Corporate communications and UK law: classify the message before applying a rule

Corporate communications rules and ethics do not form one UK legal code. The applicable rule follows the organisation, the subject, the recipient, the channel and the purpose. An employee consultation, a member document, a listed-company announcement, a customer promotion and an incident update can use similar words while sitting in different legal and regulatory frameworks.

This guide uses Cedar Vale Engineering Ltd, a fictional manufacturer operating in England. It is considering whether to consolidate one customer-support site into another. The example does not establish that the proposal is lawful, reportable or material. Its communications team may prepare records, but named specialists must decide each legal question.

The legal and guidance sources were checked on 6 September 2026. UK, Great Britain, and England and Wales are not interchangeable. Commencement and regulator guidance can change, so publication remains on hold pending a same-day source check and qualified review.

What to take away

Classify the communication before applying a rule

Cedar Vale first needs a purpose record. Internal communication may support employee engagement but cannot replace a required consultation. Public relations supplies facts to journalists without controlling independent editorial decisions. Investor relations may involve market rules.

Marketing promotes products or corporate aims. Customer service answers an existing need. Crisis communication operates within incident command. A statutory, regulatory or contractual notice has its own content, recipient and timing.

The record should identify the legal entity speaking, factual owner, intended recipient, reason for contact, channel, source-copy version, territory, decision owner and correction route. It should also say what the communication is not. A label such as "service update" cannot settle whether content is direct marketing, an advertisement or a formal notice.

Employee communication and consultation

The fictional consolidation may affect work location, duties or redundancy risk. Those facts belong to employment review, not message optimisation. Acas states that consultation about contract changes should be genuine and meaningful, with two-way discussion about whether change is needed and what form it should take. Its guidance on consulting over contract changes applies in the Great Britain employment context.

Different facts can trigger different processes. Acas separately explains collective redundancy consultation, including discussion with recognised unions or elected representatives where the statutory route applies. A qualified employment lawyer must decide whether either regime, a collective agreement or another duty applies to Cedar Vale. A staff email, sentiment survey or manager meeting is not proof of consultation.

The employee gate should record what remains open, affected population, representative route, information supplied, views received, response owner and stop condition. Public wording must pause if it presents a proposal as decided before the relevant process permits that conclusion.

Company documents and formal recipients

Routine corporate content is not the same as a Companies Act communication. The Companies Act 2006 extends across the UK, subject to provision-specific scope. Schedule 5 contains rules for documents and information sent or supplied by a company, including electronic and website methods. It does not mean that placing any statement on a website satisfies every company-law duty.

For a formal member, creditor, Companies House or contractual notice, Cedar Vale must identify the exact provision or agreement, authorised sender, prescribed content, eligible recipient, delivery method, date and evidence. The website newsroom and a statutory filing are separate publication states. A corporate lawyer or company secretary should own the classification.

Listed-market disclosure and inside information

Market rules apply only if the entity and financial instrument are in scope. The FCA Handbook's DTR 2 covers disclosure and control of inside information by issuers in that framework.

The FCA's best-practice page on identifying, controlling and disclosing inside information, updated 22 May 2026, targets government departments, regulators and public bodies. It expressly states it is not a substitute for independent legal advice.

Neither source shows that Cedar Vale is an issuer or that the proposed consolidation is inside information. If the route could apply, an authorised market-disclosure specialist must assess scope, precision, materiality, confidentiality, timing and release method. The communications team should restrict access and escalate a leak, but it must not infer that a press statement is an acceptable regulatory announcement.

Advertising, endorsements and consumer protection

Some corporate messages contain marketing. CAP Code Section 2 requires marketing communications within its non-broadcast remit to be recognisable as such. Section 3 addresses misleading advertising, including documentary substantiation for objective claims before publication. These are code rules administered in the UK advertising system; the content and placement determine remit.

Consumer law is a separate legal gate. CMA's unfair commercial practices guidance says the relevant provisions in Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 apply to commercial practices from 6 April 2025.

They replaced and updated the Consumer Protection from Unfair Trading Regulations 2008 for those practices.

The guidance, last updated 18 November 2025, is no definitive interpretation of the law.

Cedar Vale should therefore mark every factual and objective commercial claim with its evidence, date, owner and limitation. A testimonial needs provenance, permission and its commercial connection recorded. Paid or controlled content should not be presented as independent editorial opinion. Advertising and consumer specialists must resolve these gates separately.

Personal data, direct contact and DUAA status

Corporate communication can process personal data via employee lists, named customer records, media contacts, analytics, access logs and complaint files.

The Data (Use and Access) Act 2025 changed parts of UK data and privacy law. The ICO's DUAA overview was updated on 19 June 2026: all data-protection provisions in the Act are in force. It states DUAA amends, not replaces, UK GDPR, the Data Protection Act 2018 and PECR.

Do not shorten that status to "new privacy law"; Cedar Vale needs per-purpose data journeys. Cover controller and processor roles, data source, lawful-basis assessment and minimum fields.

Add transparency, recipient, access, retention, rights. Transfers, security, deletion, complaint route matter, and the ICO still marks some detailed guidance as under review following DUAA, so a privacy reviewer must check the precise page used for the decision.

Direct contact adds another question. The ICO's electronic-mail marketing guidance was updated 28 April 2026 and explains PECR rules by message and subscriber type. A service, employee or regulatory message may have a different purpose from marketing, but its corporate tone does not decide the classification. The sender must also retain objections and suppression where relevant.

Confidentiality, intellectual property and defamation

Authority to know a fact is not authority to publish it. Drafts may contain employee information, confidential negotiations, security detail or a third party's material. Cedar Vale should record who supplied each quotation or asset, the permitted use, territory, duration, editing authority and withdrawal route.

The Copyright, Designs and Patents Act 1988 is UK legislation covering copyright and related rights. Ownership and permission depend on the work and facts; commissioning content does not justify a blanket ownership assumption. An IP specialist should check text, photography, graphics, recordings, software and licences before release.

Potentially harmful statements about people or organisations need legal escalation. The Defamation Act 2013 principally extends to England and Wales, with limited exceptions identified in the Act. A communications checklist cannot determine meaning, defence, privilege or serious harm. Preserve the source record, pause disputed assertions and route correction or withdrawal to qualified counsel.

Accessibility and equality

An approved message that an affected person cannot use has failed its communication purpose. The Equality Act 2010 applies in Great Britain, although particular provisions and duties depend on the relationship and facts. GOV.UK's accessible communication formats guidance, updated 17 June 2026, is written for government communicators and discusses alternative formats and involving disabled people.

Cedar Vale should not treat that page as a private-sector certificate. Its accessibility and equality owners need to determine applicable duties, user tasks and reasonable adjustments. Test the approved version in each required format, including how a recipient requests help and receives a correction. A PDF export alone is not evidence that the journey works.

Cyber incidents and sector-specific rules

The proposed site change might expose operational details or access credentials if drafts are poorly controlled. The NCSC's effective cyber-incident communications guidance recommends preparation, coordination and accurate information for cyber incidents. Its scope is incident communication, not a universal legal standard for ordinary announcements.

During an incident, the incident commander, security owner, legal adviser, factual owner and communications lead need defined authority. Record what is confirmed, withheld, corrected and time-stamped. A routine content approval must not override containment or regulatory reporting.

Sector rules may add or change duties. A financial firm, healthcare provider, utility, listed issuer or public authority may face specific communication and notification requirements. This guide does not enumerate them because Cedar Vale's fictional sector status is not established. The rule is procedural: identify the regulator and exact instrument before claiming a notice is required or complete.

Contracts allocate work but do not create permission

An agency or software contract should identify parties, authority, scope, deliverables, acceptance, rights, confidentiality, data roles, security, accessibility evidence, subcontractors, correction, fees and VAT, change, liability, termination, export and deletion. Those terms allocate responsibilities between parties. They cannot manufacture a lawful basis, PECR permission, advertising substantiation or market-disclosure compliance.

Where a supplier processes personal data, the ICO's controller and processor contract guidance describes the Article 28 contract requirement and subprocessor arrangements. The page is under review because of DUAA changes. Cedar Vale must verify current text and the parties' actual roles rather than copying a label from the supplier agreement.

Use a non-compensating release record

The final release register should carry one row for each gate:

A commercial deadline, supportive executive or favourable risk score cannot offset a failure. The accountable owner may proceed only within the exact approved scope; any change in entity, audience, purpose, claim, channel, territory or source version reopens the affected gates.

This is general information, not legal advice. Publication stays on hold until named UK legal, employment, market-disclosure, advertising, consumer, privacy and PECR, IP, defamation, accessibility and equality, security, sector, contract and tax reviewers sign their own records. A fact-checker must then confirm commencement, territorial scope and regulator guidance on the publication date.

Before you act

Common questions

When can Cedar Vale publish wording about the proposed consolidation?

Public wording must pause if it presents the proposal as decided before the relevant process permits that conclusion. The employee gate records what remains open, the affected population, representative route, information supplied, views received, response owner and stop condition. Publication also remains on hold pending a same-day source check and qualified review.

Does a press statement satisfy listed-company disclosure duties?

No. The text says the communications team must not infer that a press statement is an acceptable regulatory announcement. If the route could apply, an authorised market-disclosure specialist must assess scope, precision, materiality, confidentiality, timing and release method. Neither DTR 2 nor the FCA page shows Cedar Vale is an issuer or that the consolidation is inside information.

How should Cedar Vale treat a customer email about the site change?

Direct contact adds another question. The ICO electronic-mail marketing guidance explains PECR rules by message and subscriber type. A service, employee or regulatory message may have a different purpose from marketing, but its corporate tone does not decide the classification. The sender must also retain objections and suppression where relevant.