Rules and ethics
Part of B2B influencer marketing: UK disclosure laws
Why B2B influencer marketing data protection starts with lawful outreach
What UK data protection law means for B2B influencer marketing: PECR consent tests, lawful bases, retention limits and platform ad policy checks.
What to take away
- Influencer outreach by email counts as electronic marketing, and the ICO's PECR guidance sets the consent test.
- A creator's email address, rate card and audience figures are personal data once you can identify them.
- Pick a lawful basis before the first email and record who made the choice and when.
- Set a deletion date when a creator record opens, and delete what the campaign no longer needs.
- Platform advertising policies apply on top of the law, and a breach can stop a paid campaign.
Where personal data enters a B2B creator programme
A creator programme collects data long before a contract exists. Sourcing tools, event lists and conference programmes hold named individuals, and each one you copy into a spreadsheet becomes a record you are responsible for. The steps for building an influencer longlist show where those sources come from.
PECR consent test
Is the contact an individual subscriber?
Consent or soft opt-in needed
Corporate subscriber, PECR email rule does not apply
Contact lists and the PECR test
The email consent rule in PECR covers individual subscribers. The ICO email marketing guidance says you need consent or must meet the requirements of a soft opt-in, and that this includes sole traders and ordinary partnerships. Corporate subscribers can be mailed without either.
Check which category your contact falls into before you send anything. The soft opt-in helps only where you gathered the address during a sale or negotiation and offered a refusal at that point. A cold approach to a creator you have never dealt with does not meet that test, so treat it as a consent question.
What counts as personal data in a creator file
A rate card, a personal email address or audience screenshots can each identify a person. UK GDPR applies to that file, whatever its size. Keep only what the campaign needs. Follower counts alone are not personal data, but the creator behind them is.
A work address at a small firm can identify one person, so treat it as carefully as a personal inbox. Vetting adds more data: a check on vetting B2B influencers before you work with them produces notes about named people, and those notes belong in the same controlled file.
If you are still mapping which duties apply, the UK rules and compliance guide sets out the disclosure, contract and data questions in one place. Work through it before the first outreach email goes out.
Building a lawful basis into the brief
Consent, legitimate interests and the record you keep
Pick a lawful basis before the first email, not after the campaign. Legitimate interests often fits prospecting but needs a documented balancing test, so write the choice into the campaign file. Consent suits a newsletter sign-up and must be as easy to withdraw as to give.
Weak vs defensible creator file
Before
- Contact source
- Scraped list
- Lawful basis
- Not stated
- Screenshots
- Held indefinitely
- Brief
- Silent on data
After
- Contact source
- Named sources
- Lawful basis
- Logged at collection
- Screenshots
- Deletion date set
- Brief
- States sharing limits
Record who made the call and when, then revisit the basis if the purpose shifts. A basis chosen for a first approach does not automatically cover a later paid brief, a newsletter or a reuse of the same contact data in another campaign, so each new purpose needs its own entry in the file.
Retention and deletion for creator records
Under the ICO storage limitation guidance, you must not keep personal data for longer than you need it. Set a deletion date when a record opens. A longlist that goes nowhere should not sit on a shared drive for years. Record the source of every contact so you can answer a request later.
Where a creator asks to be removed, act on it and log the date so the next campaign does not re-add them. Keep only the minimum that shows why you approached someone, and nothing else. A weak file and a defensible one look different on paper.
| Before | After |
|---|---|
| Emails saved from a scraped list | Named sources recorded for each contact |
| No stated lawful basis | Lawful basis logged at collection |
| Screenshots held indefinitely | Deletion date set when the record opens |
| Brief silent on data | Brief states what creators must not share |
Platform rules and advertising policy
Advertising policy checks before a campaign runs
Paid promotion must meet platform policy and the law. A creator post boosted as an ad falls under the platform's advertising terms as well as the rules that apply to the post itself. Fix labelling before spend goes live, as a takedown costs more. Labelling rules differ by format, so check the specific ad product before the creator posts.
A written B2B influencer marketing disclosure policy gives every creator one labelling rule to follow. That matters when a platform review arrives. The wider B2B influencer advertising rules explain how those labels sit alongside the data duties above, so keep both in the campaign file.
Roles when an agency runs the outreach
When an agency sends the emails, the split of roles decides who answers a complaint. Write that split into the influencer marketing commercial contracts before the first send, together with what the agency may keep and when it must delete.
Contract terms can differ between campaigns, so check each agreement against the data duties above. Individual cases need a qualified adviser, particularly where a creator is a sole trader or the campaign involves special category data.
Common questions
Does UK GDPR apply to a creator's public profile?
Yes, once you can identify the person from the data you hold. A public post is still personal data when you build a record around it, so the lawful basis, retention and deletion rules apply to that record.
Can we email a creator at their company address?
Often yes, if the address belongs to a corporate subscriber. Sole traders and ordinary partnerships count as individual subscribers, so consent rules apply to them. Check the entity type first, and record what you found in the creator file.
How long should we keep creator records?
As long as you need them for the purpose you recorded, then delete. A stated retention period beats an open-ended drive. Review the file at the end of each campaign and remove contacts you no longer need to approach.
Who owns the data when an agency runs the outreach?
The brand usually decides the purpose and so acts as controller, with the agency as processor. Put that split in the contract, name who answers requests from creators, and agree what happens to the records when the engagement ends.
