Personal data in corporate communications after the DUAA changes

Start with the data journey, not a preferred lawful basis. A corporate communication may use employee lists, customer records, supplier contacts, journalist details, analytics, complaints or access logs. Each purpose needs its own role, source, fields, recipients and retention.

The example is Cedar Vale Engineering Ltd, a fictional England manufacturer considering a site consolidation. No processing or legal assessment occurred. Sources were checked on 6 September 2026.

Record the current legal position accurately

The Data (Use and Access) Act 2025 amended UK data law. The ICO's DUAA overview, updated 19 June 2026, states that all its data-protection provisions are now in force. It also says DUAA amends rather than replaces UK GDPR, the Data Protection Act 2018 and PECR.

That does not settle a communication's lawful basis or PECR status. Detailed ICO pages may still carry notices that they are under review following DUAA. Record the exact page, update date, decision date and named privacy reviewer.

Draw one factual data map per purpose

For an employee proposal update, list the employer entity, eligible workers, minimum contact fields, source system, access, response route and retention. For a customer service notice, create a separate record. Do the same for media contacts, website analytics and complaint evidence. Do not join them merely because the communications team can access each system.

The ICO's data-minimisation guidance describes the adequate, relevant and limited principle. Its page is under review, so use it with current legislation and qualified advice. Remove fields that do not serve the recorded purpose.

Keep UK GDPR and PECR questions separate

A message can involve personal-data processing even when PECR's marketing provisions do not apply. Conversely, electronic-mail rules turn on message purpose and subscriber type rather than the writer's label. The ICO's electronic-mail marketing guidance was updated 28 April 2026. It addresses consent, soft opt-ins, subscriber categories, bought lists and publicly available contact details.

Cedar Vale should classify service, employee, regulatory and promotional content independently. If the communication is direct marketing, record sender or instigator, consent or other applicable route, identity, objection method and suppression. Do not reuse a research participant, journalist or customer contact for promotion without a fresh, documented assessment.

Establish actual supplier roles

A platform contract cannot decide controller or processor status by vocabulary alone. Inspect who determines purposes and essential means, who acts on instructions, which subprocessors are used, where data moves and who answers rights or incident requests.

The ICO's controller and processor contract guidance describes Article 28 contract and subprocessor arrangements. It is under review because of DUAA. A privacy lawyer must verify the current requirement and Cedar Vale's real facts before instruction.

Close the record properly

The evidence pack should include source, purpose, role analysis, lawful-basis decision, PECR classification, privacy information, minimised field list, recipient, access log, security control, transfer review, retention, objection and suppression, correction, complaint, export and deletion. Employee confidentiality and monitoring questions stay separate.

Any missing owner or unresolved purpose means hold. A contract, unsubscribe link or corporate identity does not compensate for another failed gate. Publication requires current ICO and legislation checks plus named privacy, PECR, employment, security and legal approval.