With the start of enforcement of the GDPR all site owners will need to review their use of private data, and update their privacy policy and procedures as need be.
The best place to start is to look at the ICO website
Guide to the General Data Protection Regulation
Remember that this is not a ‘tick box’ exercise, you should be conducting a review and assessment and keeping it up to date throughout the year and as things changes.
Also, from 25 May 2018, the Data Protection (Charges and Information) Regulations 2018 requires every organisation or sole trader who processes personal information to pay a data protection fee to the ICO, unless they are exempt. In practice this means most companies will now have to register with the ICO.