Rules and ethics
Part of Customer data platforms rules and ethics: UK guide
Which UK regimes touch a customer data platform journey, and which role in the buyer's team owns each one
Map the UK regimes that may touch an England customer data platform journey, from the UK GDPR and PECR to the Equality Act, with a source and owner for each.
No statute called the customer data platform regulation governs England. The rules depend on what the configured journey does. This map separates primary law, regulator guidance, advertising code, contracts and operating ethics, using sources checked on 7 October 2026. It gives no legal advice or compliance conclusion.
What to take away
- No single customer data platform regulation exists, so the rules depend on what the journey does at each step.
- Statute, regulator guidance, an advertising code and contract terms are separate regimes with separate decision owners.
- A platform capability or a consent flag does not decide which regime applies.
- Record pass, hold or reject for each regime, because a low price cannot repair a failed legal gate.
- Recheck legislation and guidance immediately before publication or activation, because several sources changed in 2025 and 2026.
Map the regimes to decisions
| Regime or record | Material question | Source to cite | Decision owner in the buyer's team |
|---|---|---|---|
| UK GDPR and Data Protection Act 2018 | What personal data, purpose, authority, accuracy, rights, retention and security apply? | Both texts on legislation.gov.uk, plus ICO guidance | Privacy lead and legal reviewer |
| Privacy and Electronic Communications Regulations 2003 (PECR) | Does the journey store or access information on a user's device, or use an electronic marketing channel? | Regulation 6 on legislation.gov.uk, plus ICO storage and access guidance | PECR reviewer and legal reviewer |
| Data (Use and Access) Act 2025 | Which amendments and commencement stages affect the current assessment? | The Act on legislation.gov.uk | Legal reviewer using the latest commencement record |
| CAP Code | Is each marketing communication recognisable, accurate and supported by evidence? | The current CAP Code text | Advertising reviewer |
| Consumer protection | Could the audience journey or message be an unfair commercial practice? | Digital Markets, Competition and Consumers Act 2024, which includes a prohibition of unfair commercial practices | Consumer-law reviewer |
| Equality Act 2010 | What reasonable adjustments do accessibility duties require? | Section 20 on legislation.gov.uk | Accessibility lead and legal reviewer |
| Contract and professional ethics | What has each party promised, and what stricter controls apply? | The signed terms and any professional code the team has adopted | Commercial counsel and accountable owner |
PECR: devices and electronic marketing
Regulation 6 of PECR sets the starting rule for cookies, pixels and similar tools: PECR regulation 6 says a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, subject to Schedule A1.
The regulation was substituted on 5 February 2026 by the Data (Use and Access) Act 2025. Regulator guidance on storage and access technologies was finalised on 29 April 2026. Use both when you describe how the journey sets identifiers.
The 2025 Act changes the baseline
Part 1 of the Data (Use and Access) Act 2025 deals with access to customer data and business data, and the same Act amended PECR. The reader's question is not whether the Act is relevant but which provisions are in force for this journey today.
Keep a dated note of the commencement status you relied on. A change in commencement reopens any decision that depended on the earlier position.
Accessibility is a legal duty, not a feature
Where the Equality Act 2010 imposes a duty to make reasonable adjustments, section 20 requires steps that are reasonable to take to avoid a substantial disadvantage to a disabled person caused by a provision, criterion or practice. The section is marked as applying in England, Wales and Scotland.
For a platform journey, that points at admin tasks, preference centres and consent screens. Test them with the people who must use them, and record who decided that an adjustment was or was not reasonable.
Apply the map to the data journey
Record collection, device access, identifiers, joins, profile or inference state, analytics and activation separately. For each step, name the source, purpose, legal entities, recipient, retention and correction or deletion route. The data protection analysis and the identity resolution review each need their own record.
Keep public adverts, targeted advertising, genuine research, service messages and promotional electronic messages apart. UK GDPR authority cannot answer a PECR question, and a PECR exception cannot support an advertising claim. The advertising rules checklist covers the audience side.
Assign separate release owners
- Privacy ownerreviews the data map and the rights route.
- PECR reviewerassesses device access and electronic communications.
- Advertising and consumer reviewersinspect the final message and audience context.
- Security, accessibility and IP reviewersexamine their own evidence.
- Commercial counselchecks service, data and exit terms against the commercial contracts areas.
Keep one regime record per decision. It should cite the exact law or guidance page, its status, the provision or topic, the activity, the facts supplied, the reviewer, the decision, limits and an expiry date. Where guidance is under review, attach that notice and do not treat a proposed position as settled. The consent trail audit is a useful check before a renewal.
England is the operating context, not a shortcut for scope. A buyer with people, suppliers or destinations elsewhere must examine extra territorial questions. For the wider picture, read the rules and ethics guide.
Before you act
- Map each journey step to its regime and named owner.
- Record source, purpose, entities, recipient, retention and deletion route.
- Keep UK GDPR authority separate from every PECR question.
- Note the commencement status of the 2025 Act that you relied on.
- Test admin tasks and consent screens for reasonable adjustments.
- Reopen the decision when purpose, source, join or destination changes.
