UK law and Statutory Instruments implement EU law (although the Government can be taken to court if it implements a law which contravenes EU law).
The most relevant pieces of legislation are the Regulation of Investigatory Powers Act 2000, the Data Protection Act 1998, and The Data Retention (EU Directive) Regulations. The Statute Law database is a good place to start.
RIPA specifies when you need to retain information, the DPA specifies when you need to get rid of it (unless you have a good reason not to). For most intents and purposes, the RIPA and DRR trumps the DPA: that is, the RIPA and DRR specifies the “good reasons not to” in the preceding sentence. Note, however, that if you’re just operating a website, then you’re not operating a Public Electronic Communications Network (PECN) or a Public Electronic Communications Service (PECS). You're definitely not a network, and a PECS is defined in the Communications Act 2003 as:
In this Act “electronic communications service” means a service consisting in, or having as its principal feature, the conveyance by means of an electronic communications network of signals, except in so far as it is a content service.
Thus, an ordinary website is a “a content service” and so not a PECS.
(Additionally, most of the regulations don’t apply to you unless the Secretary of State has written to you to tell you to apply them).