Does your digital PR quality checklist cover data and sources?

What to take away

Our data protection guide covers the regulatory context; vet sources before pitching, not after.
Every dataset needs a named owner, a collection date and a licence you can quote back to a journalist.
Unsourced statistics are the most common reason a campaign stalls at the fact-check stage.
A source you cannot trace back to a named collector is a liability, however compelling the number looks.
A cyber incident is not automatically a personal data breach. Under the UK GDPR and the Data Protection Act 2018, notify the ICO of a personal data breach unless it is unlikely to result in a risk to people's rights and freedoms, without undue delay and, where feasible, within 72 hours of becoming aware of it (UK GDPR Article 33). The linked NCSC cyber security guidance for schools is a security resource, not the ICO notification route. If the breach is likely to result in a high risk to individuals, those individuals must also be told without undue delay (ICO guidance on personal data breaches). For lawful basis and list-building detail, see UK GDPR and ICO rules for outreach lists.

Key findings

UK GDPR Article 33 requires a personal data breach to be notified without undue delay and, where feasible, not later than 72 hours after becoming aware of it.
Notification is the default. The exception is a breach that is unlikely to result in a risk to people's rights and freedoms.
Under the Open Government Licence v3.0, reused information must carry the provider's attribution statement, and the licence does not cover personal data in the information.

Provenance before outreach

Start by asking who collected the data and when. A figure with no collection date is not a source, it is a rumour. Write the owner's name and the date into the campaign brief.

Data chain of custody

Who collected the data
When it was collected
Who cleaned it
Who approved release
Date the brief

Record the chain of custody. Name who collected the data, who cleaned it, and who approved it for release. Date the brief itself, so you can tell which version a colleague is quoting.

Data and source checklist

Record the publisher or author, exact dataset or report title, direct URL, publication or release date, date accessed, version, named owner or collector, and collection date.
Trace each claim back to its original source. Check that the source supports the precise wording, population, measure, units and timeframe used in the campaign.
For survey data, record the target population, sample size, recruitment and sampling method, fieldwork window and any weighting. For example, if the brief uses the sample of 200 discussed below, state its design and population rather than implying that the sample represents the general public.
Include a confidence interval and margin of error only when they have been calculated for the survey's actual design. Record the assumptions and do not substitute a generic figure.
Reproduce calculations from the source data and have a second reviewer check the figures and claims before sign-off.
Record the dataset's licence, permitted uses and attribution requirements. If it contains personal data, check the applicable data-protection requirements before use.

Where the data comes from a survey, check the fieldwork window. Seasonal fieldwork can skew results, particularly for anything tied to spending or travel.

Sample size and method

A sample of 200 tells you something about a niche audience and very little about the general public. State the target population, sampling and recruitment method, weighting and fieldwork window; report a confidence interval and margin of error calculated for that survey design, not an assumed generic figure. A sample of 200 on its own does not establish representativeness or a valid margin of error.

Sample size and method checks

State confidence interval in brief
Check sample weighting
Report margin of error
Consider hybrid panel plus behavioural data

Ask whether the sample was weighted to reflect the population you are describing. Report the margin of error alongside any percentage you publish. Journalists increasingly ask for it.

Licences and permissions

Check the licence before you build the story around the data; the hidden costs of data and licensing are worth knowing before you commit. For UK public data, the Office for National Statistics (ONS) and data.gov.uk are useful starting points, but check the licence attached to the particular dataset. Some public data is released under the Open Government Licence; commercial panel data and academic datasets may carry different terms. Under the Open Government Licence v3.0 you must acknowledge the source by including or linking to the attribution statement the information provider specifies. If the provider gives none, use "Contains public sector information licensed under the Open Government Licence v3.0." The licence does not cover personal data in the information.

Check whether the licence allows commercial use. A dataset free for academic research may not be free for client work. Keep a copy of the licence alongside the dataset, so you have evidence of the terms you agreed to.

Record the licence name, the permitted uses and any attribution requirement in one place. If a journalist asks for the terms, you should be able to send them within the hour.

If you are unsure how licensing sits alongside the rest of delivery, the digital PR operations and delivery guide sets out where legal review belongs in the workflow.

Official rules to cite

Four official rules sit behind the breach and licence checks above. Notify the ICO within 72 hours of becoming aware, where feasible. Notify unless the breach is unlikely to result in a risk. Inform individuals without undue delay when the risk is high. When the provider gives no attribution statement, use the Open Government Licence default.

Rule	Wording to quote	Source
Time limit for notifying the ICO	"without undue delay and, where feasible, not later than 72 hours after having become aware of it"	UK GDPR Article 33
When the ICO must be told	"unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons"	UK GDPR Article 33
Telling affected individuals	"If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, you must also inform those individuals without undue delay."	ICO, Personal data breaches: a guide
Attribution when the provider gives no statement	"Contains public sector information licensed under the Open Government Licence v3.0."	The National Archives, Open Government Licence v3.0

The four official rules the checklist depends on, quoted rather than paraphrased. Wording as read on 29 October 2026; check the current text before relying on it.

Measurement setup

Set up tracking before launch, not after. Confirm that your analytics property records the campaign URL, the referring source and any outbound clicks.

Define the campaign URL convention before launch. Inconsistent tagging turns reporting into a manual cleanup job. Set a baseline before outreach so you can show change rather than a single end figure.

Decide in advance which metric proves the campaign worked. Referral sessions, coverage count and link equity each tell a different story, and the client will ask for one of them.

Review and sign-off

Run a second pair of eyes over every number before it leaves the building. The reviewer should check the source, the maths and the wording of any claim.

Use a sign-off line in the brief that names the reviewer and the date. That makes the approval trail visible if a client asks who checked a number. Keep the signed-off brief with the final assets.

A launch review process that catches errors early is cheaper than a correction. Our launch review notes on data and sources explain what the reviewer should be looking for.

Decision table

Choose

Proprietary survey data: Full method note in the brief
Third-party panel data: Licence check and attribution line
Open government statistics: Named dataset and release date
Client-supplied figures: Written confirmation of source

Avoid

Proprietary survey data: Quoting a percentage with no sample size
Third-party panel data: Assuming reuse rights transfer with purchase
Open government statistics: Republishing without checking revisions
Client-supplied figures: Treating internal estimates as public data

Common questions

Who owns the data in a digital PR campaign?

Ownership depends on the licence and the contract. For commissioned surveys, the agency usually owns the raw responses while the client holds usage rights. Record this in writing before fieldwork.

How often should sources be rechecked?

Recheck any figure before each new pitch round. Datasets get revised, and a number quoted in January may not match the publisher's own updated release by the summer.

What if a source turns out to be wrong mid-campaign?

Stop outreach, correct the record with anyone who has already published and issue a revised brief. A prompt correction protects the relationship better than silence.

Does a checklist slow delivery down?

It adds an hour or two at the start and saves days later. Most delays in digital PR come from fact-check failures, not from planning.

Methodology

The rule wording comes from legislation.gov.uk (UK GDPR Article 33), the ICO guidance on personal data breaches and The National Archives' Open Government Licence v3.0, read on 29 October 2026, with each quotation checked against the page text. The Article 33 wording was also confirmed on the current legislation.gov.uk page and matches the version dated 25 January 2023. The Open Government Licence page prints no date, and the ICO page’s latest-updates note (20 August 2025) concerns PECR, not this rule. Laws and guidance change, so check the current text before relying on any of them. The 200-person sample in the article is illustrative and is not survey data. This is general information; a specific incident needs legal advice.

Cite this

Link Earned (2026). "Does your digital PR quality checklist cover data and sources?" Updated 29 October 2026. https://linkearned.co.uk/digital-pr-quality-checklist-data-and-sources