UK digital PR data protection checks before pitching on sources, lists and AI

What to take away

Regulator guidance now reaches AI-assisted research, list building and first-draft copy, so data protection sits inside the creative process rather than the CRM.
PECR governs electronic-mail direct marketing, so check its rules before pitching.
Director duties under company law bind the people who own the agency, not the account team, so governance is an ownership question.
A short before-and-after check on sources, consent and retention heads off most complaints.

Where data protection enters a digital PR campaign

Digital PR runs on other people's data. Journalist contact lists, survey panels, expert quotes and scraped social posts all contain personal data. The UK regime includes the UK GDPR, the Data Protection Act 2018 and PECR (the Privacy and Electronic Communications (EC Directive) Regulations 2003); our compliance guide for 2027 sets out wider context. Every list you build needs a lawful basis before the first email leaves.

Lawful basis for outreach data

Is the data special category?

Yes

Written client instruction before fieldwork

Documented legitimate interests balancing test

The UK GDPR applies to outreach as much as to a newsletter. A named contact at a business is still personal data when the person can be identified. Legitimate interests can support a targeted pitch, but only with a documented balancing test. A purchased list rarely survives that test.

PECR governs unsolicited marketing by electronic mail. If a pitch is direct marketing, the rules differ by subscriber type: prior consent is generally required for individual subscribers, including sole traders and certain partnerships, unless an exception such as the soft opt-in applies. Corporate subscribers can generally be emailed without prior consent if the sender is identified and a working opt-out is provided. A journalist pitch is not automatically direct marketing just because it is sent by email, so assess its purpose and content; where personal data is used, UK GDPR still applies.

Check whether the agency must pay the ICO data protection fee using the ICO's fee self-assessment, then check the register of fee payers. Controllers must pay unless an exemption applies.

Special category data needs more care. A survey that asks about health, ethnicity, religion or political views cannot rely on legitimate interests alone. If a campaign does not need that detail, do not collect it. If it does, the client's instructions should say so in writing before fieldwork opens.

Data protection law is UK-wide, so the position is the same in England, Scotland, Wales and Northern Ireland.

Scraped data carries a second problem. If a platform's terms prohibit extraction, the breach is contractual as well as regulatory. An agency that passes scraped contacts to a client shares the exposure.

What the ICO expects from AI-assisted outreach

The ICO's Guidance on AI and data protection and its AI and data protection risk toolkit are relevant when a tool processes personal data. Drafting a pitch with a language model counts if personal data is included. So does using one to deduplicate or rank a contact list.

Before uploading personal data to an AI provider, check where it is stored and accessed and whether a restricted transfer outside the UK occurs. If it does, confirm that UK adequacy regulations cover the destination or use an appropriate safeguard, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Carry out a transfer risk assessment where required.

AI outreach compliance checks

Lawful basis identified for the tool
Clear notice given to contacts
Explain how output was reached
Records of processing kept
DPIA done before processing begins

Two questions cover most of the practical ground.

Is there a lawful basis and a clear notice?

You still need a lawful basis, and the people on the list need to know what happens to their details. An AI tool does not create either one. If the output is a first draft rather than a decision, the risk is lower.

Can you explain how the output was reached?

If a tool decides who receives a pitch, you should be able to describe the logic in plain terms. Records of processing and a short note on the model's role make that answer easy to give.

UK GDPR Article 22 applies only to a decision based solely on automated processing that has legal or similarly significant effects on a person; a tool ranking journalists is not automatically within that rule. Where Article 22 applies, safeguards include the person's right to human intervention, to express their point of view and to contest the decision.

A data protection impact assessment is expected where processing is likely to be high risk, and scoring a bought list can qualify. Use the ICO's guidance on data protection impact assessments and its DPIA template to assess the risks and record how you will address them. Complete the assessment before processing begins.

A before and after check for sources and lists

The table below sets out the checks to run at two points in a campaign.

Confirm whether outreach is direct marketing and apply the relevant PECR rules for the subscriber type.
For each source and list, record its origin, collection date, purpose, UK GDPR lawful basis, privacy information and objection or suppression status. Keep the applicable UK GDPR Article 30 record of processing activities where required.
For special category data, identify the UK GDPR Article 6 lawful basis and Article 9 condition, and any corresponding Data Protection Act 2018 condition where required. Do not collect details the campaign does not need.
Check whether the agency needs to pay the ICO data protection fee and whether the register of fee payers records it.
Before AI-assisted ranking or scoring, assess whether a DPIA is needed, whether Article 22 applies, and whether international-transfer safeguards are required.
Set and document retention periods by data type and purpose, with a review and deletion point. UK GDPR does not set one universal retention period for all media contacts.

Before and after check

Before outreach

Source of data: Record where each contact came from
Lawful basis: Document interests and the balancing test
Claims and figures: Check the survey wording and sample
Retention: Set a deletion date for the list

After coverage

Source of data: Keep the record with the campaign file
Lawful basis: Note any objections and act on them
Claims and figures: Keep the raw data behind each stat
Retention: Delete on that date, not later

Two habits hold the process together. Log objections where the whole team can see them, and keep the raw survey file beside the published figure. A claim that cannot be traced to a record is a claim you cannot defend.

Who owns the data-protection checks inside an agency

Company directors carry statutory duties. GOV.UK's guidance on being a company director sets out responsibilities that include promoting the company's success and exercising reasonable care and skill. These governance duties do not replace the agency's separate UK GDPR duties as controller or processor. Identify and document the roles the agency and client have for each processing activity.

A written digital PR disclosure policy for data and sources turns the agency's data-protection responsibilities into something an account team can follow on a Tuesday afternoon. It gives the client a written process to agree before work begins.

A subject access request is a UK GDPR right: route it to the person responsible, locate relevant campaign records and follow ICO guidance on responding. A complaint or difficult request may need qualified advice; this article is not a substitute for advice on a specific case.

Common questions

What counts as personal data in a media list?

Anything that identifies a person, including a work email, a job title tied to a name, or a social profile. Business-to-business outreach is not exempt.

Do I need consent to pitch a journalist?

Not always. Consent is one lawful basis among several, and legitimate interests often fits a relevant, targeted pitch. Write down the reasoning before you send.

How long can we keep an outreach list?

Only as long as the purpose requires. Set a review date when the campaign starts and delete what you no longer need. A stale list is a liability with no upside.

Who is liable if a campaign misuses data?

The agency that processed the data carries the main duty, and the client can be liable too. Agree the split in writing before work begins.