Rules and ethics
Part of Newsletter monetisation rules and ethics: a UK map
Subscriber data under UK GDPR, DUAA and PECR, field by field
Map subscriber, customer and affiliate data through UK GDPR, DUAA and PECR controls, with evidence for purpose, suppliers, rights and deletion.
Map personal information by purpose before adding advertising, payment or affiliate tracking to an England newsletter. Subscriber delivery, audience research, direct marketing, transaction administration and measurement are not one undifferentiated purpose.
What to take away
- PECR sits alongside the UK GDPR, so assess marketing separately.
- Name every processor and subprocessor, and record the transfer mechanism.
- Set a retention period or event and a deletion proof for every field.
- Hold launch if list provenance, suppression or deletion cannot be proved.
Use the current legal baseline
The ICO says the Data (Use and Access) Act 2025 amended, but did not replace, the UK GDPR, Data Protection Act 2018 and PECR. Its page was updated on 19 June 2026 after the data-protection provisions came into force. Check the ICO warning on any detailed page because some guidance is still being revised.
That page is titled Data (Use and Access) Act 2025: what does it mean for organisations? It lists concrete changes, including a statutory complaints route with acknowledgement and response duties, recognised legitimate interests for specified purposes, and adjustments to subject access, automated decision-making and international transfers.
UK data-protection law is not England-only. Record establishment, affected people, suppliers and transfer locations. Get specialist advice where another regime may also apply.
Build a field-level record
For email address, name, billing data, reading event, referral identifier and support history, write down:
- source and collection date;
- specific purpose and lawful basis;
- notice version supplied;
- required or optional status;
- recipients and processor roles;
- retention period or event and deletion proof;
- rights and complaint route.
Apply the ICO's data-minimisation guidance to each field. The guidance is titled A guide to the data protection principles: data minimisation. Do not retain granular engagement data merely because a supplier collects it.
Worked example for email address, reading event and referral identifier:
| Field | Source | Purpose and basis | Notice version | Retention | Deletion proof |
|---|---|---|---|---|---|
| Email address | Sign-up form | Delivery; consent or contract | Notice v2.3, May 2026 | Subscription plus 24 months | Suppression entry and deletion log |
| Reading event | Email pixel | Measurement; legitimate interests | Notice v2.3, May 2026 | 13 months rolling | Monthly purge record |
| Referral identifier | Affiliate link | Attribution; legitimate interests or consent | Notice v2.4, June 2026 | 13 months | Network deletion confirmation |
Treat these periods as typical, not fixed. Retention logic: email address runs from subscription end plus a grace period; reading events use a rolling window; referral identifiers follow the affiliate network's reporting cycle.
Assess marketing separately
The lawful-basis decision under UK GDPR does not by itself answer PECR. The ICO's electronic-mail guidance distinguishes types of subscriber and routes such as consent or the conditions for a soft opt-in. Record the exact sign-up action and suppression evidence.
The guidance is titled Guidance on direct marketing using electronic mail. Soft opt-in scenario: a reader buys a paid report and gives an email address. You may email similar reports only if the address came from that sale, the marketing concerns similar products, and you offered an opt-out when you collected the address and in every message.
Research participation, editorial delivery, service notices and commercial email need separate definitions. Do not convert an interview address into a promotional list. If a pixel, cookie or similar technology stores or accesses information on equipment, add a distinct PECR review rather than hiding it in the email consent field.
Control suppliers and transfers
Decide who determines purposes and means. The ICO states that processing by a processor requires a binding controller-processor arrangement. Record subprocessors, instructions, security, assistance, audit evidence, retention, return and deletion. The cited page is under DUAA review, so the reviewer must verify its current version.
A sample clause, for illustration only: the processor shall process personal data only on the controller's documented instructions. It shall apply the security measures in the annex, assist with rights requests and breach reports, and delete or return data within 30 days of termination.
Check whether a restricted transfer occurs and who initiates it. Supplier headquarters alone do not answer that question. Keep the transfer mechanism and assessment with the actual data path.
International transfers: name the mechanism. The International Data Transfer Agreement (IDTA) applies where the UK exporter and the importer are not covered by UK adequacy regulations and you are not using the EU clauses with the UK Addendum.
The Addendum to the EU standard contractual clauses applies where you are already using the EU clauses and need to extend them to UK transfers. Keep a transfer risk assessment with the signed mechanism.
Affiliate networks: decide whether the network is a separate controller or your processor. A network that sets its own tracking purposes is likely a separate controller, so you need a joint or separate arrangement and a lawful basis of its own.
Prepare rights and complaints work
Publish a route through which a person can ask about use of their information, exercise applicable rights or complain. The ICO's organisational DUAA overview describes the complaints-process changes that were in force by 19 June 2026, including an electronic route, acknowledgement and response duties.
The ICO describes a duty to acknowledge a complaint within 30 days and to provide a substantive response without undue delay and within three months.
Log receipt, identity checks, scope, searches, decision, communication and closure without placing unnecessary personal material in a general support queue. Keep marketing suppression working even when other customer records are later deleted. Test how the team finds data held by its mail, payment, analytics and support suppliers within the required response process.
Test rights and failure routes before launch
Use synthetic records to test access, correction, suppression, export, cancellation and deletion. Limit administrator privileges, protect accounts, keep recovery copies controlled and assign breach escalation. NCSC's small-organisation cyber guidance is operational advice, not a guarantee.
Hold launch if the team cannot prove list provenance, distinguish purposes, honour suppression, name its processor roles or delete according to policy. A successful send and unsubscribe click do not validate the full data lifecycle.
Before you act
- Map each field to a specific purpose and lawful basis.
- Apply data minimisation to every field you hold.
- Assess PECR separately from the UK GDPR lawful basis.
- Record controller-processor arrangements and subprocessors.
- Publish a rights and complaints route.
- Test access, correction, suppression, export and deletion with synthetic records.
Common questions
What did the Data (Use and Access) Act 2025 change?
It amends the existing framework. The ICO page linked in the baseline section lists the changes, including the statutory complaints route and recognised legitimate interests. Check that page for the current position because some guidance is still being revised.
Does a valid UK GDPR lawful basis cover email marketing?
No. PECR applies separately. The electronic-mail guidance, linked above, sets out consent and the soft opt-in conditions.
What must a controller-processor arrangement cover?
The ICO's controller-processor page, linked above, states that a binding arrangement is required. Cover subprocessors, instructions, security, assistance, audit, retention and deletion. Verify the page because it is under DUAA review.
