Rules and ethics
Part of Corporate communications and UK law: classify the message before applying a rule
Personal data in corporate communications after the DUAA changes
Map personal data through UK corporate communications, separating UK GDPR, current DUAA changes, PECR contact rules, supplier roles and retention.
What to take away
- The Data (Use and Access) Act 2025 changed UK GDPR, the Data Protection Act 2018 and PECR. All three remain in force for the same message.
- Communications teams now face higher PECR penalties, new cookie exceptions, revised automated decision-making rules and a different complaint route.
- Build one record per purposerole, lawful basis, PECR status, fields, recipients, retention trigger and named reviewer.
- Retention is your decision, not the Act's. Set a trigger, a period and a review date, then hold while any purpose is unresolved.
Which DUAA provisions matter for communications work
The ICO's page The Data Use and Access Act 2025: what does it mean for organisations? was updated 19 June 2026. It states that the Act's data protection provisions are in force, and that it amends rather than replaces UK GDPR, the DPA 2018 and PECR.
DUAA Legal Position Timeline
- 2025Data (Use and Access) Act passed
- 19 June 2026ICO overview updated
- NowAll data-protection provisions in force
- OngoingICO pages under review
Which DUAA provisions matter
| DUAA change | Effect on communications work |
|---|---|
| PECR penalties | The old £500,000 cap for unlawful electronic mail marketing has gone; the UK GDPR maximum applies |
| Cookie exceptions | Some analytics and appearance cookies may be set without consent, subject to conditions |
| Automated decision-making | Automated scoring or audience segmentation faces fewer absolute bans, with safeguards retained |
| Subject access and complaints | The clock can stop for clarification, searches must be proportionate, and complaints normally reach the controller first |
| Recognised legitimate interests | A new list covers crime, safeguarding and emergency processing, which matters in a crisis |
Some ICO pages still carry notices that they are under review. Record the page title, its update date and the date your team decided.
Build one record per purpose
A corporate communication may draw on employee lists, customer records, supplier contacts, journalist details, complaint files and website analytics. Treat each as its own purpose with its own record.
For an employee proposal update, record the employer entity, eligible workers, minimum contact fields, source system, access, response route and retention. Start a separate record for a customer service notice rather than merging the two.
The ICO's Data minimisation guidance sets out the adequate, relevant and limited test. It carries an under-review notice, so read it alongside current legislation.
Example: a service notice and a product email
Cedar Vale Engineering Ltd is a fictional England manufacturer, used here to show the method. No processing or legal assessment has been carried out for it.
Service notice and product email
Lawful basis
- Service notice about a maintenance window
- Legitimate interests or contract, decided on the facts
- Promotional email about a new product line
- Consent, or the soft opt-in for existing customers
PECR position
- Service notice about a maintenance window
- Not direct marketing, so the consent rule does not bite
- Promotional email about a new product line
- Direct marketing under regulation 22
Extra record
- Service notice about a maintenance window
- Privacy information, minimised fields, access log
- Promotional email about a new product line
- Sender identity, opt-out in each message, suppression list
Purpose decides the category, not the wording. A service notice keeps its status if it explains the change and promotes nothing. The six checks in whether content counts as an advert help where a message does both.
The ICO's Guidance on direct marketing using electronic mail, updated 28 April 2026, covers consent, soft opt-ins, subscriber categories and bought lists.
Set retention by trigger, period and review
- Name the trigger that starts the clockcontract end, complaint closure, campaign finish or last reply.
- Choose the shortest period that serves the recorded purpose, and note the reasoning.
- Diarise a review before the period ends, so deletion is a decision rather than a default.
- Delete or anonymise at the end, and record who approved it.
- Keep suppression entries longer than the contact data, because an objection must outlive the record.
| Purpose | Trigger | Period chosen by Cedar Vale |
|---|---|---|
| Employee consultation | Consultation closes | 12 months |
| Customer service notices | Notice sent | 24 months |
| Website analytics | Collection | 14 months |
These periods are policy choices for a fictional company, not legal requirements. No provision of the Act fixes a retention period for communications data.
Hold publication when a purpose, owner or retention trigger is missing. A signed contract, an unsubscribe link or a corporate identity does not repair the gap.
Check supplier roles before you sign
A platform contract cannot settle controller or processor status by vocabulary. Ask who determines the purposes and the essential means, who acts on instructions, which subprocessors are used and where data moves.
Article 28 of UK GDPR requires a written contract with any processor. The ICO's controller and processor guidance sets out the terms and is under review after the DUAA, so verify the wording with a privacy lawyer.
The clauses listed in corporate communications contracts are the ones to read twice before instruction. Confirm who answers rights requests and incident reports.
Common questions
How long may we keep contact data?
No fixed period applies. Decide per purpose under the storage limitation principle, set a trigger and a review date, then delete or anonymise. Suppression lists usually outlive the contact records they came from.
Which DUAA provisions should a communications team check first?
The PECR penalty change, the cookie exceptions, the automated decision-making rules and the subject access and complaint handling changes. The ICO overview tracks commencement as it falls.
Who is the controller for our communications platform?
Whoever decides why and how the personal data is used. Check the Article 28 contract, the subprocessor list and the transfer position before accepting the vendor's label.
Does a service notice need consent?
No, if it is genuinely a service message rather than marketing. Judge purpose from the content, the audience and the outcome the sender seeks, and apply regulation 22 if it promotes something.
