Rules and ethics
Part of UK rules for an announcement, mapped route by route from claims to supplier contracts
Press release distribution data protection workflow
An overview of press release distribution data protection, mapping data events, sources, purposes, roles, systems, retention, objections and deletion evidence.
Press release distribution data protection begins with a data journey, not a conclusion about lawful basis. A release may contain named people, move through supplier accounts and be sent to identifiable media contacts. Each operation needs its own purpose, role, evidence and retention decision. This UK-focused guide uses UK material; check current guidance before outreach.
What to take away
- Map each data event separately, covering fields, source, purpose, roles, systems, retention and deletion evidence.
- A journalist's work email is still personal data, and public availability is not automatic consent to marketing.
- The Data (Use and Access) Act amended the UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them.
- A supplier contract cannot create a lawful basis or PECR permission, so test labels against real conduct.
- Keep publication on hold until provenance, roles, privacy information, PECR analysis, security and deletion evidence are resolved.
Draw the journey as events
List each event separately: an employee supplies copy; an approver edits it; a contact list is selected; a platform receives files and addresses; messages are transmitted; responses and objections arrive; monitoring captures public material; records are exported, corrected, suppressed or deleted.
For every event, capture:
- data fields and whether they identify a person;
- source, collection date and accuracy evidence;
- stated purpose and compatible or new uses;
- buyer, supplier and recipient roles;
- systems, locations, access and onward recipients;
- retention trigger, correction route and deletion evidence.
This factual map does not determine controller, joint-controller or processor status. The parties' real decisions and conduct matter. A supplier label and contract wording should be tested against the service actually delivered.
Separate contact from permission
A journalist's work email can still be personal data. If an email is direct marketing, PECR regulation 22 requires prior consent for individual subscribers unless the soft opt-in applies: the sender must have obtained the address during a sale or negotiations for a sale, market its own similar products or services, and offer an opt-out when collecting the address and in every message. Corporate subscribers are not subject to regulation 22's consent rule, but sole traders and some partnerships are individual subscribers; regulation 23 requires sender identification and a valid way to opt out. The ICO's business-to-business marketing guidance says public availability is not automatic agreement to direct marketing, and UK GDPR obligations can apply to identifiable business contacts.
Record why the individual might reasonably expect the specific communication, how privacy information is provided, how an objection reaches every live system and which minimal identifier remains on a suppression record. Do not treat an editorial enquiry, attendance at an event or receipt of one requested announcement as blanket permission for future promotion.
The privacy reviewer should document an Article 6 UK GDPR lawful basis for each processing purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests. If relying on legitimate interests, document the purpose, necessity and balancing test. Assess PECR separately: a UK GDPR lawful basis does not replace PECR consent where regulation 22 requires it, and a supplier's ability to send is not permission. Whether an email is direct marketing depends on its purpose and context, so assess the actual list and message.
Work from the current legal state
The ICO's Data (Use and Access) Act overview states that the Act amended, rather than replaced, the UK GDPR, Data Protection Act 2018 and PECR. Check the current status of relevant provisions and any ICO guidance review notices before outreach.
If the supplier handles data only under documented buyer instructions, check the contract against UK GDPR Article 28. A processor contract must state the subject matter and duration, nature and purpose of processing, types of personal data and categories of data subjects, and the controller's rights and obligations. It must also cover documented instructions, confidentiality, security, subprocessors, assistance with data-subject rights and compliance duties, return or deletion at the end of the service, and audit information; the processor must alert the controller if an instruction appears to breach data protection law. ICO guidance on controller and processor arrangements describes when a binding arrangement is needed and is itself marked for DUAA review. The commercial agreement cannot manufacture a lawful basis or PECR permission.
Record the required compliance controls
Check whether the organisation must pay the data protection fee to the ICO. Use the ICO fee checker, pay if required, and check the public register of fee payers; an exemption from the fee does not remove UK GDPR duties.
Article 30 UK GDPR requires controllers and processors to keep records of processing activities (ROPA) unless a limited exception applies. Do not assume the exception covers regular media lists or distribution: it does not apply where processing is non-occasional, likely to risk people's rights and freedoms, or involves special-category or criminal-offence data. Record the applicable purposes, data and subject categories, recipients, international transfers, retention limits and security measures.
Under Article 35 UK GDPR, complete a data protection impact assessment (DPIA) before processing likely to result in high risk. Triggers include systematic and extensive automated evaluation with significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of publicly accessible areas. Assess the actual data journey; a DPIA is not automatically required for every press release campaign.
Map where suppliers and subprocessors access data. A restricted transfer of personal data outside the UK needs an applicable adequacy regulation or appropriate safeguards; safeguards can include the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs). Where required, complete a transfer risk assessment and do not rely on EU SCCs alone for a UK restricted transfer.
Control content, access and incidents
Minimise personal information inside the public release. Confirm authority before naming staff, customers, case-study subjects or quoted individuals. Keep embargoed copy and lists away from broad shared accounts. Use role-based access, protected source files, logs, account recovery and a tested incident route.
NCSC SaaS security guidance offers operational checks for access, logging, backups and recovery. It does not verify a distributor's data-protection status. Security evidence and privacy reasoning remain separate gates. For a personal data breach, Article 33 UK GDPR requires the controller to notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms; a processor must notify the controller without undue delay. Under Article 34, inform affected people without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
Close the record deliberately
At completion, reconcile approved recipients, sends, failures, replies, corrections and objections. Export records needed for the buyer's evidence and suppression duties. Delete material that has reached its documented endpoint, subject to any justified retention or preservation instruction. Obtain supplier evidence rather than assuming an account closure removed every copy.
Route subject access requests and erasure requests to the controller and track their deadlines. Under Article 12(3) UK GDPR, respond without undue delay and within one month of receipt; an extension of up to two further months is possible for complex or numerous requests, with the person told within the first month. Erasure is subject to the exceptions in Article 17, and an objection to direct marketing must be honoured; retain only the minimal suppression data needed to prevent future contact.
Keep publication on hold where provenance, role allocation, privacy information, PECR analysis, objection handling, security or deletion evidence is unresolved. Named privacy and PECR counsel, security, accessibility, commercial and editorial reviewers must examine the actual data journey and current guidance before use.
Before you act
- List every event in the data journey separately.
- Record fields, source, purpose, roles and retention for each event.
- Check the ICO data protection fee requirement and public register of fee payers.
- Keep an Article 30 record of processing activities where required, and assess whether an Article 35 DPIA is needed.
- Document the UK GDPR Article 6 lawful basis and assess PECR separately, including regulation 22 subscriber status, consent or soft opt-in, and regulation 23 opt-out requirements.
- Check supplier terms against Article 28 and map international transfers, using an applicable transfer mechanism and risk assessment where required.
- Confirm privacy information and authority before naming staff, customers or quoted individuals.
- Set an incident route that covers Article 33 ICO notification and Article 34 communication to affected people where required.
- Route access and erasure requests promptly and track the UK GDPR response deadline.
- Reconcile sends, replies, corrections and objections before deletion.
Common questions
Does a work email address count as personal data?
Yes. The article states a journalist's work email can still be personal data. The ICO's business-to-business marketing guidance says public availability is not automatic agreement to direct marketing, and UK GDPR obligations can apply to business contacts.
What did the Data (Use and Access) Act do to existing law?
The ICO overview says the Act amended, rather than replaced, the UK GDPR, the Data Protection Act 2018 and PECR. Check the current status of relevant provisions and any ICO guidance review notices before outreach.
Can a supplier contract make marketing lawful?
No. The article says the commercial agreement cannot manufacture a lawful basis or PECR permission. Where a supplier handles data only under documented buyer instructions, inspect the contract evidence, and test any supplier label against the service actually delivered.
