Content marketing agency contracts: terms to settle first

What to take away

The ICO's direct marketing guidance, last updated 21 May 2025, treats business-to-business email and calls as direct marketing. The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) set channel-specific rules; for marketing by email or text to individual subscribers, the contract should say who obtains consent or checks whether the soft opt-in applies, and who maintains suppression lists and handles opt-outs.
The CAP advertising codes apply to native advertising and advertorials, so require the agency to label paid content as the rules require.
The Consumer Rights Act 2015 applies only where the client is a consumer, so check which side of that line you are on before signing.
For a content marketing agency contract, settle scope, intellectual property, payment, liability and data protection before work starts.
This article sets out questions to ask. It is general guidance, not legal advice, and individual cases need a qualified adviser.

Which terms must a content agency contract settle first?

Start with the basics a dispute will turn on. What exactly is being delivered, to what standard, by when, and at what price? A statement of work attached to the master agreement is the usual home for this. It should name deliverables, word counts or asset volumes, review rounds and acceptance criteria.

Use this checklist alongside the statement of work:

Change control:say how changes to the scope, price or timetable are proposed, approved and recorded.
Payment:state when invoices are issued, the agreed payment period, how disputed invoices are handled and what happens if payment is late. Statutory interest may be available on qualifying commercial debts under the Late Payment of Commercial Debts (Interest) Act 1998.
Expenses:list reimbursable expenses, require prior approval and say what evidence must accompany a claim.
Confidentiality:define confidential information, permitted disclosures and how client materials must be protected and returned or deleted.
Governing law and jurisdiction:identify the law governing the contract and the courts that can hear a dispute.
Dispute resolution:set out the steps and contacts for escalating a disagreement before either side starts proceedings.

Contract basics to settle first

Deliverables, volumes and acceptance criteria
Review rounds and delivery dates
Price and payment terms
IP assignment in writing
Portfolio rights and third-party licences
Notice periods and file handover

Then decide who owns what. Copyright in original copy or design normally sits with the creator until assigned in writing, so the contract needs an assignment clause.

Check whether the agency keeps portfolio rights, and whether third-party assets such as stock images or fonts carry their own licences. For wider compliance, see Content agencies: UK rules and compliance guide for 2027. For this contract's data and direct-marketing terms, the relevant framework includes the UK GDPR, Data Protection Act 2018 and PECR 2003.

Finally, write down how the relationship ends. Notice periods, handover of files and any survival clauses matter more than the pitch deck suggests.

How should data protection duties be split?

Under the UK GDPR and Data Protection Act 2018, the client is usually the controller and the agency the processor. That split must be documented in a data processing agreement covering subject matter, duration, purpose, categories of data and security measures.

Splitting data protection duties

Client is usually controller
Agency is usually processor
Document split in a data processing agreement
Agree who checks lawful basis
Agree who maintains suppression lists
Agree who handles opt-outs
Name controller status if agency uses own list

The ICO's direct marketing guidance confirms that business-to-business email and phone marketing counts as direct marketing. So the contract should say who checks lawful basis, who maintains suppression lists and who handles opt-outs.

If the agency runs campaigns using its own platform or list, it may act as a controller or joint controller. That changes liability, so name it explicitly rather than assuming processor status.

Who is liable when a campaign breaches the advertising codes?

The CAP advertising codes cover native advertising and advertorials, and responsibility can sit with both the brand and the agency. Contracts should allocate responsibility for compliance checks before publication.

Build in an approval step: who signs off claims, testimonials and comparative statements? Require the agency to hold evidence for any factual claim it drafts. If the ASA receives a complaint, the client's reputation is exposed even where the agency wrote the copy.

Indemnities should be mutual and specific. An agency indemnity for third-party intellectual property claims is common; a client indemnity for products or claims it supplied is equally reasonable. Cap total liability at a figure both sides accept, and carve out fraud, death or personal injury where caps are not permitted.

Where does consumer law apply?

The Consumer Rights Act 2015 governs consumers' service contracts, but if your organisation is a business buying content marketing, it generally does not apply to that contract.

If you are a sole trader or a consumer buying services, it can. The Consumer Rights Act 2015 sets out statutory rights, including reasonable care and skill in performing services.

There is no general England-specific register for content agencies. If an agency operates as a limited company, it is registered with Companies House; that is company registration, not an agency-specific compliance register.

Decision table: situation, choose, avoid

Decision table

Choose

Business-to-business email campaign: A lawful basis and suppression process named in the contract
Sponsored article or advertorial: A labelling clause referencing the CAP codes
Client supplies customer data: A data processing agreement with security terms
Consumer client buying services: Terms reflecting Consumer Rights Act 2015 rights
Work spans several years: A review date for fees and scope

Avoid

Business-to-business email campaign: Assuming B2B email needs no consent or opt-out
Sponsored article or advertorial: Letting the agency decide disclosure after publication
Client supplies customer data: A verbal promise to delete data later
Consumer client buying services: Clauses that exclude statutory rights
Work spans several years: A fixed scope with no change mechanism

Common questions

Do content agency contracts need a data processing agreement?

Yes, where the agency processes personal data on the client's behalf. The agreement should set out purpose, duration, security and deletion terms, as required by the UK GDPR.

Can an agency keep copyright in the content it writes?

It can, unless the contract assigns copyright to the client. Check the assignment wording and any licence-back for portfolio use before signing.

Does the Consumer Rights Act 2015 apply to agency contracts?

Only where the client is a consumer. Business-to-business content contracts fall outside it, though other law still applies.

Who is responsible if an advert breaches the CAP codes?

Responsibility can fall on the advertiser and the agency. Allocate approval and evidence duties in writing, and take advice on your own facts.