Rules and ethics
Part of Four overlapping UK regimes govern digital PR rules and ethics
Digital PR UK regulations on data and sources explained
Digital PR UK regulations explained for outreach teams: ICO electronic mail rules, CAP advertising standards, CIM ethics and how to source data properly.
What to take away
Digital PR UK regulations are the rules covering how PR teams collect contact data, send outreach email, and label the coverage they place.
- Personal data duties sit with the ICO under the Data Protection Act 2018 and the UK GDPR, read with the Privacy and Electronic Communications Regulations 2003 (PECR): consent, the soft opt-in and a recorded lawful basis for every contact.
- Advertising duties sit with the ASA, whose CAP Code covers paid placements, sponsored content and many social posts.
- The CIM Code of Professional Conduct gives members a written ethics standard that non-members can borrow.
- These regimes apply across the UK, including England, and no separate English statute governs outreach email.
Where the rules actually bite
Most of the regulatory weight lands in two places: the personal data inside your media list, and the way a paid placement is presented to readers. PECR and UK GDPR cover the first. The CAP Code covers the second.
Two statutes carry most of this. The Data Protection Act 2018 sets the UK's data protection framework and the ICO's powers; the Privacy and Electronic Communications Regulations 2003 (PECR) sit alongside it and govern electronic marketing, including email. Both apply UK-wide, so England, Scotland, Wales and Northern Ireland follow the same rules.
The UK GDPR sets six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. Outreach usually rests on consent or legitimate interests, and the basis has to be recorded before the first send.
Most organisations that process personal data must also pay the ICO's annual data protection fee and appear on the public register of fee payers, unless a limited exemption applies.
None of the three is devolved, and England follows the same data and advertising rules as Scotland or Wales. This is general guidance; a live complaint needs a qualified adviser.
Complaints rarely arrive as a regulatory question. They arrive as a forwarded email asking where a contact came from. Teams that can show a source, a date and a lawful basis answer it in minutes, which is why record-keeping is the first control in any digital PR compliance guide.
Advertising rules catch teams that assume earned coverage is out of scope. The ASA's advice for businesses sets out the CAP Code duties — rule 2.1 on making marketing communications identifiable, and rules 3.1 and 3.7 on misleading claims and the evidence behind them. Those duties follow any content a reader could mistake for editorial.
The ASA publishes its rulings, can require an ad to be changed or withdrawn, and refers persistent offenders to Trading Standards.
The regimes compared
Three regimes do most of the work in a UK campaign. Each has its own overseer and its own implied step for a delivery team, set out below.
| Regime | Overseer | What it requires | The step it implies |
|---|---|---|---|
| PECR (Privacy and Electronic Communications Regulations 2003) | ICO | Consent before unsolicited marketing email to an individual subscriber, or the soft opt-in; corporate subscribers fall outside that consent rule | Record the basis for every contact and keep one suppression list |
| CAP Code | ASA | Marketing communications must be identifiable and must not mislead, with evidence held for claims | Label paid placements and advertorials, and hold proof for every claim |
| CIM Code of Professional Conduct | CIM | Members must act with integrity and avoid misleading claims | Adopt it as the agency's own sourcing and disclosure standard |
UK digital PR regimes compared
PECR and UK GDPR
- Overseen by
- ICO
- Covers
- Electronic mail and personal data
- Practical step
- Record lawful basis
CAP Code
- Overseen by
- ASA
- Covers
- Ads and paid placements
- Practical step
- Label paid content
CIM Code
- Overseen by
- CIM
- Covers
- Member conduct and honesty
- Practical step
- Use as ethics checklist
Data sourcing and the evidence trail
Every name on a media list is personal data, even when the address is published on a newsroom page. Using it to pitch a story is direct marketing, so the team needs a lawful basis recorded before the first send.
Evidence trail for every contact
- Where the contact came from
- When it was collected
- What was sent
- When someone asked to stop
The trail is short: where the contact came from, when it was collected, what was sent, and when someone asked to stop. A team that cannot produce those four answers has nothing to show a regulator.
Professional codes add a layer that no regulator enforces. The CIM Code of Professional Conduct requires members to act with integrity and to avoid misleading claims. That is a workable benchmark for an agency writing its own sourcing rules.
Publishing those rules matters more than drafting them. A disclosure policy covering data and sources tells an account manager which labels to apply, which sources need a second check, and who signs off.
Official sources:
- ICO guidance on marketing and data protection rules
- Who regulates hidden advertising in UK social media
Source rules: copyright, database rights and defamation
Data protection is only half of the sourcing question. Copyright in text, images and video is set by the Copyright, Designs and Patents Act 1988, and database right under the Copyright and Rights in Databases Regulations 1997 protects a substantial investment in compiling data. Both matter when a campaign reuses a survey, a chart or a scraped directory, and fair dealing for criticism or review is a narrow exception rather than a licence to reproduce.
Defamation is the other exposure. The Defamation Act 2013 requires a statement to cause serious harm before it is actionable, and it provides defences of truth, honest opinion and publication on a matter of public interest. For press standards, the IPSO Editors' Code of Practice covers accuracy, privacy and the protection of sources for the publications that sign up to it. Keep a note of where every figure and quote came from, and of any permission you were given.
Outreach email: consent and the soft opt-in
The ICO's guidance on direct marketing using electronic mail explains who the soft opt-in covers. It applies to people who have already bought from you or asked about a similar product, and only for similar marketing.
The email rules themselves sit largely in regulation 22 of PECR, which requires consent before unsolicited marketing email goes to an individual subscriber. A limited company or an LLP is a corporate subscriber, so its business address falls outside that consent rule, but the personal data of the person behind the address does not.
That leaves two routes for cold outreach: consent, or the corporate subscriber exemption in PECR. A named person at a limited company is still a person, so UK GDPR duties on accuracy and opt-outs continue to apply. Keep one suppression list, and make every pitch say who you are and how to opt out.
Common questions
Do we need consent to email a journalist?
Not always, but you always need a recorded lawful basis and a working opt-out. Check what kind of subscriber sits behind each address before you build the send.
Does the CAP Code cover link building?
It covers ads and marketing communications, so paid placements and advertorials are in scope even when they read like news. Unpaid editorial is not an ad, but a client's claims about results can be.
Can we buy a media contact list?
Only with a lawful basis you can evidence and a consent record most brokers cannot supply. Treat a purchased list as the weakest link in the campaign and test it before scaling.
