UK advertising, company and data transfer rules for marketing agencies before you sign

What to take away

Most marketing agencies UK regulations sit with the Advertising Standards Authority and CAP codes, the Information Commissioner's Office for data, and Companies House and the Companies Act 2006 for company duties.
The ASA's remit covers ads in paid, own and earned spaces, so a client cannot outsource blame by hiring an agency.
Sending personal data outside the UK needs a lawful transfer mechanism under ICO rules, which matters when an agency uses overseas staff or tools.
Check company records and contract terms before signing, not after a complaint lands.

Which rules apply to an agency in England

England is the jurisdiction where most agency contracts are signed and most complaints are handled, so the practical rulebook is the one enforced here.

An agency contract usually names the law of England and Wales, and the courts of England and Wales, so a dispute is heard here even when the client sits abroad. A company registered in England and Wales files at Companies House in Cardiff, and its filings are open to anyone.

Regulators and what they cover

CAP / ASA

Who writes rules: Committee of Advertising Practice
Who enforces: Advertising Standards Authority
What it covers: Misleading claims, pricing, social
Who is liable: Agency posting for client
How it starts: Complaint, then published ruling

Companies Act 2006

Who writes rules: Parliament
Who enforces: Companies House
What it covers: Filing, reporting, governance
Who is liable: Directors personally
How it starts: Filing history check

Advertising and CAP codes

The Committee of Advertising Practice writes the codes and the Advertising Standards Authority enforces them, as the ASA's account of its regulatory work confirms. The codes cover misleading claims, comparative pricing and social media content. An agency posting on a client's behalf is still bound by them.

3 covers omitting material information. Enforcement usually starts with a complaint, not an inspection. A ruling against a campaign is published, and the reputational cost often outlasts the campaign itself. Sector regulation sits on top: a financial promotion must meet section 21 of the Financial Services and Markets Act 2000 and the FCA's rules on financial promotions.

Company law duties

A limited company must keep accounting records under section 386 of the Companies Act 2006 and file annual accounts under section 441, normally within nine months of its accounting reference date.

First accounts are due within 21 months of incorporation. A confirmation statement must be delivered at least once every 12 months under section 853A. Directors owe the general duties in sections 171 to 177 and are personally responsible for accounts and confirmation statements.

Before appointing an agency, check its filing history through Companies House. A dormant or overdue filer is a warning sign.

Small agencies sometimes trade through a different entity from the one named in the pitch. Ask which company will invoice you, then check that company's record.

Data, transfers and client contracts

Data protection is where agency engagement most often goes wrong, because client lists, CRM exports and campaign data move between systems.

Does the transfer need documenting?

Does the agency access UK personal data from outside the UK?

Yes

Lawful basis and ICO transfer mechanism required

Still confirm where data is stored and which sub-processors are used

UK GDPR and international transfers

If an agency accesses personal data from outside the UK, the transfer needs a lawful basis. The ICO's guidance on international transfers sets out the mechanisms: the International Data Transfer Agreement (IDTA) and the UK Addendum to the EU standard contractual clauses.

Transfers to countries covered by adequacy regulations under section 17A of the Data Protection Act 2018 need no separate instrument. Ask where campaign data is stored and which sub-processors are used before work begins.

Two common gaps: a freelancer based abroad who logs into the client CRM, and a reporting tool that routes data through servers outside the UK. Both need documenting.

Contract clauses that carry legal weight

Indemnities, liability caps, IP ownership and termination rights belong in the written contract, not in a pitch deck. Our guide to marketing agencies commercial contracts in England walks through the clauses buyers most often miss. If a term is unclear, negotiate the change now: after signature, an amendment usually needs the other side's agreement.

When to check, and what to put in place

Most of the checks below use records that are already public, or documents the agency should supply anyway.

Before you sign

Confirm the agency's Companies House registration and latest accounts.
Ask which entity signs, and whether it matches the one you checked.
Get the data processing agreement in writing.
Confirm where personal data will be stored and transferred.
Check who owns creative assets and campaign data on exit.
Agree approval routes for advertising claims.

During and after the engagement

Review performance claims before publication.
Keep records of approvals and briefs.
Re-check transfers if the agency changes tools or staff locations.
Diarise contract renewal and termination notice dates.

For a fuller picture of how the pieces fit together, read our marketing agencies UK rules and compliance guide for 2027, which maps the regulators, codes and contract terms in one place.

This article is general guidance only, not legal advice. Individual cases need a qualified adviser, especially where data transfers, regulated sectors or cross-border contracts are involved.

Common questions

Do the CAP codes apply to an agency's own marketing?

Yes. The codes apply to ads wherever they appear, including an agency's own website and social channels. The ASA enforces them in the same way it does for any other advertiser.

Who is responsible if client data is transferred overseas?

Responsibility is shared. The client remains the controller and must ensure a lawful transfer mechanism is in place, while the agency as processor must follow documented instructions and report breaches.

Is a written contract legally required?

No single statute demands one for every agency engagement, but without written terms, liability, IP and termination are left to default rules that rarely suit either side.

Does England law differ from Scotland or Wales?

Company law is UK-wide: the Companies Act 2006 applies in England, Wales, Scotland and Northern Ireland, and Companies House registers companies in Cardiff, Edinburgh and Belfast. Wales shares the law of England and Wales on contracts, and the ASA and the ICO work UK-wide.

Scots contract law differs on points such as prescription: the Prescription and Limitation (Scotland) Act 1973 sets a five year period for many contract claims. In Northern Ireland, the Department for the Economy holds the consumer law enforcement role.