Micro influencer marketing: handling creator data

Trace the record from first contact

In micro influencer marketing, creator data enters a campaign before publication: an outreach email list may hold names, addresses, quoted rates and notes from calls. Map each source before briefing, recording what data it contains, why it is held, who can access it and when deletion is due. This inventory informs later choices.

A sole trader's business details are personal data, so an unsecured sheet on a shared drive is a compliance issue rather than harmless filing. Direct messages, audience comments and platform reports add volume quickly. Apply the same mapping to those records, noting their purpose, access and deletion point instead of tracking only contact details.

Name the party making the decisions

Your brand normally controls the creator list because it decides why and how those records are processed. A controller chooses the purpose and means; a processor handles personal data for a controller. The brand is therefore usually the controller for records it gathers to find and manage creators.

A monitoring or reporting platform is a processor when it follows your instructions. Put the division in writing and in the contract terms agreed with each supplier, since the roles affect who responds to questions. A creator controls audience data gathered through their own account, separately from the information your brand keeps about that creator.

Match the legal basis to the channel

Every processing purpose needs a lawful basis, and the options include consent, contract, legal obligation and legitimate interests. Choose for the actual use rather than applying one label to the whole campaign.

The creator list, agreement records and outreach activity may serve different purposes, so record the basis for each list.

Where processing is needed to perform a signed creator agreement, contract is usually the basis. A cold outreach list more often relies on legitimate interests: the use must be necessary for your interests and those interests must not be overridden by the creator's rights. Record the selected basis against each list.

That basis does not replace channel rules. Email or text marketing to individuals needs specific consent under PECR regulation 22. A limited soft opt-in covers your own previous customers only, not new contacts on bought-in lists. Sole traders and some partnerships count as individuals for this rule.

Give each field an exit point

Collect only the fields the campaign needs and tie each one to a purpose you can state.

Ask for a creator's postal address when a product is being sent; a date of birth rarely merits collection. Review lists regularly and remove information that is no longer needed, including details held by survey tools.

Small campaigns often leave creator sheets on shared drives long after work ends, despite the original purpose having expired. Set a retention period for every list, record why it is needed, and delete or anonymise on schedule so data is not kept longer than necessary. Write standard periods where possible; this also reflects the data protection principles.

Treat sensitive notes as exceptional

Health, religion and politics are special category information when a campaign records them. A creator may discuss such matters openly, but that does not remove the need for extra care.

First ask whether the campaign needs the information at all; recording health details merely to match a theme can exceed what the work requires.

Before collecting it, identify both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9, and write each down. The ICO special category data guide sets out the relevant guidance; one general reason for processing is not enough for this data.

In most campaigns, the simplest choice is not to gather this material. Keep any notes to what the content shows and remove details beyond that. A creator's health information requested only to fit a creative theme is usually more than the work needs, so leave it out of the brief and subsequent records.

Keep requests and ad labels distinct

Creators may ask what you hold about them through a spoken request, in writing or on social media. Treat each as a subject access request, reply without delay and meet the one-month deadline. Plan for requests before one arrives, rather than deciding where records are held under pressure.

Name one person to log requests, identify where each creator record sits, and keep the brief and rate history together. If a creator asks to be removed, act without delay. Deleting a message thread after a request arrives is not an appropriate response and may leave you unable to locate the information requested.

Data protection governs how creator and audience information is handled; advertising law governs how a post is labelled. These duties are separate, and industry advertising rules are enforced separately. A campaign may meet one duty and fail the other, so label each commercial post clearly as an ad and say so beside the data clause in the brief.

Both checks belong in the wider rules and compliance guide. When a new supplier is involved, test the disclosure and data requirements during vendor due diligence, before any creator data moves. The written brief should distinguish the advertising instruction from the terms that govern data handling.

Set controls before platform import

Before importing into a new platform, settle roles, fields and retention. Use tool implementation to carry those checks through rollout.

Document a purpose and lawful basis for audience data, and do not reuse it for an unrelated launch. Give each creator list a named owner and put paid-work roles in writing.

This is general guidance only, and it does not decide how every campaign should handle a particular record or request. A specific campaign or complaint needs a qualified adviser to assess its circumstances before you settle the response or next steps for your organisation.