How UK GDPR and ICO rules shape digital PR data sourcing

What to take away

How UK GDPR principles apply when you build a digital PR data sourcing plan

The UK GDPR principles are the spine of any outreach list. Personal data must be processed lawfully, fairly and transparently, and held only for specified purposes.

That matters for digital PR because a journalist contact list is personal data. A named reporter's work email, direct line and beat notes identify a living person, so the rules bite as soon as you store them.

Start with purpose limitation. Write down why you hold each record: pitching a story, inviting comment, or sending a report. If the reason changes, the lawful basis may change with it.

Data minimisation is the discipline most agencies fail. You rarely need a mobile number, home address or personal social account to pitch a business story. Collect the work email, the outlet and the beat.

Accuracy has a practical edge in media relations. Journalists move outlets often, so a stale list produces bounces and complaints. Set a review cycle, commonly six or twelve months, and delete records that no longer serve the purpose.

The ICO's guidance for organisations sets out these duties for any business handling personal data, including agencies running campaigns on a client's behalf.

For organisations | ICO is the reference point for those duties, from the principles through to individual rights.

Storage limitation links to your retention schedule. If a pitch went nowhere two years ago, there is usually no reason to keep the contact. Deleting it reduces breach exposure and strengthens your position if someone asks what you hold.

Security covers the mundane: access controls on your CRM, no exported spreadsheets on personal drives, and a process for removing leavers. A journalist list leaked from a shared drive is a reportable incident.

Before you build any of this, it helps to know the digital PR data protection checks that should happen before you pitch, because the order of decisions affects the whole file.

Lawful basis choices under the Data Protection Act 2018

The Data Protection Act 2018 sits alongside UK GDPR and fills in the domestic detail, including how the rules apply to processing for journalism and how the ICO is constituted. The Data (Use and Access) Act 2025 amends parts of that framework, so agency policies written before it need a review.

For outreach, you have a small set of realistic lawful bases. Consent is the cleanest but hardest to obtain at scale. Legitimate interest is the workhorse for B2B prospecting. Contract covers existing clients. Legal obligation rarely applies to pitching.

Legitimate interest requires three steps, and the ICO expects you to document all three:

A balancing test is not a paragraph of boilerplate. It should name the audience, the data used, the likely expectation of the recipient, and any less intrusive alternative you rejected.

The recipients' expectations matter most. A business reporter who publishes a work email for tips has a different expectation from a personal Gmail address scraped from a forum. Treat those two records differently.

Consent remains the safer route for consumer-facing campaigns and for anything involving special category data. If you rely on consent, it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

Keep the evidence. A consent record with no timestamp, source or wording is weak. A legitimate interest assessment with no review date is equally weak.

Your privacy notice must name the basis and explain the right to object. Objections must stop the processing, not just the next send.

Under the 2025 Act, some recognised legitimate interests are available for specified purposes, but the documentation duty does not disappear. Read the current ICO position rather than relying on a summary from a supplier.

If your agency works across the UK, remember that UK regulations on data and sources shape how regional campaigns are run, from Scotland to the South West.

What ICO enforcement and the direct marketing checklist expect on file

The ICO publishes enforcement action, and the pattern in marketing cases is consistent. Penalties follow ignored complaints, missing consent records, and suppression lists that failed.

Enforcement action | ICO is worth reading as a risk register rather than as news. Each notice shows what the regulator asked for and what the organisation could not produce.

The recurring failures are mundane. No record of where a number or address came from. No evidence of consent. No process for honouring opt-outs. No training for the staff who send the messages.

The ICO direct marketing checklist turns those failures into questions. It asks whether you have identified a lawful basis, told people what you will do with their data, and made it simple to opt out.

Direct marketing checklist | ICO is the document to work through before a campaign goes live, not after a complaint.

For agencies, the checklist doubles as a client-facing artefact. It shows a prospective client that outreach will be run to a defined standard, which is a genuine differentiator in pitches.

Keep the completed checklist with the campaign file. If a client asks how their list was built, you should be able to answer in documents rather than recollection.

An internal disclosure policy is the natural companion, because it sets out what you tell clients and recipients about the data you use.

PECR rules for cold email and B2B outreach in link building

PECR governs electronic marketing, and it applies alongside UK GDPR. The two regimes ask different questions: UK GDPR asks whether you may process the data, PECR asks whether you may send the message.

Cold email to individuals needs consent. Cold email to corporate subscribers is permitted without consent, provided the sender is identified and an opt-out is offered.

The corporate subscriber test is narrower than many agencies assume. A sole trader and some partnerships count as individuals, not corporate subscribers. A generic info@ address at a registered company is the safer case.

Guide to Privacy and Electronic Communications Regulations | ICO sets out the rules for electronic mail, cookies and similar technologies.

Link building sits squarely in this territory. Pitching a guest post or a data story to a named editor is a marketing message, even when the aim is editorial coverage.

Business-to-business marketing | ICO explains where the B2B exemption applies and where it does not, including the treatment of sole traders.

Practical rules for outreach teams:

Soft opt-in exists but applies to existing customers in a sales context. It does not rescue a cold list bought from a broker.

Cookie consent and storage technologies on publisher sites you place links on

Digital PR often involves placing content on publisher sites, and those sites run analytics, advertising and embedded media. PECR covers cookies and similar storage, so consent has to be collected before non-essential storage is set.

Agency exposure here is indirect but real. If you supply an embed, a widget or a tracking pixel for a campaign, you are part of the consent chain.

Ask the publisher what is set on the page and on what basis. A placement that drops advertising cookies without consent creates a problem for the publisher and reputational risk for your client.

When you build a campaign hub or landing page, apply the same standard. Analytics that run before consent, or a cookie banner with no reject option, are common findings.

Keep the consent wording and the banner configuration on file. If a complaint arrives, the question will be what the user saw and when.

A file-by-file record: the practical checks an agency must retain

Documentation is what separates a defensible campaign from an optimistic one. Build a folder per campaign and keep it current.

Data protection fee registration is a separate duty. Most organisations processing personal data must pay the ICO's annual fee and appear on the register, and directors can be fined for non-payment.

Check the register before you pitch a client on compliance. It is a quick credibility test that many agencies overlook.

Whether you keep suppliers in-house or outsourced, the records duty stays with you. A supplier's assurances do not transfer your accountability.

When to use data brokers and what the ICO expects of buyers

Brokers sell access to media databases, contact lists and enrichment tools. They can save time, but they cannot transfer responsibility.

Under UK GDPR you are a controller for the list you use, even if you did not collect it. That means you must be able to point to a lawful basis and to the source.

Ask every broker for the provenance of the data, the lawful basis they relied on, and the date of collection. A broker who cannot answer should not be used.

Check whether individuals were told their data would be shared for marketing. If not, your legitimate interest assessment is built on sand.

Run a sample test before buying. Send to a small segment, watch bounce and complaint rates, and treat a spike as a signal that the list is stale or poorly sourced.

Contracts should include audit rights, breach notification, and deletion on request. Keep the due diligence in the campaign file.

Common questions