Customer data platforms rules and ethics: UK guide

Customer data platforms rules and ethics in the UK start with the actual journey: collection, storage or access technology, identity joins, profiles and inferences, analytics, audience activation, communications, supplier access and exit. There is no single UK customer data platform regulation. An organisation operating in England should build a journey table naming each stage, rule, owner and evidence before applying any rule.

This guide reflects sources checked on 6 September 2026. The Data Protection Act 2018, UK GDPR framework and PECR apply across the UK subject to their own scope. The Equality Act 2010 has Great Britain scope, which includes England. CAP rules govern relevant non-broadcast advertising through the UK advertising self-regulatory system. None of these is interchangeable.

The Acts and regulations create binding requirements; ICO guidance explains the regulator’s approach but does not replace the law. Check the applicable law and guidance against the proposed journey, including any relevant commencement provisions, before launch.

What to take away

Start with the statutory record

The Data Protection Act 2018 is primary UK legislation. It sits alongside the UK GDPR as amended. The Data (Use and Access) Act 2025 changed parts of the data-protection and privacy framework, with provisions subject to commencement arrangements. Do not treat a future or transitional provision as settled without checking the latest commencement position.

The statutory record for processing is the record of processing activities required by UK GDPR Article 30. Controllers must keep a written record of their processing activities, including matters such as purposes, data-subject and personal-data categories, recipients, transfers, retention periods where possible, and security measures; processors have a corresponding record-keeping duty for processing carried out on behalf of controllers. Make the records available to the ICO on request.

This internal record is distinct from ICO fee registration. Under the Data Protection Act 2018 and the Data Protection (Charges and Information) Regulations 2018, a controller must pay the data protection fee unless an exemption applies. Check the ICO’s fee guidance and register of fee payers to establish whether the organisation must pay; fee payment does not replace the Article 30 record.

The Privacy and Electronic Communications Regulations 2003 are a separate statutory instrument. PECR Regulation 6 governs storing information, or accessing information stored, on a user’s terminal equipment. It generally requires clear and comprehensive information and the user’s consent, except where the activity is solely for transmitting a communication or is strictly necessary to provide a service the user has explicitly requested. A UK GDPR lawful-basis analysis does not replace this PECR assessment, and a consent flag does not explain what a person agreed to, for which technology, channel, party or purpose.

For electronic-mail direct marketing, PECR Regulation 22 generally requires prior consent for messages to individual subscribers. The limited “soft opt-in” can apply to an organisation’s own similar products or services when contact details were obtained during a sale or negotiations for a sale, and the person was given an opportunity to refuse at collection and in each message. Assess the conditions for the actual audience and message rather than treating a platform’s consent field as proof.

Use the current ICO guidance on direct marketing and storage and access technologies as practical interpretations of the rules. Guidance is not legislation, and it does not make a journey compliant by itself; check that it applies to the actual technology, channel and purpose.

Define the journey before applying a rule

Build a table that names the source system, person or organisation represented, collection event, identifiers, join method, resulting profile state, inference, analytics output and activation destination. Record the owner, purpose, authority, retention and deletion route for every step.

Keep adjacent functions separate. CRM stores relationship records; a warehouse or lake may support many purposes; identity resolution proposes links; consent and preference management records choices; tag management controls technologies; analytics describes events; activation passes audiences or instructions. A product may combine these. Capability does not prove that any input, match or output is lawful.

The ICO's data-protection principles guidance provides a UK regulator starting point for purpose limitation, minimisation, accuracy, storage limitation and security. A qualified reviewer must apply those principles to the specific facts rather than approve a category called CDP.

Identify people, purposes and authority

For each processing activity, state the purpose clearly and list only the data needed for it. Preserve provenance and uncertainty for an inferred identity or attribute. An audience label should not be treated as a verified fact about a person. Ethical review should also ask whether profiling is fair, proportionate and reasonably expected, and whether sensitive inferences or exclusion could harm people; lawful processing alone does not make every use fair.

Transparency must describe material sources, purposes, recipients and rights in a form appropriate to the real journey. UK GDPR Articles 13 and 14 set information duties for data collected from the person and data obtained from elsewhere. The ICO page on privacy information is marked under review because of DUAA changes. That status is a trigger to recheck, not permission to omit information.

Do not choose a lawful basis generically. Record the proposed basis, purpose, evidence, necessity and reviewer decision by activity. PECR consent or an exception, where relevant, is a separate question. Research participation, service messages, public advertising and promotional electronic communications must not be collapsed into one permission.

UK GDPR Article 6(1) lists the lawful bases: consent; performance of a contract or steps requested before entering a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest or exercise of official authority; and legitimate interests pursued by the controller or a third party, subject to the rights-and-freedoms balance. Choose and document the basis for each purpose before processing. For legitimate interests, assess necessity and balance the interests against the person’s rights and freedoms; consent must meet the UK GDPR standard and be capable of withdrawal.

Before processing that is likely to result in a high risk to people’s rights and freedoms, the controller must carry out a data protection impact assessment under UK GDPR Article 35. Examples include large-scale processing of special-category data and systematic, extensive evaluation of people based on automated processing that produces legal or similarly significant effects. If a high risk remains after measures to reduce it, Article 36 requires prior consultation with the ICO.

Assign roles by facts

Controller and processor status follows real decisions about purposes and essential means. The ICO's controllers and processors guidance cautions against relying on labels alone. Map the buyer, platform supplier, implementation partner, source system and activation destination separately.

A controller must designate a data protection officer under UK GDPR Article 37 when its core activities involve regular and systematic monitoring of people on a large scale, large-scale processing of special-category data or criminal-conviction data, or when it is a public authority or body (except a court acting in its judicial capacity). Check these criteria against the organisation’s actual core activities; having a privacy contact is not the same as meeting the DPO requirement.

Where an actual processor relationship exists, the ICO's contracts and liabilities guidance sets out the regulator's contract expectations. Legal review must inspect the exact service, instructions, subprocessors, assistance, audit, security, return and deletion. A data-processing addendum cannot authorise a purpose or remedy an inaccurate join.

Remote access and onward recipients can raise international-transfer questions. Under UK GDPR Chapter V, a restricted transfer needs an applicable mechanism, such as UK adequacy regulations or an appropriate safeguard. Safeguards can include the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. The ICO’s international transfers guidance is the current starting point. A supplier’s region label is not proof of where support, subprocessors or replicas can access data.

Design rights and corrections into the system

The journey should show how access, correction, objection, restriction, suppression and deletion move through every copy and destination. UK GDPR Article 12(3) generally requires a response to a rights request without undue delay and within one month; the period can be extended by up to two further months for complex or multiple requests, with the person informed within the first month. The ICO’s individual-rights guidance provides the UK framework. It does not determine an individual request without the circumstances.

Under UK GDPR Article 33, a controller must notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to risk people’s rights and freedoms. If the breach is likely to result in a high risk, Article 34 generally requires communication to affected people without undue delay. A processor must notify the controller without undue delay, and controllers must document personal data breaches.

For example, a suppression flag created when someone objects to direct marketing should remain until that purpose ends, while a raw event log may be deleted once the analytics purpose and any legal need end.

Use authorised fixtures to test a false identity join, corrected attribute, objection, suppression and deletion. Include a later import that might recreate the record. Keep the original request, decision, exception and downstream evidence together. Stop activation if the required state cannot be traced.

Where profiles or inferences inform solely automated decisions with significant effects, check the applicable UK GDPR rules as amended by the Data (Use and Access) Act 2025, including the commencement position and relevant safeguards, before use. Do not assume a marketing score has no significant consequence without analysing its actual use.

Separate advertising from data permission

Audience creation, ad targeting, promotional messages and claims on the resulting advert require separate evidence. The recognisability rules for marketing communications appear in CAP Code Section 2. Section 3 covers misleading advertising and substantiation. CAP is an advertising code, not a data-protection statute.

Before release, preserve the final ad, audience definition, exclusions, source data, targeting settings, material commercial relationship and evidence for each objective claim. A CDP-generated segment does not prove that a claim is accurate or that targeting is permitted. Suppressed, refused and unknown states must remain out of activation where the qualified decision requires it.

Consumer-facing journeys also need a separate consumer-law review. The CMA's unfair commercial practices guidance concerns the consumer-protection regime under the Digital Markets, Competition and Consumers Act 2024. It does not replace CAP, privacy or contract review.

Treat security, accessibility and IP as distinct checks

Restrict administrator and service-account access, retain useful logs, control changes and rehearse incident recovery. UK GDPR Article 32 requires technical and organisational security measures appropriate to the risk. The NCSC’s supplier assurance questions can organise diligence on incidents, audit, data return and deletion; they are not supplier certification.

Test critical configuration, review, correction and export tasks for accessibility. The Equality Act 2010 is primary legislation with Great Britain scope. The exact duties and reasonable adjustments depend on facts, so an accessibility statement or automated scan cannot close the gate.

Data sources and exported lists may involve copyright or database rights. The IPO's database-right guidance distinguishes database rights from copyright. Public availability alone does not establish permission to copy or reuse a dataset.

Make exit part of compliance operations

The contract and operating plan should identify the legal entity, exact service, accepted purposes, data roles, subprocessors, changes, incident assistance, audit, export, retention, deletion and termination. Commercial review must separately cover service scope, fees, tax, renewal, liability, continuity and acceptance.

Before dependence grows, export fictional or specifically authorised records with their provenance, preferences, suppression state, mappings and audit evidence. Attempt a restore outside the service. Stop if essential meaning is lost or deletion evidence is unavailable.

Use a non-compensating release decision

Give each gate its own owner and result: privacy and data protection; PECR; rights and accuracy; advertising and consumer; security; accessibility; IP; commercial contract; export and exit. A pass in one area cannot cancel a hold in another.

Retain the journey version, evidence, reviewer, date, uncertainty and recheck trigger. Changes to purpose, source, join, inference, destination, communication, supplier, subprocessor or ownership reopen the relevant decision. Record the decision for each gate and resolve any outstanding issue before the affected activity goes live.

Before you act

Common questions

What is the first step in applying UK rules to a customer data platform?

Build the journey table described above. The opening paragraph and the journey section set out the fields and owners.

How do controller and processor roles get assigned?

The facts decide roles. The roles section lists the contract points for legal review.

Why is a consent flag not enough for PECR compliance?

The flag has to match the actual technology, channel, party and purpose. PECR consent or an exception is separate from UK GDPR lawful basis.