How does copywriting services data protection law apply to client copy?

What to take away

Where personal data enters copywriting work

Data protection risk sits in the material collected to write the words: briefs, interview notes, screenshots and named testimonials.

The UK GDPR guidance and resources published by the ICO explain how personal data relates to an identified or identifiable living person. The UK GDPR and the Data Protection Act 2018 form the core UK framework; a named customer quote or an email address in a case study can both be personal data.

A brief often arrives with a CRM export attached, holding more personal data than the finished article will. Ask for the fields you need.

For each purpose, identify and document an Article 6 lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent is not automatically the right choice for a testimonial; if you rely on legitimate interests, record the balancing assessment and consider the person's expectations and rights.

If notes reveal health, racial or ethnic origin, religious beliefs or other special category data, do not treat it as ordinary personal data. You need an Article 9 condition as well as an Article 6 basis, so avoid collecting it unless it is necessary.

There is no single retention period for every project. Set a review or deletion trigger that reflects the purpose, such as project closure, and keep material only while it is needed for that purpose or a documented legal or contractual need; record the decision in the commercial contracts you issue.

Work out each party's role from what it actually does. A client that decides why and how source material is used is generally the controller; a copywriter handling it only on the client's documented instructions may be its processor, while using data for the agency's own accounts can make it a controller for that separate purpose. If the supplier is a processor, written processor terms or a data processing agreement must meet UK GDPR Article 28; where both parties decide purposes and means, assess whether joint-controller responsibilities apply.

What counts as personal data in a case study

Redaction is not enough. A job title, an employer and a small team can identify someone between them, so check the combination.

How to record consent that survives an audit

Store the date, the wording the person agreed to and the channel they used. A verbal yes in a project file is weaker evidence than a reply that still exists.

Keep personal-data duties separate from claim checks

The Consumer Protection from Unfair Trading Regulations 2008 are a separate consumer-protection regime, not the core rules for handling personal data. They prohibit misleading actions, misleading omissions and aggressive practices in business-to-consumer trading.

Even accurate marketing copy can disclose personal data inappropriately if there is no lawful basis or the use goes beyond what people were told. Remove direct identifiers and check whether the remaining details, taken together, could still identify someone.

Treat unauthorised access, loss or disclosure of personal data as a possible breach. A processor should alert its client without undue delay; the controller must assess whether the ICO needs to be notified and whether affected people need to be told.

A privacy notice should explain why personal data is used, the lawful basis, who receives it, how long it is kept and the rights people can exercise. Make sure the notice reflects the actual handling of briefs, recordings, drafts and case-study material.

Contract and operational duties

Confirm who approves the final wording and who is responsible for each use of personal data. Client sign-off does not by itself settle the parties' controller or processor roles, so record those responsibilities in the project paperwork.

If the agency acts as a controller, check whether it must pay the ICO fee and appear on the ICO's register. A fee exemption may apply, so use the ICO's fee self-assessment to check the agency's position.

People have rights including access (often called a subject access request or DSAR), rectification, erasure, restriction and objection; portability applies in some circumstances. Have a route to identify and log requests, and pass a request to the controller promptly if the agency is handling the data as a processor.

An image licence, font or stock-asset permission does not by itself settle the privacy position for an identifiable person shown in the material. Check whether people can be identified, how they were told their image would be used, and which party will handle objections or removal requests.

Separate consumer-copy checks

Common questions

Do I need a data protection officer to run copywriting services?

A DPO is not automatically required for a small agency. UK GDPR requires one for public authorities and for organisations whose core activities involve large-scale regular and systematic monitoring or large-scale processing of special category or criminal-offence data. Even without a DPO, keep a privacy notice and a record of what you hold.

Can I publish a testimonial without written consent?

The case-study guide covers publication choices. Written consent is not the only possible lawful basis, but you must identify a valid basis for using the person's data; if relying on consent, record it and make sure it is informed, specific and freely given. If relying on legitimate interests, document the assessment and consider the person's expectations and rights.

How long should I keep interview recordings?

There is no universal retention period for interview recordings. Set a review trigger, such as project closure, then delete the recording when it is no longer needed for the stated purpose or a documented legal or contractual need; explain the approach in your privacy notice.

Do the 2008 Regulations cover business-to-business copy?

Mostly they protect consumers. Business-facing work can still fall under advertising codes or contract law, so do not assume a claim is unregulated because the reader works for a company.

This guide is general guidance for England; check devolved rules if you trade in Scotland, Wales or Northern Ireland. Individual cases need a qualified adviser.