What should a digital PR disclosure policy cover for data and sources?

What to take away

Why data sourcing belongs in the policy

A disclosure policy tells a client, a publisher and a regulator where your numbers came from. It is not a privacy notice. It is the audit trail for every claim you pitch.

Without one, a survey figure can travel from a press release into national coverage with no note of sample size or fieldwork dates. The agency carries the reputational risk.

Map each source to one of four types: first-party client data, commissioned research, licensed third-party data, public sector statistics. Each needs its own permission and citation line.

Our guide to digital PR advertising rules for data and sources explains how those citation lines interact with the CAP Code, so read it before you draft the source schedule.

ICO rules for outreach data

Outreach lists hold personal data, even when built from public bylines and press office contacts. Under the UK GDPR and the Privacy and Electronic Communications Regulations you need a lawful basis for processing and a clear route to object.

The ICO's step-by-step guide to direct marketing for your small business covers consent, legitimate interests and record keeping. Read it before you build a journalist list.

The ICO regulates data protection across the United Kingdom, so this test applies in Scotland, Wales and Northern Ireland too.

ASA and CAP expectations

Advertising claims across the UK are governed by the CAP Code, administered by the Advertising Standards Authority. The ASA's history of advertising self-regulation explains how that system developed and why it still shapes press office sign-off.

In a disclosure policy, a headline statistic in a pitch is an advertising claim. It must be substantiated, and the substantiation available on request.

Keep a source file per claim: raw data, methodology note, the person who verified it, and the date. If a publisher asks for proof, the policy should name who sends it.

Campaigns touching financial promotions or health claims attract separate rules, so take advice from a qualified adviser.

Crawling and robots directives

Link-building campaigns interact with crawling rules, and the policy should say how. Google's documentation on how Google interprets the robots.txt specification sets out the directives that control crawling, including user-agent matching and path rules.

Staff sometimes add disallow rules to staging sites and forget them at launch. Require a pre-launch crawl check and named sign-off.

State that the agency will not ask publishers to hide paid links from crawlers. Sponsored placements need the correct link attribute, agreed in writing before the placement goes live.

Decision table

Common questions

Does a policy need legal review?

It should be reviewed by someone with data protection knowledge, and by a qualified adviser for regulated sectors such as finance or health. This article is general guidance only.

How long should source records be kept?

Keep them for at least as long as the campaign runs plus the period your client contract specifies. If a claim is challenged, the source file is your evidence.

Does the policy differ across the UK?

Data protection and advertising self-regulation apply UK-wide. Some sector rules are devolved, so check the position in Scotland, Wales or Northern Ireland first.

What is the first section to write?

Start with the source schedule: every dataset, its owner, its licence and its review date. The wider digital PR UK rules and compliance guide covers how the regimes fit together.