Rules and ethics
Part of UK paid social agencies: rules and ethics, gate by gate
Rights requests and incidents in a paid social campaign: who acts
Handle data protection rights requests and incidents in a paid social campaign: which party acts, what to preserve, and what to pass on to the others.
A rights request or a data incident in a paid social campaign touches several organisations at once. The advertiser, agency, platform and analytics supplier each hold part of the data, so the first job is to record who decides why each party holds it and who must be told.
What to take away
- Decide before launch which party receives a rights request and how it reaches the others.
- A processor that suffers a breach must inform the controller without undue delay.
- A notifiable breach must be reported to the ICO within 72 hours of becoming aware, where feasible.
- An erasure request goes to each recipient of the data, unless that is impossible or disproportionate.
- Any unresolved purpose, audience source or recipient keeps that processing off.
Name who acts for each party
Roles decide who acts, and roles can differ per operation. In a worked retailer example, the retailer decides the marketing purpose and audience criteria, so it is controller for those operations. The agency uploads the list, sets up ads and reports, so it is processor for the retailer.
| Party | Role in the example | First move when something goes wrong |
|---|---|---|
| Retailer | Controller for the marketing purpose and audience criteria | Decides what is reported and to whom |
| Agency | Processor for list upload, ad set-up and reporting | Preserves the facts and tells the retailer |
| Platform | Controller for ad delivery, optimisation and its own measurement | Responds as controller for those purposes |
| Analytics supplier | Processor for conversion measurement | Tells the retailer without undue delay |
| Agency, own analytics | Controller if it uses campaign data for its own product analytics | Owns the response for that use |
The ICO is the UK-wide data protection regulator, not an England-only body, and there is no separate England-only regulator. The Advertising Standards Authority administers the UK advertising codes for ad content complaints, which is a different route. The wider rules and ethics gates cover the advertising side.
Keep access tight so an incident stays small
Use individual platform permissions, protected recovery, logs and prompt revocation. A shared login cannot show who did what, and access that nobody revokes stays open. These controls let an agency say what happened when the retailer asks.
Identify who can reach the data from outside the UK, because storage location alone does not answer who can remotely access data. An incident plan that names only the storage region misses the people with remote access.
Route a rights request across every party
Maintain one rights route across all parties, including deletion propagation. A request that reaches only the agency still concerns data that the retailer, the platform and the suppliers may hold. Agree in advance who logs the request and who tells the others.
On erasure, UK GDPR expects the controller to tell each recipient of the disclosed data about the erasure, unless that proves impossible or involves disproportionate effort. For a campaign, that means listing every party that received the audience data.
A clean list makes the route short. Before upload, verify provenance and notice, objections, suppression, sharing authority and deletion for a customer-list audience, so a later request finds data with a known source.
A request to stop marketing also touches PECR. Electronic marketing needs a separate check under the ICO's April 2026 electronic-mail guidance, and agreement to research, a download or testimonial reuse does not automatically permit later sales contact.
Preserve, notify and report an incident
Preserve the facts first, then notify the responsible controller immediately. The agency should not decide alone whether a breach is reportable. Logs, timestamps and the list of affected accounts are what the controller needs to make that call.
The ICO's breach page explains the risk assessment and the 72-hour notification window where reporting is required, while warning that the page is under review. A processor that suffers a breach must inform the controller as soon as it becomes aware, and a notifiable breach is reported to the ICO within 72 hours of becoming aware of it, where feasible.
Where the agency is a processor, the contract should carry current Article 28 terms for assistance, deletion or return and audit evidence.
Sign off before launch
Before launch, named counsel signs each role and contract decision, and security signs the access and response route. Any unresolved purpose, audience source or recipient keeps that processing off until the open point is settled.
The ICO's DUAA summary states that all data-protection provisions were in force by 19 June 2026, so check legislation and updated guidance with named UK privacy counsel.
A signed route is only useful if each party knows it. Give the retailer, agency, platform contact and analytics supplier the same one-page route, with a named person for rights requests and a named person for incidents.
Before you act
- List every party for each processing purpose and record its role.
- Name one person for rights requests and one for incidents.
- Use individual platform permissions, protected recovery and logs.
- Agree how an erasure request reaches every recipient of the data.
- Confirm how a processor tells the controller about a breach.
- Keep unresolved purpose, audience source or recipient off.
Common questions
Who tells the ICO about a breach in a paid social campaign?
The controller reports a notifiable breach, so a processor that suffers one tells the controller straight away. The report to the ICO is due within 72 hours of becoming aware of the breach, where feasible.
Does an erasure request reach the platform and suppliers?
Yes, where the data was disclosed to them, unless telling them proves impossible or involves disproportionate effort. List the recipients before launch so the route is ready.
What happens if a purpose, audience source or recipient is unresolved before launch?
That processing stays off until the open point is settled.
