Corporate communications and UK law: classify the message before applying a rule

Corporate communications rules and ethics do not form one UK legal code. The applicable rule follows the organisation, the subject, the recipient, the channel and the purpose. An employee consultation, a member document, a listed-company announcement, a customer promotion and an incident update can use similar words while sitting in different legal and regulatory frameworks.

This guide uses Cedar Vale Engineering Ltd, a fictional manufacturer operating in England. It is considering whether to consolidate one customer-support site into another. The example does not establish that the proposal is lawful, reportable or material. Its communications team may prepare records, but named specialists must decide each legal question.

The legal and guidance sources were checked on 6 September 2026. UK, Great Britain, and England and Wales are not interchangeable. Commencement and regulator guidance can change, so publication remains on hold pending a same-day source check and qualified review.

Classify the communication before applying a rule

Cedar Vale first needs a purpose record. Internal communication may support employee engagement but cannot replace a required consultation. Public relations supplies facts to journalists without controlling independent editorial decisions. Investor relations may involve market rules. Marketing promotes products or corporate aims. Customer service answers an existing service need. Crisis communication operates within incident command. A statutory, regulatory or contractual notice has its own content, recipient and timing.

The record should identify the legal entity speaking, factual owner, intended recipient, reason for contact, channel, source-copy version, territory, decision owner and correction route. It should also say what the communication is not. A label such as "service update" cannot settle whether content is direct marketing, an advertisement or a formal notice.

Employee communication and consultation

The fictional consolidation may affect work location, duties or redundancy risk. Those facts belong to employment review, not message optimisation. Acas states that consultation about contract changes should be genuine and meaningful, with two-way discussion about whether change is needed and what form it should take. Its guidance on consulting over contract changes applies in the Great Britain employment context.

Different facts can trigger different processes. Acas separately explains collective redundancy consultation, including discussion with recognised unions or elected representatives where the statutory route applies. A qualified employment lawyer must decide whether either regime, a collective agreement or another duty applies to Cedar Vale. A staff email, sentiment survey or manager meeting is not proof of consultation.

The employee gate should record what remains open, affected population, representative route, information supplied, views received, response owner and stop condition. Public wording must pause if it presents a proposal as decided before the relevant process permits that conclusion.

Company documents and formal recipients

Routine corporate content is not the same as a Companies Act communication. The Companies Act 2006 extends across the UK, subject to provision-specific scope. Schedule 5 contains rules for documents and information sent or supplied by a company, including electronic and website methods. It does not mean that placing any statement on a website satisfies every company-law duty.

For a formal member, creditor, Companies House or contractual notice, Cedar Vale must identify the exact provision or agreement, authorised sender, prescribed content, eligible recipient, delivery method, date and evidence. The website newsroom and a statutory filing are separate publication states. A corporate lawyer or company secretary should own the classification.

Listed-market disclosure and inside information

Market rules matter only if the entity and financial instrument fall within scope. The FCA Handbook's DTR 2 covers disclosure and control of inside information by issuers within that framework. The FCA's best-practice page on identifying, controlling and disclosing inside information, updated 22 May 2026, is aimed at government departments, regulators and public bodies and expressly says it is not a substitute for independent legal advice.

Neither source shows that Cedar Vale is an issuer or that the proposed consolidation is inside information. If the route could apply, an authorised market-disclosure specialist must assess scope, precision, materiality, confidentiality, timing and release method. The communications team should restrict access and escalate a leak, but it must not infer that a press statement is an acceptable regulatory announcement.

Advertising, endorsements and consumer protection

Some corporate messages contain marketing. CAP Code Section 2 requires marketing communications within its non-broadcast remit to be recognisable as such. Section 3 addresses misleading advertising, including documentary substantiation for objective claims before publication. These are code rules administered in the UK advertising system; the content and placement determine remit.

Consumer law is a separate legal gate. The CMA's unfair commercial practices guidance says the relevant provisions in Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 apply to commercial practices from 6 April 2025. They replaced and updated the Consumer Protection from Unfair Trading Regulations 2008 for those practices. The guidance, last updated 18 November 2025, is not a definitive interpretation of the law.

Cedar Vale should therefore mark every factual and objective commercial claim with its evidence, date, owner and limitation. A testimonial needs provenance, permission and its commercial connection recorded. Paid or controlled content should not be presented as independent editorial opinion. Advertising and consumer specialists must resolve these gates separately.

Personal data, direct contact and DUAA status

Corporate communication can process personal data through employee lists, named customer records, media contacts, analytics, access logs and complaint files. The Data (Use and Access) Act 2025 changed parts of UK data and privacy law. The ICO's DUAA overview was updated on 19 June 2026 to say that all data-protection provisions in the Act are in force. The page also states that DUAA amends rather than replaces UK GDPR, the Data Protection Act 2018 and PECR.

That status must not be shortened to "new privacy law". Cedar Vale needs a data journey for each purpose: controller and processor roles, data source, lawful-basis assessment, minimum fields, transparency, recipient, access, retention, rights, transfers, security, deletion and complaint route. The ICO continues to mark some detailed guidance as under review following DUAA, so a privacy reviewer must check the precise page used for the decision.

Direct contact adds another question. The ICO's electronic-mail marketing guidance was updated 28 April 2026 and explains PECR rules by message and subscriber type. A service, employee or regulatory message may have a different purpose from marketing, but its corporate tone does not decide the classification. The sender must also retain objections and suppression where relevant.

Confidentiality, intellectual property and defamation

Authority to know a fact is not authority to publish it. Drafts may contain employee information, confidential negotiations, security detail or a third party's material. Cedar Vale should record who supplied each quotation or asset, the permitted use, territory, duration, editing authority and withdrawal route.

The Copyright, Designs and Patents Act 1988 is UK legislation covering copyright and related rights. Ownership and permission depend on the work and facts; commissioning content does not justify a blanket ownership assumption. An IP specialist should check text, photography, graphics, recordings, software and licences before release.

Potentially harmful statements about people or organisations need legal escalation. The Defamation Act 2013 principally extends to England and Wales, with limited exceptions identified in the Act. A communications checklist cannot determine meaning, defence, privilege or serious harm. Preserve the source record, pause disputed assertions and route correction or withdrawal to qualified counsel.

Accessibility and equality

An approved message that an affected person cannot use has failed its communication purpose. The Equality Act 2010 applies in Great Britain, although particular provisions and duties depend on the relationship and facts. GOV.UK's accessible communication formats guidance, updated 17 June 2026, is written for government communicators and discusses alternative formats and involving disabled people.

Cedar Vale should not treat that page as a private-sector certificate. Its accessibility and equality owners need to determine applicable duties, user tasks and reasonable adjustments. Test the approved version in each required format, including how a recipient requests help and receives a correction. A PDF export alone is not evidence that the journey works.

Cyber incidents and sector-specific rules

The proposed site change might expose operational details or access credentials if drafts are poorly controlled. The NCSC's effective cyber-incident communications guidance recommends preparation, coordination and accurate information for cyber incidents. Its scope is incident communication, not a universal legal standard for ordinary announcements.

During an incident, the incident commander, security owner, legal adviser, factual owner and communications lead need defined authority. Record what is confirmed, withheld, corrected and time-stamped. A routine content approval must not override containment or regulatory reporting.

Sector rules may add or change duties. A financial firm, healthcare provider, utility, listed issuer or public authority may face specific communication and notification requirements. This guide does not enumerate them because Cedar Vale's fictional sector status is not established. The rule is procedural: identify the regulator and exact instrument before claiming a notice is required or complete.

Contracts allocate work but do not create permission

An agency or software contract should identify parties, authority, scope, deliverables, acceptance, rights, confidentiality, data roles, security, accessibility evidence, subcontractors, correction, fees and VAT, change, liability, termination, export and deletion. Those terms allocate responsibilities between parties. They cannot manufacture a lawful basis, PECR permission, advertising substantiation or market-disclosure compliance.

Where a supplier processes personal data, the ICO's controller and processor contract guidance describes the Article 28 contract requirement and subprocessor arrangements. The page is under review because of DUAA changes. Cedar Vale must verify current text and the parties' actual roles rather than copying a label from the supplier agreement.

Use a non-compensating release record

The final release register should carry one row for each gate:

Gate	Evidence and owner	Status	Stop or escalation
Factual authority	Source, period, claim owner	pass, fail or unresolved	remove, narrow or recheck
Employment	process and employment reviewer	pass, fail or unresolved	hold external wording
Company or market notice	exact provision and authorised owner	pass, fail or unresolved	use prescribed route
Advertising and consumer	classification and claim file	pass, fail or unresolved	relabel, substantiate or stop
Privacy and PECR	data map and qualified decision	pass, fail or unresolved	suppress, minimise or redesign
IP, confidentiality and defamation	permissions and counsel record	pass, fail or unresolved	withhold or escalate
Accessibility and equality	task test and adjustment route	pass, fail or unresolved	provide a usable route
Security and sector	incident and regulator evidence	pass, fail or unresolved	contain and follow exact process
Contract	signed allocation and exit evidence	pass, fail or unresolved	do not instruct supplier

A commercial deadline, supportive executive or favourable risk score cannot offset a failure. The accountable owner may proceed only within the exact approved scope; any change in entity, audience, purpose, claim, channel, territory or source version reopens the affected gates.

This is general information, not legal advice. Publication stays on hold until named UK legal, employment, market-disclosure, advertising, consumer, privacy and PECR, IP, defamation, accessibility and equality, security, sector, contract and tax reviewers sign their own records. A fact-checker must then confirm commencement, territorial scope and regulator guidance on the publication date.