tools

If your website runs analytics, advertising pixels or embedded maps that store or read files on the user’s device (e.g. cookies), you usually need the user’s consent, given after clear information about the purpose. This is regulated by Article 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej), in force since 10 November 2024. Only files that are necessary for the service the user has asked for, such as a shopping cart in a store, may run without consent.

Practical rules:

• analytics and advertising tools do not load before consent,
• refusing is as easy as consenting,
• the cookie policy lists the tools actually used.

I described the technical details in the guide on the cookie banner and Consent Mode v2.

Step 6: terms and conditions, when you sell or provide an account

An online store must have terms and conditions, and the customer must be able to read them before placing an order (Article 8 of the Act on Providing Services by Electronic Means). Terms and conditions are also needed when you offer an electronic service: an account, a newsletter, online booking.

In a store selling to consumers, check:

• the seller’s details and how to contact you,
• the gross price, delivery cost and payment methods,
• the information on withdrawing from the contract and the sample form from Annex 2 to the Consumer Rights Act,
• complaints and liability for the goods’ conformity with the contract (in contracts with consumers, since 2023 it has replaced the statutory warranty, rękojmia),
• for a price reduction: the lowest price from the 30 days before the reduction (the Omnibus rule).

These elements are covered by the Store compliance audit from PLN 1,290 net. In it I check, among other things, manufacturer details, the Omnibus rule and online withdrawal from the contract. The wording of the terms and conditions as a legal document should still be reviewed by a lawyer.

Step 7: accessibility and the statement

Public bodies must publish an accessibility statement. Some businesses, for example online stores selling to consumers, must instead meet the requirements of the European Accessibility Act and describe in their terms and conditions how the service meets them. Microenterprises providing services are exempt. Whether this applies to you depends on your industry and the size of the company, so I won’t settle it in one sentence. I describe who is covered by the act from 28 June 2025 in the guide on website accessibility.

Quick checklist

• [ ] The footer has the name, address, NIP and contact details.
• [ ] A limited liability company or joint-stock company also gives the registry court, KRS number and capital.
• [ ] There is a GDPR notice under the form, with a link to the policy.
• [ ] The privacy policy describes the real tools and providers.
• [ ] Analytics tools load only after consent.
• [ ] A store or online service has terms and conditions available before ordering.
• [ ] I have checked whether the accessibility rules apply to the company.
• [ ] A lawyer has reviewed the documents.

You can catch technical gaps, such as missing HTTPS, email errors and accessibility errors, with the free tool Check your website. It combines Google’s speed measurement with more than 30 tests and shows the result within 30 seconds.

Summary

A business website must show the company’s identifying details, and where there is a form, a GDPR notice and a privacy policy. A company adds its KRS details, and a store adds terms and conditions. It happens that the list turns out to be longer than you assumed, so go through it once and put an annual review in your calendar.

If you’d like me to tidy up your website technically, write to me. I reply within 24 hours, and new customers get 20% off their first project. Remember: this is neither legal nor tax advice, and I describe the situation as of 31 October 2026. Always confirm the wording of your documents with a lawyer.