Rules and ethics
Social commerce data protection: practical checklist
A UK social commerce data protection checklist covering lawful bases, PECR rules, ICO fees, records, DPIAs, transfers, rights and breach deadlines.
Begin with a data-flow map for social commerce data protection. A post can lead to platform identifiers, referral data, a merchant account, payment and delivery details, creator reports, support messages and later advertising. The United Kingdom data-protection framework, including the UK GDPR and Data Protection Act 2018, applies across the UK; PECR adds rules for electronic marketing and technologies that store or access information on a device. Check with the ICO whether the controller must register and pay its data protection fee; an exemption may apply.
What to take away
- Name the controller and processor for every flow before accepting a supplier's role label.
- Inventory every tag in the deployed configuration and test refusal and withdrawal, not just acceptance.
- Ask whether an objective can be met with less information before uploading a customer list.
- Keep suppression and preference records connected across the agency, merchant and sending tools.
- Set an end event for test audiences, exports and temporary access before launch.
Identify roles from decisions
For every flow, name who decides why information is used and the essential means. The ICO's controller and processor guidance defines the roles and explains when a binding processor contract is required. Do not accept "processor" in a sales proposal without comparing it with the real activity.
Record joint or separate purposes where the merchant, platform, agency or creator uses information for its own decisions. For each purpose, document the lawful basis under UK GDPR Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. Maintain the Article 30 records of processing activities required for your role; recurring campaigns and customer-list matching should not be treated as occasional processing, and small size alone does not establish an exemption. Also document privacy information, access, retention, security, rights handling and transfers.
Check restricted international transfers before a provider or platform receives data outside the UK. Under UK GDPR Chapter V, use UK adequacy regulations where applicable or an appropriate safeguard such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and complete the required transfer risk assessment.
Review pixels and audience tools before activation
Social advertising may use cookies, pixels or other storage and access technologies on the merchant site. Regulation 6 of PECR generally requires consent before storing information on, or accessing information stored on, a user's device. Its limited exceptions include storage or access solely to transmit a communication and what is strictly necessary to provide an information society service explicitly requested by the user. The UK GDPR also applies where personal data is processed.
Inventory every tag in the deployed configuration, including those loaded through a consent or tag-management service. State its purpose, data recipient and activation rule. Test refusal and withdrawal, not just acceptance. A supplier's dashboard label does not prove the technology remained inactive.
Archive the deployed configuration so later reviewers can distinguish an approved design from the code that actually ran.
Minimise uploads and inferences
Before uploading a customer list or building a matched audience, ask whether the objective can be met with less information. The ICO's data-minimisation guidance says personal data must be adequate, relevant and limited to what is necessary for the purpose.
Avoid inferring sensitive characteristics from follows, names, images or product interests. The ICO notes in its special-category guidance that deliberately assigning and using certain inferred attributes can involve special category data. Escalate such proposals before any audience is generated.
Before a new audience-matching or profiling activity starts, screen whether a data protection impact assessment (DPIA) is required under UK GDPR Article 35. A DPIA is mandatory where processing is likely to result in a high risk to people's rights and freedoms; examples include systematic and extensive evaluation based on automated processing that produces legal or similarly significant effects, and large-scale processing of special-category or criminal-offence data. Record the screening and complete any required DPIA before processing begins.
For a customer-list match, record the original collection context, selection rule, fields uploaded, audience exclusions and deletion confirmation. Keep a suppression process so a person who objects is not silently restored during the next export. Do not send more fields merely because the platform accepts them.
Separate service contact from promotion
Order confirmation, support and marketing may travel through the same inbox but serve different purposes. The ICO's electronic-mail guidance addresses email, texts and direct messages; PECR Regulation 22 generally requires consent for unsolicited electronic-mail marketing to individual subscribers. Its Regulation 22(3) soft opt-in may apply where details were obtained during a sale or sale negotiations, the sender markets its own similar products or services, and an opt-out was offered when details were collected and in every message. Assess the content, recipient and route; do not assume a previous purchase permits every later promotion.
Keep suppression and preference records connected across the agency, merchant and tools that send messages. Define who acts on objections, erasure or access requests when information sits in several systems. Under UK GDPR Article 12(3), respond without undue delay and within one month; a complex request or multiple requests may allow up to two further months, but tell the requester and explain why within the first month.
Prepare an incident route for misdirected messages, exposed exports, compromised creator access or unexpected platform recipients; the person receiving a report should preserve facts, restrict further processing and contact the data-protection lead. Record each personal data breach and assess risk promptly: under UK GDPR Article 33, a controller must notify the ICO without undue delay and, where feasible, within 72 hours of awareness if the breach is likely to risk people's rights and freedoms. If it is likely to result in a high risk, notify affected people without undue delay under Article 34; a processor must notify its controller without undue delay. Do not delay escalation while the marketing team decides whether results were affected.
Contract and close the flow
The ICO's Article 28 contract guidance lists required processing details and minimum terms, including instructions, confidentiality, security, subprocessors, rights assistance, deletion or return, and audits.
Before launch, compare that record with the chosen provider agreement. Set an end event for test audiences, exports and temporary access. Recheck after a platform feature or partner changes. A campaign is not closed while copied lists, creator reports or unused permissions remain unaccounted for.
Before you act
- Map each data flow from post to retention.
- Compare the provider agreement with the Article 28 requirements.
- Record the original collection context for each uploaded list.
- Archive the deployed tag configuration for later reviewers.
- Define who acts on objections, erasure and access requests.
- Prepare an incident route for exposed exports and misdirected messages.
- Check ICO registration and whether the data-protection fee exemption applies.
- Choose and document an Article 6 lawful basis for each purpose.
- Keep the Article 30 records of processing activities required for your role.
- Screen for a DPIA and complete one before processing if required.
- Check Regulation 6 PECR consent and exceptions for each device-storage or access technology.
- Confirm Regulation 22 PECR consent or that the soft opt-in conditions are met.
- Record the international transfer safeguard and transfer risk assessment where required.
- Set a process to respond to rights requests within one month.
- Route qualifying breach reports for ICO notification within 72 hours.
Common questions
When is a binding processor contract required?
The ICO's controller and processor guidance defines the roles and explains when a binding processor contract is required. Do not accept processor in a sales proposal without comparing it with the real activity. Record joint or separate purposes where the merchant, platform, agency or creator uses information for its own decisions, and document the lawful basis for each purpose.
Can a previous purchase permit every later promotion?
No. The ICO's electronic-mail guidance addresses email, texts and direct messages. Assess the content, recipient and route, and do not assume a previous purchase permits every later promotion. Keep suppression and preference records connected across the agency, merchant and tools that send messages, and define who acts on objections.
What must be included in a processor contract?
The ICO's Article 28 contract guidance lists required processing details and minimum terms. These include instructions, confidentiality, security, subprocessors, rights assistance, deletion or return, and audits. Before launch, compare that record with the chosen provider agreement, and recheck after a platform feature or partner changes.
