Branding agencies data protection: evidence a review can check

Branding agencies need data protection decisions before collecting research recordings, sharing client contacts, adding analytics or sending promotion. The location of the agency in England does not answer who controls the information, why it is used or whether PECR also applies.

A written policy states intentions; the purpose map records what the agency actually does, purpose by purpose, so the decisions can be produced and defended later. The map comes first because a policy that describes anything else is just wording.

This guide is written for two readers at once: the agency building the record, and the buyer working through a directory listing, a shortlist or a review. Branding agencies data protection answers — who controls the information, why it is held, how long it is kept and who receives it — are evidence a reviewer can check. Nothing here supplies a lawful-basis decision or compliance assurance for a real project.

The governing law is UK GDPR, read with the Data Protection Act 2018 and amended by the Data (Use and Access) Act 2025. The 2025 Act comes into force in stages, and one change that touches the purpose map is the list of recognised legitimate interests, where the balancing test does not apply. Other changes are still bedding in, so some ICO guidance pages are marked under review.

What to take away

Split purposes into separate rows for research, delivery, analytics and marketing before drawing any data flow.
Keep the map as the record of processing activities that UK GDPR Article 30 requires, and name a lawful basis in every row.
Assign controller and processor roles from real responsibilities, not from contract clauses.
Set retention from purpose, obligation and evidence, not from storage capacity.
Keep direct marketing separate because PECR applies alongside data protection rules.
Stop collection or release when purpose, roles, transparency, transfers, rights, retention or security fail.

Split the purposes before drawing the flow

Create the record of processing activities that UK GDPR Article 30 requires — the purpose map — with a separate row for audience research, service delivery, analytics and direct marketing. For each row record the people affected, information fields, collection route, purpose, lawful basis, recipients, systems, retention, deletion, rights route and security owner. Do not reuse a research list for promotion merely because the addresses are available.

Attach the notice version, assessment, approval and query reference needed to reproduce each decision later.

One row filled in. Purpose: audience research interviews. People affected: participants who are individuals. Fields: name, contact details, recordings and notes. Collection route: recruitment and the interview itself. Lawful basis: legitimate interests, with the balancing assessment recorded. Recipients: a transcription supplier working under a processor contract. Systems: the research folder and the transcription platform. Retention: raw recordings deleted once the report is approved and the agreed retention period ends. Rights route: the address in the participant notice, with subject access requests answered within one month. Security owner: the research lead.

UK GDPR sets six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Name the one that applies in each row and record why it does, because a column left as a proposal gives the record nothing to stand on.

The ICO's data protection principles guide covers lawfulness, fairness and transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability. The page is marked under review after the Data (Use and Access) Act 2025. A named privacy professional should check the current law and guidance against the actual flow.

Assign roles from facts

Write who decides the purposes and essential means, who follows instructions, and where either party uses information for its own ends. The ICO's controllers and processors guidance says the distinction follows real responsibilities. An agency can have different roles for different processing operations.

Where a controller-processor relationship exists, the ICO's contract guidance identifies required terms and governance questions. It is also under review. The parties must document instructions, confidentiality, security, sub-processors, rights assistance, incidents, audits and end-of-contract return or deletion. A clause cannot alter the role created by the facts.

Test transparency, retention and rights

Privacy information must match what happens. The ICO's right to be informed guidance covers purposes, sharing, retention and timing. Map the notice version to the collection point and provide access, correction, erasure, objection and portability routes where they apply; UK GDPR requires a response to a subject access request within one month.

Set retention from purpose, obligation and evidence, not storage capacity. Keep raw research, participant contact details, approved assets, working files and marketing records on distinct schedules. Record legal holds and deletion evidence. The decision needs named owners rather than a vague promise to retain information only as long as necessary.

Where processing is likely to result in a high risk to people, UK GDPR requires a data protection impact assessment (DPIA) before it starts — large-scale profiling, systematic monitoring or sensitive information in audience research are common triggers for agencies. Record the DPIA with the purpose map so the risk assessment and the approval sit beside the row it covers.

Inspect transfers and security

Identify hosting, support access and sub-processors by legal entity and location. The ICO's international transfer guide sets out a three-step test for restricted transfers. For a restricted transfer the mechanism is an adequacy regulation, the UK International Data Transfer Agreement (IDTA) or the Addendum to the EU standard contractual clauses, supported by a transfer risk assessment.

The NCSC small organisations collection supplies practical UK security guidance, not certification. Evidence the real controls for accounts, devices, file exchange, backups, incident reporting and supplier exit.

Keep direct marketing apart

The ICO's direct marketing guidance addresses both data protection and PECR. PECR requires consent before electronic marketing to individual subscribers, allows a 'soft opt-in' where the address was collected in the course of a sale or negotiations and similar products are offered with an opt-out at collection and in every message, and applies different rules to corporate subscribers such as limited companies. An existing client relationship, a public business address or agreement to research does not settle permission for every call, email or message.

Record the channel, subscriber type, provenance, consent or other route, suppression check and objection handling. Sole traders and some partnerships count as individual subscribers even when they trade under a business name.

Stop collection or release when the purpose is unclear, roles conflict, transparency is inaccurate, a transfer is unresolved, rights cannot be served, retention lacks an owner or security evidence fails. Resume only after the named privacy, PECR, legal and security reviewers record a dated decision.

What the map shows a client or reviewer

Data protection questions surface as soon as a buyer works through a directory listing, a shortlist, a pitch or a review: who controls the information, why it is held, how long it is kept and who receives it. An agency that can produce the Article 30 record for research, delivery, analytics and marketing answers those questions from a dated record rather than from a policy statement. A review note that captures only creative work, team size and fee levels leaves the data question unasked.

Keeping the map current also makes client due diligence quicker, because the evidence is already written down, owned and reproducible.

What a directory listing and a review can check

Ask a shortlisted agency for one filled row of the Article 30 record per purpose, not a policy document. The row should name the purpose, the people affected, the fields, the lawful basis, the recipients, the systems, the retention period, the rights route and the security owner.

Then check the edges of the work:

Who is controller and who is processor for research, delivery, analytics and marketing, stated operation by operation.
The retention schedule for raw recordings, participant contacts, approved assets, working files and marketing lists.
The transfer mechanism for every host, support access or sub-processor outside the UK, with the transfer risk assessment.
The named security owner and the route for reporting an incident.
Whether ICO registration is current and the fee tier matches the agency's size.
Whether any list gathered for research is kept out of promotion.

Before you act

List each processing purpose and name the lawful basis for it.
Record people, fields, route, purpose and basis in the Article 30 record of processing activities.
Record recipients, systems, retention, deletion, rights and security owner.
Complete a DPIA before high-risk processing and keep it with the purpose map.
Register with the ICO through its registration service where the requirement applies.
Check PECR consent, the soft opt-in or the corporate-subscriber position for each marketing channel.
Confirm an adequacy regulation, the UK IDTA or the Addendum to the EU SCCs before a restricted transfer.
Attach notice version, assessment, approval and query reference.

Common questions

What should a branding agency record for each processing purpose?

For each purpose, record the people affected, information fields, collection route, purpose and lawful basis — one of consent, contract, legal obligation, vital interests, public task or legitimate interests. Also record recipients, systems, retention, deletion, rights route and security owner. Attach the notice version, assessment, approval and query reference needed to reproduce each decision later.

How are controller and processor roles decided?

By what each side actually does: whoever sets the aims and key methods is the controller, whoever acts on instruction is the processor. One agency may hold both roles across different tasks.

When should collection or release stop?

Pause if the aim is vague, duties clash, the notice is wrong, a transfer is unsettled, rights can't be met, no one owns retention or security proof is missing. Only restart once named reviewers record a dated decision.

What should a buyer look for in a directory listing or a review?

One filled row of the Article 30 record per purpose, not a policy document, showing the lawful basis, recipients, retention, rights route and security owner for research, delivery, analytics and marketing. Check the transfer mechanism for any supplier outside the UK and whether ICO registration is current.