Rules and ethics
Part of Food influencers: UK partnership rules and ethical practice
Seven data protection duties in food creator partnerships
Seven data protection duties for UK food creator partnerships: lawful basis, privacy notices, consent, records, DPIAs, breach reporting, transfers and retention.
What to take away
- The title promises seven duties. They are lawful basis, transparency, consent, records and DPIAs. The final two are breach reporting and transfer plus retention controls.
- Use real guidance and tools. Examples include ICO fee self-assessment, ICO ROPA template, ICO DPIA template and ICO breach reporting. Also consider IDTA, UK Addendum, CookieYes, OneTrust and Usercentrics. Termly and Iubenda are further options.
- Plan these duties before a campaign goes live, not after a creator posts a diner's image or location.
- This is general guidance only. A qualified adviser should review individual cases.
Duty 1: Choose and record a lawful basis
Before collecting a creator's bank details, address or audience metrics, choose a lawful basis under the UK GDPR. Consent is one option. Contract and legitimate interests often suit paid creator work better.
Choosing a lawful basis
Is the creator paid for work?
Contract or legitimate interests
Consent may be suitable
Record the basis and why it applies. The ICO offers free lawful basis guidance. If you cannot explain the basis in one sentence, the processing is not properly planned. For the wider framework, see Food creator partnerships: UK rules and compliance guide.
Duty 2: Publish clear privacy information
People should know what happens to their data. A creator who films a busy dining room or posts a diner's image is processing personal data. The ICO's online safety and data protection guidance covers platforms and users.
Privacy notice essentials
- Say what happens to personal data
- Cover filming and diner images
- Link from post or profile
- Keep it short and clear
A short privacy notice linked from the post or profile can work. Termly offers a free privacy policy generator and paid plans. Iubenda sells privacy and cookie policy tools, priced by sites and languages.
Duty 3: Capture and honour consent
Where you rely on consent, such as a diner opting in to a restaurant newsletter at a creator event, it must be freely given and easy to withdraw. Do not bundle consent into terms and conditions. Record when and how it was captured.
CookieYes offers consent banners and a cookie scanner, with a free tier for small sites. OneTrust and Usercentrics serve larger organisations, often with quote-based pricing. Check withdrawal routes work.
Duty 4: Keep records of processing
Article 30 of the UK GDPR requires most controllers to keep records of processing activities. The ICO's free ROPA template suits restaurants, agencies and creators who decide why data is used.
Include campaign purpose, data categories, recipients and retention periods. Keep invoices, contracts and payment records with them. GOV.UK's business tax and returns guidance covers tax returns and records. Do not treat data records as separate from finance.
Duty 5: Run a DPIA for high-risk campaigns
A data protection impact assessment is required before high-risk processing. Examples: large-scale filming, location tracking, profiling, sharing diner data with several sponsors.
The ICO offers a free DPIA template and screening checklist. Use it to record risks and mitigations.
If you cannot reduce a risk, consult the ICO before the campaign. Simple processing allows a short DPIA. Review it when the campaign changes.
Duty 6: Report qualifying breaches within 72 hours
If a personal data breach risks people's rights, report it to the ICO within 72 hours of becoming aware. The ICO offers breach reporting guidance and a reporting form.
The ASA can sanction advertisers when advertising rules are broken, and its sanctions page explains options including naming advertisers. Data breaches sit with the ICO, so a campaign can face both regulators; keep an incident log and a named contact.
Duty 7: Manage international transfers and retention
If a creator or agency stores data outside the UK, check transfer rules before the campaign starts. The ICO's International Data Transfer Agreement (IDTA) and UK Addendum to EU standard contractual clauses are free tools. They suit UK controllers sending personal data to countries without adequacy regulations.
Set a retention period for entries, images and audience data. Delete what you no longer need. State in the contract who deletes campaign assets and when. See Food creator partnerships UK regulations for related advertising duties.
Common questions
Does a food creator need a privacy notice?
If a creator collects or shares personal data, such as diner images or email sign-ups, they should tell people what happens to it. A short, plain notice linked from the post or profile is usually enough.
Who is responsible if a campaign mishandles data?
Responsibility depends on who decides how the data is used. A restaurant that sets the purpose is usually the controller, while an agency or creator may act as a processor. Contracts should state this clearly.
Do data rules apply to free meals as well as paid posts?
Yes. Payment is not the trigger. If personal data is collected, stored or shared, the rules apply whether the creator was paid or received a complimentary meal.
What happens if a partnership breaks the rules?
The ASA can sanction advertisers, and the ICO can act on data breaches. Penalties vary with the breach. Take advice before responding to a regulator.
