Rules and ethics
Part of How to keep a talent agency compliant with UK rules and ethics
Check how talent agencies data protection duties apply to your roster
A practical England guide to talent agencies data protection: controller roles, lawful bases, PECR email rules, ASA disclosure and copyright licences.
What to take away
- Decide who the data controller is before you sign a roster contract, because that answer shapes every privacy notice.
- Give each processing purpose its own lawful basis and a retention rule you could explain to a regulator.
- Treat newsletter and email monetisation as direct marketing, so read the ICO guidance before you send.
- Substantiate and label paid partnership claims, because ASA CAP rules apply.
- England agencies work inside a UK-wide framework; individual cases need a qualified adviser.
Start with the controller question
Data protection duties follow control, not job titles. An agency that decides why creator data is held, and how long for, is usually the controller. Where the creator makes those decisions too, the two may be joint controllers. UK GDPR and the Data Protection Act 2018 apply across the UK, so an England agency working with a Scottish creator faces one framework. Put the roles in writing.
Map the data a roster actually creates
A roster generates more personal data than most agencies expect: creator contact records, brand buyer details, payment data and audience analytics exported from platforms. Each set has a purpose and a lifespan. Most organisations are expected to keep a record of processing, and a one-page map per roster type is enough to start. The wider talent agencies UK rules and compliance guide shows how this sits with other duties.
Give each purpose a lawful basis
Pay and expenses rest on contract. Brand outreach usually rests on legitimate interests, so write the balancing test down. Audience newsletters rest on consent. If a creator shares health or sexuality details, you also need an Article 9 condition. One consent clause in a management contract will not cover all of that.
Handle creator and audience data separately
Audience data exported from platforms is often pseudonymised rather than anonymous. Matching it back to individuals creates fresh risk and fresh duties. Keep audience datasets in a separate store from creator and brand contacts, limit who can join them, and set a deletion date. Retention should be a period you can justify.
Keep email marketing inside PECR
The Privacy and Electronic Communications Regulations sit alongside UK GDPR for electronic mail. The ICO's guidance on direct marketing using electronic mail explains consent and the soft opt-in. That opt-in can apply where you collected an address during a sale or negotiations and offered an opt-out at the time. A bought list will not pass that test.
Substantiate claims and label endorsements
Advertising rules reach creator content as much as broadcast ads. The ASA's guidance on claims, endorsements and testimonials covers substantiation and the duty to identify marketing. An agency can build the check into its booking form: evidence file, disclosure wording, and a named sign-off. Our talent agencies disclosure policy in England guide sets out that wording.
Protect the work you licence
Copyright in a video, script or photograph normally belongs to the creator who made it. Agencies often license that material to brands, so the licence should be written and narrow. GOV.UK's copyright guidance explains ownership of original works and how rights can be transferred.
Glossary
- Controller: the organisation that decides why and how personal data is used.
- Processor: a supplier handling personal data on a controller's instructions.
- PECR: rules on electronic marketing, cookies and communications networks.
- Lawful basis: the Article 6 UK GDPR reason for processing.
- SAR: a subject access request asking what you hold about someone.
Common questions
Do we need to pay the ICO data protection fee?
Most organisations processing personal data as a controller must pay an annual fee unless an exemption applies. Check the ICO registration service for your tier.
How long can we keep a creator's contact details?
There is no fixed number in law. Set a period tied to the purpose, such as six months after a contract ends for a dormant contact, and delete on schedule.
Who is liable if a brand mishandles audience data?
Liability follows the controller and processor roles in your contract and the facts of the transfer. If you shared data without a lawful basis, the agency's exposure is real. Take advice on the specific arrangement.
Can we email brand contacts without consent?
The soft opt-in may cover existing clients and people in active negotiations, provided you offered an opt-out when collecting the address and in every message. Cold lists need consent.
