3 checks before a UK micro-influencer brief uses ICO and UK GDPR guidance

What to take away

Where personal data turns up in a campaign

Four touchpoints carry personal data in a micro-influencer campaign.

Some creators publish health, religious or political content. If a campaign collects that material, it becomes special category data and needs a lawful basis and an extra condition. Keep collection narrow and record why each field exists.

Check one: the lawful basis for your creator list under UK GDPR

Start with what the list actually is. A spreadsheet of creator names, handles, email addresses, phone numbers and audience metrics is personal data about identifiable people. The ICO's UK GDPR guidance and resources set out the principles you must meet, including purpose limitation, storage limitation and accountability.

That matters for micro influencer marketing, where lists are often small and informal.

Many teams reach for legitimate interests because it feels quick. It can work, but it is not a free pass. You must identify the interest, show the processing is necessary, and balance it against the creator's rights and expectations. A beauty creator with a public business email has different expectations from a private individual whose address you scraped.

Record the balancing test. Two paragraphs is enough if they are honest: what you want to do, why less intrusive options will not work, and what you will do about objections. Keep it with the campaign file. If a creator objects, you stop using their data for that purpose.

Consent is the other common route, and it is harder than it looks. Consent under UK GDPR must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give. If your only route to a paid brief is agreeing to marketing, the consent is not freely given.

Contract is a narrow basis. It covers processing needed to deliver a brief a creator has already signed up to, such as paying them and shipping products. It does not cover prospecting, because there is no contract yet.

The ICO's lawful basis guidance is the reference point for choosing between these. Match the basis to the purpose, not to the department. Prospecting, contracting, paying and reporting are four purposes and may need different answers.

Watch the source of the data. Buying a creator database from a third party does not transfer their lawful basis to you. Ask the supplier what basis they relied on, what notice creators received, and whether the data was scraped. If the answers are vague, the risk lands on you.

Scraping public profiles is not a shortcut. Publicly visible does not mean free to process for outreach. The creator still has rights, and the ICO has been clear that transparency matters even where data is publicly accessible.

Special category data needs more care. If a campaign targets creators by health, sexuality, religion or political views, you are in a higher-risk category and need an additional condition. Most brand campaigns should avoid that targeting altogether.

For a wider view of how these duties land on the tools themselves, see what data protection means for campaign tools.

Check two: consent and PECR wording for outreach emails and DMs

PECR governs electronic marketing. It applies to email, SMS, and direct messages on platforms that function like private messaging. The ICO's guide to PECR for electronic marketing is the working reference here, and it is short enough to read in an afternoon.

The rule for email is simple to state. You need consent, or you need the soft opt-in. The soft opt-in only applies where you obtained the contact details in the course of a sale or negotiations for a sale, you are marketing similar products, and you offered an opt-out at collection and in every message.

Cold creator lists rarely meet that test. A list bought, scraped or assembled from public profiles has no prior sale behind it. That means consent, properly obtained and recorded, or no email. The ICO's guidance on choosing your lawful basis covers how the marketing rules and the UK GDPR basis fit together.

Consent wording has to name you. "We may share your details with partners" is not consent for your campaign. The creator needs to know who is contacting them, for what, and how to stop it.

Write the wording in plain English and keep it short. Something like: "We would like to email you about paid brand campaigns. We will use your name, email and social handle for that purpose. You can unsubscribe at any time using the link in every email." Then give a separate unticked box or an equally clear affirmative action.

Do not bundle consent with terms. A single tick box covering the brief, the newsletter and partner sharing is not valid consent for any of them.

Direct messages sit in a grey area. PECR covers "electronic mail", which the ICO reads as including messages sent to individual users through platforms. A public reply or a comment is not the same as a private DM. If you are sending individual marketing messages to creators, treat it as email.

Phone outreach has its own rule. Live calls to numbers not on the Corporate Telephone Preference Service need consent, unless the number is a sole trader or partnership number that is not registered. Many creators trade as sole traders, so check the register and check the entity.

Keep proof. A consent record should show who consented, when, what they were told and what they did. Evidence is weak when it consists of a screenshot of a tick box that has no timestamp. Store the wording version alongside the record, because wording changes over time.

When a creator says stop, stop. An opt-out is not a negotiation. Add them to a suppression list that survives campaign clean-ups, and make sure the suppression list is checked before every send.

If you are reviewing suppliers at the same time, our guide to tools and providers covers the disclosure and outreach side.

Check three: cookies, tracking and attribution in campaign tools

Campaign tools drop cookies and use storage on creator and audience devices. The ICO's guidance on the use of storage and access technologies sets out when consent is needed and when an exception applies.

The exception is narrow. Storage is exempt from consent only where it is strictly necessary to provide a service the user requested, such as remembering a shopping basket or keeping a login session alive. Analytics, attribution, retargeting and audience matching are not strictly necessary.

That means the tracking pixel on a creator's landing page, the UTM-tracking script in a dashboard, and the conversion tag on a checkout all need consent before they run. Consent must be collected before the storage is set, not after.

Banner design matters. A cookie banner with no reject option, or with reject hidden behind a second click, does not produce valid consent. Pre-ticked boxes do not either. The standard is the same as UK GDPR consent: clear affirmative action, easy withdrawal.

Server-side tracking does not remove the duty. If you are reading information from a user's device or writing to it, the rules apply regardless of where the logic sits. Moving the tag server-side changes the architecture, not the legal analysis.

Audience matching is the highest-risk area. Uploading creator follower lists or customer emails into an ad platform to build a lookalike audience is processing personal data for marketing. You need a lawful basis, notice, and for cookies or similar storage, consent.

Attribution windows are a data minimisation question. If you only need to know which creator drove a sale, you may not need a persistent identifier that follows the user for months. Shorten the window and say why in the record.

Vendors change tags without telling you. Put a quarterly review in the calendar, and make tag changes a contractual notification. If you cannot see what a tool sets, you cannot defend it.

Our piece on software selection against your workflow covers how to test this before signing.

Controller and processor roles across brand, agency and creator

The brand usually decides why creator data is processed and what happens to it. That makes the brand the controller for the creator list and the campaign reporting.

A monitoring platform acting on your instructions is a processor. It needs a written contract. The brand is usually controller because it decides why creator data is processed and how long it stays.

The agency is normally a processor when it acts only on the brand's instructions. It becomes a controller if it uses the creator list for its own pitches, adds contacts to its own database, or decides retention on its own terms.

Written contracts are required between controllers and processors. The contract must cover the subject matter, duration, nature and purpose of processing, the types of personal data, the categories of data subject, and the controller's instructions. It must also cover security, sub-processors, assistance with rights requests, breach notification and deletion on exit.

Tools are processors by default. A platform that hosts your creator list and sends your outreach is processing on your behalf. If the same platform uses your data to improve its own models or sell audience insights, it is processing for its own purposes and the roles change.

Creators can be controllers. A creator who runs their own link shortener, collects emails from their audience, or uses a tracking pixel on their own site is deciding why and how that data is processed. They need their own notice, basis and retention. Your brief should say so.

Creators can also be processors in a narrow sense. If you hand a creator a list of customer emails to match against their audience, and they act only on your instructions, they are processing for you and need a contract.

Sub-processors need naming. If your outreach tool uses a hosting provider outside the UK, that is a transfer question. Check the safeguards, and check whether the tool will tell you when sub-processors change.

Joint controllership is possible but rare. It arises where two parties jointly determine the purposes and means. Shared reporting dashboards alone do not create it, but shared decisions about targeting and retention might.

Get the roles into the campaign brief. One paragraph per party, naming controller or processor, is enough to prevent most arguments later. Our tool implementation walkthrough shows where that paragraph sits in the build.

Subject access requests and breach reporting duties

A creator can ask what you hold about them. That is a subject access request, and it must be answered without undue delay and within one month. The clock starts when the request arrives, not when you find it in a shared inbox.

You can extend by two months for complex requests, but you must tell the requester within the first month and explain why. Complexity means genuinely complex, not inconvenient.

You can ask for clarification if a request is genuinely unclear, but you cannot demand ID as a matter of routine. If you have doubts about identity, ask for what you reasonably need and no more.

Most of what you hold is disclosable. That includes emails, CRM notes, brief versions, consent records and internal comments about the creator, though some exemptions apply. Redact third party data, then release.

You cannot charge in most cases. A fee is only possible for manifestly unfounded or excessive requests, and you must justify it.

Breach reporting has a tighter clock. A personal data breach that risks people's rights and freedoms must be reported to the ICO within 72 hours of you becoming aware of it. If the risk is high, you must also tell the affected individuals without undue delay.

Common breaches in this space are mundane. A creator list shared in a public spreadsheet link. An outreach tool left on default permissions. A brief emailed to the wrong creator with another creator's rates attached. Each is reportable if the risk is real.

Keep a breach log even for incidents you decide not to report. The log is your evidence that you assessed the risk. Record what happened, what data, how many people, what you did, and why you reached your decision.

Train the people who touch the list. A campaign manager who forwards a spreadsheet to a freelancer has made a disclosure. They need to know that before it happens, not after.

An ICO and UK GDPR checklist for micro influencer marketing tools

Use this before the first brief goes out. It assumes a UK campaign with a brand, an agency and one or more creators, and it covers the three checks plus the roles and rights duties.

Run the checklist at three points: before signing a tool, before the first send, and at campaign close. The close review is the one teams skip, and it is where retention and deletion get decided.

Deletion means deletion. Removing a creator from a live list but leaving them in a backup, a test environment and an old export is not deletion. Map every copy before you promise anything.

Retention periods should be short and specific. Consent records and suppression lists usually need to outlive the campaign, because you need them to prove compliance and to honour opt-outs. Campaign performance data can often be aggregated sooner.

Creator contact details should not sit indefinitely. There is no single ICO retention number. The period follows purpose: after final payment, keep contact details only while needed for payment, dispute or consent proof.

A typical review point is 12 months after campaign close, but that is a working range, not a fixed rule. The ICO expects deletion designed into campaign tools, with scheduled removal and consent capture built in.

Keep the paperwork proportionate. A small campaign needs a basis note, a consent record, a tag map and a breach log. It does not need a fifty page data protection impact assessment unless the processing is high risk, such as large scale profiling or special category data.

Review when the tool changes. A new integration, a new tracking feature or a new sub-processor can change the analysis. Put the review date in the contract and in the calendar.

Decision table for privacy and disclosure

Data protection and advertising disclosure are separate duties. A campaign can breach CMA or CAP Code disclosure rules without breaching data protection law. A post can carry a clear ad label and still breach UK GDPR, or handle data correctly and fail disclosure rules.

The CMA guidance for content creators and the CAP Code apply across the UK, including England. Put both duties in the brief so the creator knows what is being checked.

Common questions