Four overlapping UK regimes govern digital PR rules and ethics

What to take away

Which UK laws apply to a digital PR campaign?

Digital PR sits at the junction of data protection, advertising regulation and consumer protection. No single statute covers the whole discipline. Which rule bites depends on the stage of the campaign.

UK GDPR applies whenever you process personal data. That includes a media list of journalists' work emails, a survey collecting responses, or retargeting people who engaged with coverage. The ICO's guide to data protection for organisations sets out the lawful bases and accountability duties you will rely on.

The CAP Code is written by the Committee of Advertising Practice and enforced by the Advertising Standards Authority. It covers advertising content wherever it appears, including sponsored articles, influencer posts and paid social placements.

The Digital Markets, Competition and Consumers Act 2024 adds a further layer. It gives the Competition and Markets Authority powers over fake reviews, drip pricing and dark patterns. Read the Digital Markets, Competition and Consumers Act 2024 directly if a campaign includes review content or a consumer-facing claim.

Data protection and advertising codes apply across the United Kingdom. England, Scotland, Wales and Northern Ireland share that core framework. Enforcement priorities and court procedure can differ, and some subject matter, such as health or education claims, touches devolved policy.

The regimes interact. A paid placement that uses a journalist's contact details touches data protection, advertising rules and the contract between agency, client and publisher. One campaign can generate three separate compliance questions.

The practical point is sequencing. Check data law before you build a list, check advertising law before you write copy, and check consumer law before you publish any claim about price or quality.

How do you keep campaign data lawful?

Start with a record of what personal data you hold and why. A media database of journalist contacts is personal data. So is a list of prize winners, survey respondents or event attendees.

Identify your lawful basis before you collect. Consent is common for marketing lists. Legitimate interests can cover journalistic outreach where the processing is proportionate and the recipient would expect it. Document that reasoning at the time, not after a complaint arrives.

Apply data minimisation. If you need a work email to pitch a story, do not also collect a home address or date of birth. If you run a survey, collect only the demographic fields you will actually report.

Special category data needs more care. Health, ethnicity and political opinions are examples. Survey work touching those areas needs an additional condition for processing, and often a data protection impact assessment.

If you buy data from a third party, check their lawful basis and their source. Purchasing a list does not transfer responsibility for how it was compiled.

Set retention periods. A media list refreshed every twelve months is easier to defend than one that has grown unchecked since 2019. Delete or anonymise data that no longer serves the stated purpose.

Honour individual rights. A journalist who asks to be removed should come off the list promptly. A respondent who asks for a copy of their data should receive it within one month. Build the process before you need it.

For a deeper look at how sourcing interacts with regulation, see Digital PR UK regulations: data and sources.

How do you handle disclosure and sponsorship?

The test is whether a reasonable reader would understand that content is paid for or commercially influenced. If not, the disclosure is inadequate.

Label sponsored content clearly. A small tag at the foot of a page is not enough when the headline and opening paragraphs read as independent editorial. Put the label where the reader sees it before they engage.

The IAB UK publishes creative principles for native distribution covering labelling, separation from editorial and transparency of the commercial relationship. Its native distribution principles for creative best practice are a useful benchmark when a publisher resists your requested label.

Influencer and creator partnerships need the same treatment. A paid partnership must be identifiable, using a platform tool or a clear written disclosure. The CAP Code treats hidden advertising as misleading.

Affiliate links and prize draws carry their own labelling expectations. A reader should be able to tell that a link earns commission, or that a competition is promotional.

If a client asks for content that looks editorial but is paid, put the disclosure requirement in writing before work starts. A clause making the client responsible for approving the label does not remove your own regulatory exposure.

For contract terms that cover these scenarios, see Digital PR commercial contracts in England.

What does the CAP Code require for advertorials and reviews?

Advertorials must be obviously identifiable as advertising. The ASA has ruled against content that blurs the line between editorial and promotion, even where a label sits somewhere on the page.

Reviews and testimonials must be genuine and substantiated. If you cite a customer review, be able to show where it came from and that it reflects a real experience. The 2024 Act strengthens the CMA's ability to act on fake or misleading reviews.

Comparative claims need evidence. Calling a product "the best" or "number one" invites scrutiny unless you can point to a dated, independent source. Keep the underlying data on file.

If the ASA rules against you, you can ask for an independent review of the decision. The independent review process for ASA decisions explains the grounds and procedure, which matters when a client wants to challenge an adverse ruling.

How do you handle complaints and regulatory appeals?

A complaint can come from a member of the public, a competitor or a regulator. The first response should be factual and prompt. Do not delete content while a complaint is open unless legal advice says otherwise, because removal can look like an admission.

For ASA complaints, the standard process is a written response with evidence. If the ruling goes against you, the independent review route is available on limited grounds. Budget several weeks for it.

For ICO complaints, you may need to demonstrate your lawful basis and your retention policy. A dated record of your data mapping is the strongest defence.

For CMA enquiries under the 2024 Act, take legal advice early. The CMA's powers include direct enforcement for certain consumer protection breaches without going to court.

Keep a complaints log with dates, the issue raised and the action taken. Patterns in that log are the cheapest early warning system you will get.

This guide is general guidance only and does not replace legal advice on your specific facts.

For a detailed look at advertising rules and the evidence to retain, see Digital PR advertising rules: data and sources.

What should a compliance scoring rubric look like?

Use a scored checklist before any campaign goes live. Score each row from 1 (not addressed) to 5 (fully documented and approved). A total below 20 should trigger a review.

Run the rubric at kick-off and again before publication. If a score changes, record why. That gives you a defensible trail if a regulator asks questions later.

Seven rows at a maximum of five points each gives a top score of 35. The threshold is a judgement call, so agree it with your client rather than applying it silently.

For a worked example of how compliance affects pricing and scope, see Digital PR: costs and budget guide for England.

How do you write a disclosure policy?

A disclosure policy should state who approves labels, where they appear, and what happens if a publisher refuses. Keep it to two pages so people actually use it.

Name the person responsible for final sign-off, usually a senior account lead or a compliance officer. Say who covers when that person is away.

Set out the minimum label wording. "Advertisement", "Paid promotion" and "Sponsored by [brand]" all work where they are clear. Avoid vague terms such as "in association with" unless the commercial relationship is explained alongside.

Include a clause on third-party platforms. A disclosure that works on a publisher site may not be visible in an app or an aggregated feed. Check how the label renders in each placement.

Review the policy annually and after any complaint. Record the date of each review so you can show the policy is live rather than decorative.

For a template structure and worked examples, see Digital PR disclosure policy: data and sources.

How do you brief clients on their own obligations?

Clients often assume the agency carries all the regulatory risk. That is rarely true. The client usually owns the product claim, the customer data and the brand reputation.

Point clients to the government's guidance for businesses as a starting point for their wider regulatory duties. It is a general hub rather than digital PR specific, but it helps them see compliance as a shared responsibility.

Warn them about timelines. A disclosure review can add two or three working days to a launch. If that time is not in the plan, someone will cut the wrong corner.

Common questions

Do I need consent to email journalists about a story?

Not always. Legitimate interests can cover journalistic outreach where the message is relevant to the recipient's work and you offer an easy opt-out. Document your reasoning, keep the list current, and take advice if the facts are unusual.

Does the CAP Code apply to organic social posts?

The CAP Code applies to advertising, not to all organic content. If a post is paid for or controlled by a brand as part of a promotional arrangement, it is likely in scope. An editorial mention with no commercial influence usually is not.

What happens if a publisher removes my disclosure label?

Raise it with the publisher in writing and keep a record. If they refuse to restore it, decide whether the placement should continue. Your contract should say who bears the risk.

Can I use third-party survey data in a campaign?

Only if you have the right to republish it and the sample supports the claim. Check the licence terms and the methodology. If the sample is small or skewed, say so, or drop the figure.