How to assess a branding agency's data handling

What to take away

Where UK GDPR and PECR split the work in a branding agency

Two regimes govern most of what a branding agency does with audience data. UK GDPR covers personal data broadly: how you collect it, why you hold it, how long you keep it and what rights people have. Its Article 5 sets out principles including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. PECR sits alongside it and covers electronic marketing and cookies specifically.

The split matters because the rules are not interchangeable. A lawful basis under UK GDPR does not by itself permit a marketing email or a tracking cookie. PECR adds its own consent test for those channels, and the ICO enforces both.

Start with a purpose map, not a policy. A purpose map records why each dataset exists, where it came from and who owns it. Policies written before purposes are known tend to describe intentions rather than actual processing. The purpose map is the document auditors and clients ask for first.

Branding work also overlaps with other UK rules. The Advertising Standards Authority polices marketing claims, the CMA watches commercial practices, and Companies House records ownership. Knowing which UK rules apply stops an agency treating data protection as the only constraint.

Consent as a lawful basis for research panels and campaign lists

Consent is one of the lawful bases listed in UK GDPR Article 6: consent, contract, legal obligation, vital interests, public task, legitimate interests and, since 5 February 2026, recognised legitimate interest. It is the right basis when the individual genuinely chooses, and the wrong one when the processing would happen anyway, such as payroll or a contract deliverable. Article 7 sets conditions for consent, including how it is given and withdrawn.

For research panels, consent works well. A recruitment screener should state the topic, the format, the incentive and how long responses are kept. Panel members must be able to withdraw without losing the incentive already earned.

For campaign lists, consent is the standard basis for email and SMS marketing to individuals. UK GDPR Article 7 sets conditions for valid consent, while regulation 22 of PECR covers unsolicited direct marketing by electronic mail. The ICO's Direct marketing guidance sets out the test: freely given, specific, informed and unambiguous, with a clear affirmative action.

Pre-ticked boxes, silence and bundled terms fail that test. So does consent buried in a general privacy notice that covers every possible use. Keep the wording for a newsletter opt-in separate from the wording for research participation.

Record what was consented to, when, and through which touchpoint. A screenshot of the form, the version of the wording and a timestamp are enough. Without records, an agency cannot demonstrate consent if a complaint arrives.

B2B marketing to corporate subscribers sits under different PECR rules from marketing to individuals. A named business address is not automatically fair game, and sole traders and some partnerships count as individuals. Check the subscriber type before sending.

Cookies, pixels and analytics on agency and client sites under PECR

Regulation 6 of PECR governs cookies and similar technologies, including pixels, local storage and device fingerprinting. The ICO's Cookies and similar technologies guidance explains when consent is needed and what counts as an exception.

Strictly necessary cookies are exempt. These cover things like basket state, security tokens and load balancing. Analytics cookies are not strictly necessary, even when the data is aggregated, and they need consent before they fire.

The common failure is a banner that loads analytics on page view and asks afterwards. Consent must come before the cookie is set. A reject option must be as easy to find as the accept option.

Agency sites often run several trackers: a content management system, a heat-mapping tool, a chat widget and an advertising pixel. Each needs a place in the cookie audit, with its purpose, duration and lawful basis recorded.

Client sites create a second layer. If an agency installs tracking on a client's domain, the client is usually the controller and the agency acts on instruction. The consent banner wording, the tag configuration and the audit trail should all be agreed in writing.

Cookie consent also interacts with the disclosure policy an agency publishes. Readers should be able to see what is tracked, why, and how to withdraw without emailing a person.

Controller or processor: who answers when a client CRM is involved

The ICO's guidance on controllers and processors draws the line. A controller decides the purposes and means of processing. A processor acts on the controller's documented instructions.

A branding agency is often a processor when it runs a client's email campaign, hosts a research panel on the client's behalf, or manages a CRM segment. The client remains the controller and answers to the individual.

An agency is usually a controller for its own pitch list, its own supplier records, its own staff data and its own website analytics. That distinction changes who handles a request and who notifies a breach.

Mixed roles are common in one engagement. A retainer might involve processing client CRM data as a processor while also running the agency's own newsletter as a controller. Map each activity separately rather than labelling the whole relationship.

Article 28 terms belong in the contract. A processor must act only on instructions, keep data secure, help with individual rights, and delete or return data at the end. The contract clauses that cover this should be settled before work starts, not after a complaint.

Sub-processors need naming. If an agency uses a cloud research platform, a translation supplier or a freelance analyst, the client should know who touches the data and where it sits. International transfers need a lawful mechanism.

Subject access requests and individual rights in agency accounts

A subject access request is a request from an individual for a copy of their personal data. It can arrive by email, social media message or verbally, and it does not need to use those words. A request that asks what data is held counts.

The clock runs from the day the request is received, provided identity is clear or can be reasonably confirmed. The standard deadline is one month, extendable by two months for complex requests. Agencies should log the date, the requester and the search terms used.

Search widely. A name may appear in email threads, pitch decks, research transcripts, CRM notes, invoices and messaging apps. A single mailbox search is not enough, and deleting records after a request arrives is a serious matter.

Some data is exempt or can be withheld, such as information that would reveal another person's identity or legal advice privilege. Redaction should be explained, not silent. If the agency is a processor, it should pass the request to the client controller promptly.

Other rights run alongside access: rectification, erasure, restriction, objection and portability. Each has its own conditions. A marketing objection must be honoured, and the suppression list that follows is itself lawful processing.

A compliance map helps an agency show where each right is handled, who owns the task and how long it takes. The map also supports the Article 30 UK GDPR record of processing activities that controllers must maintain. Beyond the map, the Data Protection Act 2018 requires most controllers to pay an annual data protection fee set under the Data Protection (Charges and Information) Regulations 2018. The ICO register of fee payers is publicly searchable, so a branding agency reviewing a potential partner can check that firm's registration status before signing a contract.

Breach reporting inside 72 hours: the agency drill

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It covers a misdirected email, a stolen laptop and a ransomware event.

UK GDPR Article 33 requires the controller to notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. The ICO's online “Report a personal data breach” form is the reporting tool.

Seventy-two hours is three days, including weekends. If the full picture is not yet known, report what is known and update later. Late reporting without a good reason is itself a failing.

Processors do not report to the ICO. They notify the controller without undue delay, and the controller decides. An agency processing a client CRM should have the client's incident contact written into the contract.

High risk to individuals also triggers telling those individuals without undue delay. That decision sits with the controller, and the wording should be plain about what happened and what the person can do.

Keep an internal breach log even for incidents that are not reportable. The log shows pattern, response time and whether fixes worked. It is also the first thing an ICO case officer asks for.

The Data (Use and Access) Act 2025 and what changes for agencies

UK data protection law is amended by the Data (Use and Access) Act 2025. The ICO's page on the Data (Use and Access) Act 2025 sets out the regulator's position and the changes it is preparing for.

The Act makes concrete changes, including a statutory complaints-handling duty for controllers and amendments to provisions on automated decision-making, recognised legitimate interests and research. Its provisions do not all take effect at once, so check their commencement status before changing a live process.

The Act amends PECR to create limited exceptions for certain statistical and appearance-customisation technologies, subject to statutory conditions that must be met in full before the exception can be relied upon. Those conditions are set out in the Act and in ICO guidance; they do not extend to general analytics or advertising pixels. This does not make all analytics cookies exempt: check whether a specific exception applies before relying on it, and otherwise obtain consent before the technology runs.

Watch for changes to complaint handling, to the ICO's structure and to rules on automated decision-making and research purposes. Research processing has been a focus, and agencies running panels should track the detail.

Check commencement information and ICO updates before changing a process. Record which provisions apply to each account and assign someone to review the guidance when it changes.

Practical steps: a consent-to-cookies compliance sequence

If you are assessing a branding agency, use these questions to check whether its stated approach matches the work it will do. Ask for evidence against the following sequence for the account or site in scope.

Keep a short checklist for each new account so nothing is skipped under pitch pressure.

Review the sequence when a client changes platform or a campaign adds a new tracker. Most failures come from drift, not from a single bad decision.

Common questions

Do we need consent for B2B marketing emails?

It depends on the subscriber. Corporate subscribers fall under different PECR rules from individuals, and sole traders and some partnerships count as individuals. Check the subscriber type before sending.

Can we rely on legitimate interests instead of consent?

Sometimes, for processing that does not involve electronic marketing or non-essential cookies. Legitimate interests can support fraud prevention or some analytics, but PECR still requires consent for marketing emails to individuals and for tracking cookies.

Who reports a breach when we are the processor?

The controller reports to the ICO within 72 hours if the threshold is met. The processor must notify the controller without undue delay, so agree the contact and timescale in the contract.

How long do we have to answer a subject access request?

One month from receipt, extendable by two months for complex requests. Identity checks should be reasonable, and the search should cover email, CRM, research files and messaging tools.

Does the Data (Use and Access) Act 2025 remove cookie banners?

No. PECR cookie consent rules remain in force, and the ICO continues to enforce them. Track commencement dates and any new guidance rather than assuming the requirement has gone.

Do we pay the ICO data protection fee?

Whether you must pay depends on your organisation and any applicable exemption. Use the ICO's data protection fee self-assessment tool to check whether a fee is due and which current tier applies. Processors do not pay the fee solely because they process data for a controller.