Rules and ethics
Part of Legal and ethical gates for one England UGC commission, with no marketplace shortcut
Personal data through one UGC commission, from lawful basis to deletion
Map personal data through one England UGC commission, separating lawful basis, transparency, PECR contact, supplier roles, rights and deletion.
Data protection for a UGC marketplace starts with a field-level map, not a statement that a supplier is compliant. For one English brand's short-form commission, list information about the creator, representative, featured person, marketplace user and account operator. Record who obtained each field, why, from where, when, who can see it and when it should be corrected or deleted.
This is UK-wide data-protection law applied to an England workflow. The Data (Use and Access) Act 2025 amended the UK GDPR, Data Protection Act 2018 and PECR. The ICO's DUAA page says all data-protection provisions were in force by 19 June 2026. It did not replace the existing framework.
What to take away
- Map each personal data field (field, source, purpose, lawful basis, retention, deletion trigger) before claiming a supplier is compliant with data protection law.
- The Data (Use and Access) Act 2025 in-force date is 19 June 2026, when the ICO says all data-protection provisions applied.
- One lawful basis should not be copied across purposes without a qualified assessment.
- Do not infer special category data from profiles without documented need and specialist approval.
- Social media direct messages count as electronic mail marketing under PECR rules.
- In England, the ICO enforces data-protection law; its contact route is the ICO helpline on 0303 123 1113.
Map the purpose before collecting
Separate marketplace account administration, creator discovery, contracting, payment and content production. For creator discovery the lawful basis is legitimate interests; for contracting and payment it is contract; for tax records it is legal obligation.
Separate advertising publication, audience measurement, complaints and tax records; never copy one lawful basis across those purposes without a qualified assessment. ICO's lawfulness, fairness and transparency guidance says organisations need valid grounds for collecting and using personal data.
That page is marked under review following DUAA changes, so preserve its version and recheck it before publication.
A worked example for the same short-form commission:
| Field | Source | Purpose | Lawful basis | Retention | Deletion trigger |
|---|---|---|---|---|---|
| Creator name and handle | Creator | Discovery, contracting and payment | Legitimate interests for discovery; contract for contracting and payment | 24 months after last commission (typical) | Creator request or account closure plus 30 days |
| Representative contact | Creator or agency | Contract administration | Contract | 24 months after last commission (typical) | Contract end plus 30 days |
| Featured person name and release | Creator | Publication and rights clearance | Consent | 12 months after publication or consent expiry, whichever is later | Consent withdrawal or rights expiry |
| Tax record | Creator and brand | Tax compliance | Legal obligation | 6 years from end of accounting period (HMRC rule) | End of tax retention period |
Do not infer residence, age, ethnicity, health, beliefs, interests, audience composition, creator competence or willingness from a profile. ICO guidance explains that intended special-category inferences can trigger extra requirements even when confidence in the inference is low. The simplest planning control is to prohibit such inference unless a documented need and specialist approval exist.
Give privacy information at the right point
If information comes from the person, a marketplace, an agency or a public source, record the relevant transparency route. The ICO's right-to-be-informed guidance lists matters including controller contact details, purposes, lawful basis, recipients, retention and individual rights. Public visibility does not erase those questions.
Creator contact is a separate decision. The ICO includes social-media direct messages within electronic mail marketing. A named reviewer, a UK privacy and PECR specialist, should classify the purpose, subscriber type, solicitation and contact evidence before outreach. Marketplace membership alone is not universal permission for brand promotion.
Test the supplier chain and exit
Determine controller and processor roles from actual decisions. For a short-form commission, the brand is usually the controller for payment, campaign and tax purposes. The marketplace is a processor when it only follows documented instructions, but it becomes a controller for its own discovery or marketing.
The ICO's contracts guidance discusses documented instructions, confidentiality, security, subprocessors, rights assistance, audits and return or deletion at contract end. It remains marked under review, so it needs a publication-day source check and legal review.
Use fictional records to test duplicate identity, correction, contact suppression, restricted access, incident escalation, export and deletion. Evidence for a deletion test can be a dated screenshot showing the test creator record absent, a confirmation email from the marketplace and the reviewer's pass mark.
NCSC advice for important online accounts covers two-step verification and removal of unnecessary accounts. It does not prove a marketplace configuration is secure.
The privacy gate is a documented check run by the reviewer that records pass, fail or unresolved for one processing operation. It cannot approve copyright, advertising, safeguarding or contract questions. Keep publication on HOLD until the reviewer signs the current data map and the deletion test evidence.
Before you act
- Map each data field with source, purpose and retention.
- Separate lawful bases for each distinct processing purpose.
- Prohibit special category inferences without documented approval.
- Classify outreach purpose before contacting creators.
- Test deletion, correction and access with fictional records.
- Get the reviewer's sign-off before publication.
Common questions
What does the ICO say about the Data (Use and Access) Act 2025?
The ICO's DUAA page says all data protection provisions were in force by 19 June 2026. The Act amended the UK GDPR, Data Protection Act 2018 and PECR. It did not replace the existing framework, so organisations must still follow the current rules.
When can a marketplace send marketing to creators?
Before outreach, the reviewer classifies the purpose, subscriber type, solicitation and contact evidence.
What should a privacy gate approve?
It records pass, fail or unresolved for one processing operation. It cannot approve copyright, advertising, safeguarding or contract questions.
