Rules and ethics
Part of Influencer marketing rules and ethics: how to assign duties
Influencer agencies data protection: audience uploads, PECR and deletion evidence
A practical guide to influencer agencies data protection: audience uploads, PECR technologies, processor contracts and deletion evidence.
Influencer agencies data protection begins with a data map, not a standard processor clause. An advertiser, agency, talent manager, creator and platform may each make different decisions about creator details, audience lists, account identifiers, tracking and reports. Their roles must follow the facts.
What to take away
- A data map should record each processing purpose, party, data, source, recipient, retention and deletion proof.
- Audience uploads need separate analysis because advertiser possession of an email does not imply permission for matching.
- Pixels, scripts and fingerprinting can fall under PECR, so inventory each technology, purpose, vendor and lifespan.
- If an agency is a processor, document instructions, security, subprocessors, deletion and audit evidence.
- Stop before upload or tracking if purpose, role, PECR analysis, child treatment, security, retention or deletion evidence is unresolved.
Record each purpose and party
Create a row for every processing purpose: selecting creators, contracting and payment, campaign communication, audience matching, measurement, complaint handling and archive. Name the personal data, source, population, controller decision, processor instruction where relevant, recipient, transfer, retention, rights route and deletion proof. Article 30 of UK GDPR sets out what those records of processing must contain, and each purpose needs a lawful basis under Article 6.
An illustrative row for audience matching might look like this.
| Purpose | Data | Source | Recipient | Retention | Deletion proof |
|---|---|---|---|---|---|
| Audience matching for measurement | Hashed email addresses | Advertiser customer list | Social platform matched-audience tool | 30 days after campaign end, typical for this purpose | Platform API deletion log with timestamp and match count |
The ICO data-sharing code page distinguishes sharing between controllers from processing on behalf of a controller. Contract wording alone cannot convert independent purposes into instructed processing. A named UK privacy reviewer should decide roles and lawful basis for the actual activity.
The ICO's DUAA status update explains that the DUAA amended rather than replaced UK GDPR, the Data Protection Act 2018 and PECR. The Act reached Royal Assent as the Data (Use and Access) Act 2025 on 19 June 2025. Check any linked guidance for an under-review notice.
Treat audience uploads as a separate disclosure
For a customer list or matched-audience file, record how the advertiser obtained it, the information given to people, the proposed match purpose, identifiers transformed and sent, platform role, suppression, objections and deletion. ICO guidance on sharing personal data in lists says a recipient should check integrity and what people were told when data came from elsewhere.
For example, an advertiser uploads a hashed customer list for a matched audience. The privacy notice said data may be used for marketing and measurement, and people could object. Before upload, the advertiser removes anyone who objected and keeps a suppression list. After the campaign, the advertiser asks the platform to confirm deletion and files the proof — a deletion certificate, a deletion request ID or the platform's audit report — with the data map.
Do not infer permission from the fact that the advertiser already holds an email address. Research participation, creator contracting, audience matching and later electronic marketing are separate purposes.
Analyse device access under PECR
Pixels, scripts, tags, link decoration and device fingerprinting can fall within storage and access technology. Regulation 6 of PECR requires clear and comprehensive information and consent before storing or accessing information on a user's device, unless the storage or access is strictly necessary to provide a service the user requested. The ICO's guidance on the use of storage and access technologies states that PECR can apply in first-party and third-party contexts, with UK GDPR applying where personal data is involved.
Inventory each technology, such as a marketing pixel or a device fingerprint, with its purpose, exemption or consent analysis, vendor, typical lifespan and change trigger. A pixel often lives for 30 to 90 days; a fingerprint can last 180 days or more depending on refresh.
A consent-mode status or platform toggle does not establish that the organisation's wider data use has a valid basis.
Contract, secure and delete
If an agency is truly a processor for a purpose, Article 28 of UK GDPR requires documented instructions, confidentiality, security, authorised subprocessors, assistance with rights and breach duties, return or deletion and audit evidence. Where a processor or platform is outside the UK, name the transfer mechanism: an International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or adequacy regulations made under Article 45. The ICO's guidance on contracts and liabilities between controllers and processors was marked under review when checked, so use it with current legislation and qualified advice.
Article 17 of UK GDPR gives people a right to erasure, and an objection to marketing under Article 21 should stop the processing it covers. Keep proof of what was deleted, when and by whom: a deletion certificate, a platform audit report or a deletion request ID that ties the confirmation to a ticket is stronger evidence than a screenshot of a settings page.
Limit account access by individual role and test revocation and recovery. NCSC social-media security guidance supports deliberate control where several people can publish. Preserve access logs without retaining campaign data indefinitely.
If children are present or likely to access an online service, add child-specific analysis. The ICO's Age Appropriate Design Code sets the standards for services likely to be accessed by children, and the ICO's children and UK GDPR guidance was updated for the DUAA in May 2026. Neither is a substitute for safeguarding review.
This guide does not select a lawful basis or promise compliance.
Before you act
- Create a row for every processing purpose and party.
- Record how audience data was obtained and what people were told.
- Inventory each storage and access technology with its purpose and lifespan.
- Document processor instructions, security, subprocessors and deletion evidence.
- Name the transfer mechanism for any recipient outside the UK.
- Limit account access by individual role and test revocation.
Common questions
Why can contract wording alone not determine controller and processor roles?
The ICO data-sharing code distinguishes sharing between controllers from processing on behalf of a controller. Contract wording alone cannot convert independent purposes into instructed processing.
What should be recorded for a customer list or matched-audience file?
Record how the advertiser obtained it, the information given to people, the proposed match purpose, identifiers transformed and sent, platform role, suppression, objections and deletion. ICO guidance says a recipient should check integrity and what people were told when data came from elsewhere.
When can PECR apply to pixels, scripts and device fingerprinting?
The ICO's guidance on the use of storage and access technologies states that PECR can apply in first-party and third-party contexts, with UK GDPR applying where personal data is involved. Regulation 6 is the provision that applies, so inventory each technology, purpose, exemption or consent analysis, vendor, lifespan and change trigger.
