How UK GDPR and PECR change a content agency brief

What to take away

What a UK GDPR and PECR brief must state before work starts

A brief is a processing instruction. If it is vague about personal data, the agency either guesses or stalls. Both cost you money.

The ICO publishes the compliance baseline that UK marketers work to, covering principles, accountability and individual rights, and a brief should be checkable against it. See the UK GDPR guidance and resources for the current wording.

At minimum, the brief should state what personal data the agency will touch, why, for how long, and who decides. That includes email lists, CRM exports, webinar registrations, gated PDF downloads, review quotes and user-generated content.

It should also state who is controller and who is processor. Most content retainers are processor work, but audience research, list building and lead scoring can flip an agency into controller territory.

Write down the tools. A content agency using an AI writing assistant, a heat-mapping script or a social scheduling platform is transferring personal data to third parties. Each tool needs a name in the brief.

Cover the handover. When the contract ends, does the agency delete the data, return it, or keep it for portfolio use? Portfolio use of client data is a common dispute.

Finally, state the review trigger. A brief that was compliant in January may not be compliant after a new consent banner, a new newsletter platform or a new market.

Minimum contents checklist

That checklist is short enough to paste into a statement of work. It is also the fastest way to spot an agency that has not read the rules.

Lawful bases under UK GDPR: consent, legitimate interest and contract

Every processing activity needs a lawful basis. There are six, and the ICO sets out how to choose between them. The Lawful basis | ICO page is the reference to cite in a brief.

Consent is the strictest. It must be freely given, specific, informed and unambiguous, and withdrawing it must be as easy as giving it. That last point kills most pre-ticked boxes and bundled terms.

Legitimate interest is the most used and the most abused. It requires a three-part test: purpose, necessity and balancing. The balancing test has to consider the reasonable expectations of the person whose data it is.

Contract covers processing needed to deliver something the person asked for. Sending a purchased product is contract. Sending a weekly newsletter is not.

Legal obligation, vital interests and public task rarely apply to content marketing, though legal obligation can cover tax and accounting records.

A brief should not let one basis cover everything. Newsletter sign-ups, event photography, case study quotes and website analytics usually need different bases. Where the choice is genuinely contested, the reasoning belongs in the brief rather than in a slide. Our companion piece on Consent or legitimate interest sets out how agencies typically split them.

ICO consent standards for cookies and storage technologies

Cookies are governed by PECR, not by UK GDPR alone. The ICO's Guidance on the use of storage and access technologies | ICO explains what counts and what does not.

The scope is wider than cookies. Local storage, pixels, device fingerprinting and some SDKs all fall under storage and access technologies. If the brief only mentions cookies, it is out of date.

Consent must be unambiguous and involve a clear affirmative action. Scrolling, continued browsing and banner dismissal do not qualify. Neither does a pre-ticked box.

Rejecting must be as easy as accepting. A banner with an Accept button and a buried settings link fails that test. So does a consent wall that blocks access until someone agrees.

Analytics cookies are not exempt. If an agency proposes Google Analytics or a heat-mapping tool without a consent gate, that is a brief-level problem, not a developer problem.

There is a narrow exception for strictly necessary cookies, such as basket and security functions. Marketing and measurement rarely qualify.

Keep the evidence. Consent records should show what was shown, when, and what the person did. Agencies that cannot produce this cannot defend the client.

Email and SMS marketing rules under PECR for agency campaigns

PECR governs electronic marketing. The ICO's Direct marketing and privacy and electronic communications | ICO guidance covers email, SMS, live calls and automated calls.

The default rule is consent. The soft opt-in is the exception. It applies only where the recipient's details were obtained during a sale or negotiations for a sale.

The marketing must also concern similar products, and an opt-out must have been offered at collection and in every message.

Soft opt-in is not a general permission to email a customer base. A gym selling memberships cannot use it to promote a partner's supplement brand.

Every message needs a valid sender identity and a working unsubscribe route. Unsubscribes must be honoured promptly, and a suppression list should survive any platform migration.

SMS carries the same consent standard as email. Purchased lists are not a shortcut, and consent cannot be inherited from a list broker.

Corporate subscribers are covered too. PECR protects limited companies and LLPs as well as individuals, which is where many B2B teams go wrong.

Brief the agency on who owns the list. If the agency builds the list in its own platform, the client may lose control of the asset and the consent record.

B2B versus B2C marketing: where the ICO rules diverge

The assumption that B2B marketing sits outside PECR is wrong. PECR covers corporate subscribers, so a cold email to a limited company is still electronic marketing.

The divergence is in how the rules bite, not whether they apply. B2B campaigns lean on legitimate interest for processing and on consent, or soft opt-in, for the message itself.

For tax purposes, sole traders and non-limited partnerships are regarded as individuals. A list of sole trader addresses cannot be treated as corporate, even if the domains look like business domains.

LinkedIn outreach sits in a grey area. Connection requests are not email, but InMail and direct messages are electronic marketing, and the same consent logic applies.

B2C campaigns have less room. Where the audience includes consumers, consent is the practical default for email and SMS, and profiling needs a documented balancing test.

The ICO has taken action against organisations that treated business contact data as unrestricted. The lesson for briefs is simple: state the subscriber type, not just the audience segment. Where a campaign spans both, our note on consent and claims covers the overlap with advertising rules.

Data subject rights, accountability and DPIAs in content operations

Rights requests arrive through content channels. A comment on a blog post, a reply to a newsletter or a message to a social account can all be a subject access request.

The brief should name who monitors those channels and how requests reach the client's data protection lead. Agencies that sit on a request for a fortnight create a problem for the client.

Accountability means records. Processing records, consent evidence, retention schedules and DPIA outcomes should be listed as deliverables, not as optional extras.

A DPIA is required for processing likely to result in high risk. Profiling, large-scale special category data, systematic monitoring and some AI-driven personalisation can all trigger one.

Content work triggers DPIAs more often than teams expect. Audience segmentation, sentiment analysis and automated personalisation are the usual candidates.

Where an agency runs AI tools over customer data, the assessment should cover the tool, the data flows and the retention. Our piece on how to check the data rules before briefing AI work covers that ground.

Breach handling belongs in the brief too. The client has 72 hours to notify the ICO where a breach is reportable, so the agency's internal escalation window must be shorter than that.

How the Data (Use and Access) Act 2025 changes the brief

The Data (Use and Access) Act 2025 amends UK data law, and briefs written against the older regime need a review pass.

The Act adjusts parts of the consent and cookies framework, including provisions intended to reduce consent banner fatigue for low-risk uses. The detail matters more than the headline.

It also touches automated decision-making, research purposes and the ICO's own structure and duties. Each of those can affect content operations indirectly.

For agencies, the practical effect is that cookie compliance advice from 2023 may be stale. A brief should require the agency to confirm which version of the rules it is working to.

Ask for a written position on the Act at kick-off. One paragraph is enough: what changed, what it means for this account, and what the agency will monitor.

Do not treat the Act as a finished story. Secondary legislation and ICO guidance continue to land, so the brief should set a review point rather than assume a fixed answer.

Clauses to add to a content marketing agency statement of work

A statement of work is the document that decides who pays when something goes wrong. These clauses are the ones that matter.

Worked example

A Yorkshire manufacturer briefs an agency to run a gated whitepaper campaign and a monthly newsletter. The whitepaper form collects name, work email, company and job title. The newsletter goes to the same list.

The brief should state consent for the newsletter, because the whitepaper download is not a sale. Legitimate interest can cover the download itself, but not the follow-up marketing.

Cookie consent is needed for the analytics and LinkedIn insight tag on the landing page. The agency must keep the consent record and the banner wording.

Retention is twelve months for non-converting leads, after which the record is deleted. The agency is a processor throughout and must not reuse the list for another client.

That is a compliant brief in five paragraphs. Most disputes come from leaving those five paragraphs out.

Before signing, it is worth running the wider rules and ethics check, because data protection is only one of the regimes a content agency touches.

Common questions