How buyers can check agency data protection

What to take away

Who is accountable when an agency processes client data?

Both parties carry duties. The client is usually the controller and decides why data is processed. The agency is usually the processor and acts on documented instructions.

That split matters when something goes wrong. The agency must tell the controller without undue delay, and the controller decides whether to notify the ICO. Agencies that also run their own marketing lists may be controllers for that data.

A written contract should set out the subject matter, duration, nature and purpose of processing, plus the types of personal data involved. Our guide to commercial contracts with agencies in England covers the clauses buyers should check before signing.

Which lawful basis covers agency marketing work?

Consent suits newsletter sign-ups and retargeting audiences. Legitimate interests can cover limited B2B outreach, but the agency must document a balancing test.

Contract covers processing needed to deliver the service itself. Legal obligation covers tax and payroll records. Special category data, such as health information, needs an extra condition.

For example, an agency running a client's email programme might rely on consent for consumer sends and legitimate interests for a small B2B list. Both choices belong in the record of processing activities.

How does the ICO breach reporting duty work?

A personal data breach means any security incident leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data. It is broader than a hack.

Agencies should have a route to report a breach to the ICO and a parallel route to tell the affected client. Reporting thresholds and deadlines depend on risk, so escalate early rather than deciding alone.

Keep a breach log even for incidents you decide not to report. Regulators ask for it, and it shows a working process.

How can a buyer check an agency's use of campaign data?

Ask which personal data a campaign uses, why it is needed and which lawful basis the agency or client relies on. The stated purpose and basis should be reflected in the record of processing activities.

Where case studies, testimonials or performance claims use personal data, check that use is covered too. This is separate from whether the claim itself is accurate.

Ask the agency to explain how it records the purposes and lawful bases for campaign data, and who is responsible for keeping those records current.

What should buyers ask about data collected during SEO work?

An SEO audit that scrapes personal data from a forum or directory can create a data protection issue even if the crawl itself is permitted.

Ask whether the audit collects personal data, why it is needed, where it will be stored and how long it will be kept. The agency should be able to explain how the work fits its documented processing purposes and lawful basis.

Agree these points before the audit starts, and confirm who handles any request or incident involving the data.

How can a buyer verify the answers independently?

Start with the ICO's register of fee payers. Every organisation that processes personal information must pay a fee to the ICO unless it is exempt, and anyone can search the register to see whether an organisation is registered. Ask the agency for its registration reference and search by that reference. The register entry shows the date registered and the registration expiry, so a lapsed entry is easy to spot.

For security, ask whether the agency holds Cyber Essentials certification. The National Cyber Security Centre describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes, aligned to five technical controls. A certificate is evidence a buyer can check, rather than a promise in a pitch.

If campaign data leaves the UK, for example to an ad platform or a sub-processor abroad, ask which safeguard covers the restricted transfer. The ICO has issued two sets of standard data protection clauses for restricted transfers: the International data transfer agreement (IDTA) and the Addendum to the EU standard contractual clauses. The EU clauses are not valid on their own for restricted transfers under the UK GDPR, so an agency relying on them should point to the Addendum.

Finally, ask how the agency would help the client answer a subject access request about campaign data, how long it keeps that data, and where its privacy notice describes the processing. Clear, specific answers matter more than a long policy document.

What should a buyer check before appointing an agency?

Ask the agency to identify whether it is acting as controller or processor for the work. Request its data processing agreement and record of processing activities, and confirm the name of the person responsible for data protection and the written breach escalation route.

Check that the agency can explain its lawful bases for the processing, and ask for its list of sub-processors. Sub-processors need their own contracts and, often, client approval.

For a wider view of the duties that apply across the UK and where England differs, read our UK rules and compliance guide for agencies. It maps the regulators and the paperwork a buyer should expect.

Finally, confirm professional indemnity and cyber insurance cover, and diarise a review at contract renewal.

Common questions

Does the UK GDPR still apply in England?

Yes. The UK GDPR and the Data Protection Act 2018 apply across England, Scotland, Wales and Northern Ireland. The ICO regulates them.

How quickly must a breach be reported?

Where a breach is likely to risk people's rights and freedoms, the controller must report it to the ICO within 72 hours of becoming aware. Agencies should escalate to the client immediately.

Can an agency use client data for its own marketing?

Only with a lawful basis and clear disclosure. Using client data for unrelated purposes without consent or a documented legitimate interest is risky.

Who is liable if an agency mishandles data?

The controller carries the main accountability, but processors can be liable for breaches of their own obligations. Contracts should allocate responsibility clearly.