Rules and ethics
London food creators: tax and data contract clauses
Food creators in London can use this guide to document tax status, data roles, marketing permissions and retention in restaurant partnership contracts.
What to take away
- Food creators can be self-employed, but HMRC assesses the actual working arrangements; contracts should record substitution, control, mutuality of obligation and financial risk rather than rely on a label.
- Data roles depend on who determines the purposes and means of each processing activity, so contracts should identify the controller and processor.
- Establish a lawful basis before collecting personal data and identify who is responsible for checking the rules for electronic marketing.
- Contracts should allocate responsibility for checking whether an ICO data protection fee is due.
- A written contract clause list covering tax status, data roles, marketing, retention and takedown is the practical minimum.
Why London food creator contracts need tax and data clauses
Food creators and restaurant partners in London can face advertising, tax and data questions. The Advertising Standards Authority guide covers the advertising angle; this article focuses on tax and data clauses for restaurant partnerships.
Two bodies are relevant to these clauses. HMRC decides whether a creator is employed or self-employed for tax, and the Information Commissioner's Office oversees how audience data gathered during a campaign may be used. Neither question is settled by what the contract calls the creator.
A restaurant group that books twenty creators for a menu launch is running a small data operation as well as a marketing campaign. Every booking form, DM thread and tagged post can carry personal data. The commercial contracts explained guide covers the wider deal terms, but tax status and data roles sit underneath them.
Get those two wrong and the campaign cost rises after the food has been eaten: unpaid PAYE, penalty notices, or a complaint about marketing emails sent to a list nobody had consent to use.
Documenting HMRC employment status in creator contracts
HMRC looks at the working relationship, not the invoice. The tests turn on control, substitution, financial risk and whether the engager is obliged to offer work and the creator obliged to accept it.
HMRC tests: employed vs self-employed
Points to self-employed
- Control
- Chooses method and timing
- Substitution
- May send qualified substitute
- Financial risk
- Own equipment and costs
- Obligation
- Can decline work
Points to employed
- Control
- Brand dictates shot list
- Substitution
- Must attend personally
- Financial risk
- Brand covers costs
- Obligation
- Must accept offered work
A creator who must attend a fixed shoot at a fixed time, in a branded apron, with no right to send someone else, looks less self-employed than the contract claims.
The business tax and returns guidance sets out the filing side for anyone trading in the UK. Creators register for Self Assessment, file a return and pay tax on profits. Agencies that pay creators should collect a self-employed status declaration and keep it on file.
For contract drafting, record the agreed VAT treatment and how non-cash benefits will be handled. A restaurant group paying a creator in covers, plus a fee, should record both parts of the arrangement.
Agency and restaurant company checks belong here too. Companies House records show whether the creator trades through a limited company, which changes who is paid and what the contract must say about the intermediary.
Where services are provided through an intermediary, such as a creator's limited company, assess IR35 (the off-payroll working rules) if the creator would have been an employee for tax purposes if engaged directly. The contract should record who is responsible for the status decision and any resulting PAYE and National Insurance obligations.
HMRC's Check Employment Status for Tax (CEST) tool can help assess status. Keep its result with the contract and check that the answers reflect the actual working arrangements.
The four tests in practice
Points to self-employed
- Control
- Creator chooses method, timing and edit style
- Substitution
- Creator may send a qualified substitute
- Financial risk
- Creator bears costs and can profit or lose
- Mutuality of obligation
- Each brief is a separate engagement
Points to employed
- Control
- Brand dictates shot list, hours and captions
- Substitution
- Creator must attend personally
- Financial risk
- Brand covers costs and guarantees payment
- Mutuality of obligation
- Ongoing rota of work with regular pay
No single test decides the outcome. HMRC weighs the whole picture, which is why the contract wording and the actual working day need to match.
Steps to document status
- Record the engagement as a fixed brief with start and end dates, not an open rota.
- State whether substitution is permitted and how a substitute is approved.
- Agree who supplies props, travel and insurance, and who carries the loss if a shoot is cancelled.
- Keep the signed status declaration, invoices and brief together in one file per creator.
- Review the file if the relationship becomes regular, because a rolling retainer can shift the picture.
A creator on a weekly retainer for six months, attending the same kitchen every Tuesday, is a different risk from one booked for a single launch. Contracts should say which one they are.
Documenting audience-data terms in London creator contracts
The UK GDPR and Data Protection Act 2018 set the legal framework for handling personal data in the UK, and the ICO's guidance for organisations explains how to apply it. In a creator campaign, personal data includes giveaway entrants, mailing list sign-ups, tagged diners and the contact details in a booking thread. It also includes audience analytics where individuals can be singled out.
Duties attach as soon as data is collected, not when it is used. That means telling people what happens to their details, keeping the data no longer than needed, and securing it. A creator holding a spreadsheet of competition entrants on a personal laptop is still processing personal data.
London campaigns often run giveaways to drive footfall. The entrant list is the asset the brand actually wants, so the contract should say who may contact those people afterwards and on what basis.
Retention is the quiet failure. A list built for a one-off supper club should not sit in a shared drive three years later. Set a deletion date in the agreement and confirm it in writing.
The data protection duties piece sets out the wider obligations that sit alongside these contract terms.
Controllers, processors and agency relationships
The ICO's controllers and processors guidance explains the split. It is the controller who determines the purposes and means of processing personal data. The processor acts on the controller's instructions.
In a typical London arrangement, the restaurant group or brand is the controller. The agency often acts as a processor for campaign data, and the creator may be a processor for the audience data they collect. Those roles can change mid-campaign, which is why the contract should name them rather than assume them.
Under Article 28 of the UK GDPR, a written data processing agreement is needed whenever a processor handles personal data on a controller's behalf. It must cover the subject matter, duration, nature and purpose of processing, the type of data, and the controller's instructions.
Sub-processors need naming too. If the creator uses an editing platform or a scheduling tool that stores contact details, that tool is a sub-processor and the controller should know about it.
Agency creator agreements should also cover what happens at the end of the campaign: return or deletion of data, and confirmation in writing. The team roles in England article covers who owns which task internally.
Lawful basis and consent for audience data
The ICO's lawful-basis guidance lists six bases under the UK GDPR: consent, contract, legal obligation, vital interests, public task and legitimate interests. For marketing to an audience, consent is often appropriate, but the lawful basis and the rules for marketing are separate requirements. PECR (the Privacy and Electronic Communications Regulations 2003) also governs electronic marketing. Contracts should identify who is responsible for checking the applicable requirements before marketing emails or texts are sent.
Consent is not a checkbox buried under terms and conditions. It needs a clear affirmative action, a record of when and how it was given, and an easy way to withdraw. If the brand later wants to email the same list about a different restaurant, that is a new purpose and usually a new consent.
Legitimate interests can support some processing, such as fraud prevention or basic analytics, but it is a poor fit for unsolicited marketing. A balancing test has to be documented before relying on it, not after a complaint arrives.
Giveaway mechanics deserve attention. Entry should not be conditional on agreeing to marketing, or the consent is not freely given. Separate the two actions in the entry form.
Businesses handling personal data may need to pay the data protection fee. The contract should identify who is responsible for checking whether a fee is due and keeping any required payment current.
The disclosure policy that holds up guide covers how paid partnerships must be labelled alongside these data rules. Running campaigns across several regions without a dedicated compliance lead is covered in UK regulations without a compliance officer.
Clauses to build into a London creator contract
Use this as a drafting checklist before the brief goes out. Each item should appear as a numbered clause with a named owner.
- Tax status and payment.Record whether the creator contracts directly or through an intermediary, the actual working arrangements, any IR35 status determination, VAT treatment, fees and non-cash benefits. Owner: the creator and the brand or agency, with the status decision made by the party responsible under the rules.
- Data roles.Name the controller and processor for each campaign activity, including giveaway entries and mailing lists. Owner: the brand or restaurant group and the agency.
- Processing terms.Set out the controller's instructions, data types, processing purpose and duration, confidentiality, security, sub-processors, and return or deletion of data. Owner: the controller and processor.
- Lawful basis and marketing permissions.Record the lawful basis, consent wording and evidence, and who may send marketing under PECR. Owner: the party collecting the data and the party sending the marketing.
- Security and retention.Specify access controls, how data will be secured, the retention period and how deletion will be confirmed. Owner: each party that handles the data.
- Takedown process.State who can request removal or correction of campaign content, which posts, links or paid promotions are covered, and require the creator to act promptly and confirm completion. Owner: the brand or agency and the creator.
- Changed use and liability.Require a fresh assessment before audience data is reused for a new purpose, and state how claims, costs and liabilities are allocated, including regulatory fines where legally recoverable. Owner: the brand or agency and the creator.
Contract clauses drafting checklist
- Tax statusself-employed declaration and substitution rights
- Payment termsfee, gifted value, VAT, invoicing
- Data rolescontroller, processor, sub-processors named
- Lawful basisconsent wording reproduced in contract
- Retention and deletiondates and written confirmation
- DisclosureASA, CAP Code and CMA wording
- Takedown and auditremoval rights and record inspection
Two clauses are often missed. The first is a change of purpose clause, covering what happens if the brand wants to reuse audience data for a second campaign. The second is an indemnity allocation, setting out who pays if a regulator fines either party.
A worked example helps. A London restaurant group books a creator for a three-week menu launch, paying a fee plus two dinners, and runs a giveaway to collect emails.
The contract names the group as controller, the creator as processor for the entrant list, records consent wording, sets a ninety-day deletion date, and requires the creator to declare self-employed status. Every element maps to a clause above.
