PPC agencies data protection duties rest on evidence and consent

The proposed audience arrives for review

An agency preparing paid search remarketing and measurement for an advertiser pauses before launch. The proposed audience draws on Google Ads or Microsoft Advertising reporting, the advertiser's CRM, call tracking and offline sales records. The team must establish what each source permits, then test the advertising and written responsibilities.

Each source is traced before the audience is joined

The review follows the information back to its origin because paid search campaigns can draw on distinct datasets. The team considers each source separately, including its lawful basis and retention period, rather than applying one assumption to all information once it has been combined.

The team finds that combining sources into one audience segment may itself create a data-protection risk. If CRM details were collected to fulfil orders, reusing them for paid search remarketing is a different purpose. That use needs assessment before the information is brought into the segment.

Consent evidence determines what can proceed

The reviewers identify a lawful basis for every processing activity under UK GDPR. They consider whether consent applies or whether legitimate interests could support some campaign measurement. If relying on legitimate interests, the agency documents a balancing test.

The team checks the overlap between advertising, data and consumer rules in the PPC agencies UK rules and compliance guide for 2027. PECR applies alongside UK GDPR to electronic marketing. The ICO's step-by-step guide to direct marketing for your small business explains consent and the soft opt-in for existing customers in email and text marketing.

That soft opt-in does not permit paid search remarketing cookies or pixels. Under PECR regulation 6, storing information on a user's device, or accessing information from it through cookies or similar technologies, generally requires prior consent unless an exception applies. Non-essential remarketing cookies and many advertising pixels should therefore remain inactive until consent is given.

The reviewers note that Google Consent Mode, Google Ads Customer Match policies, and Microsoft Advertising's UET consent mode and data terms may affect implementation. None of these tools or policies, by themselves, supplies consent or establishes a lawful basis for the agency's processing.

For UK GDPR consent, Article 7 requires evidence that consent was given and makes withdrawal as easy as giving consent. Article 4(11) requires consent to be freely given, specific, informed and unambiguous. The team keeps the wording and version, when and how consent was obtained, its covered purposes and any withdrawal.

People have an absolute right under UK GDPR to object to processing for direct marketing. When someone objects, the controller must stop using their information for that direct marketing. The reviewers include that requirement in their decision about the campaign data and the processes used to act on objections.

The proposed advert and its ownership are tested

Before release, the agency reviews the paid search copy as well as the audience. ASA guidance on claims, endorsements and testimonials expects evidence to be held in advance, so the team checks claims about results, speed and savings rather than relying on substantiation gathered after publication.

A client testimonial requires permission and must express a genuine view. A percentage uplift or similar performance statement needs a documented source. If the evidence relates to only one account, the advertisement should make that limitation clear to readers.

The reviewers separate data protection from consumer protection. The Consumer Protection from Unfair Trading Regulations 2008 formed the former regime; misleading commercial practices are now governed by the unfair commercial practices provisions of the Digital Markets, Competition and Consumers Act 2024. The Competition and Markets Authority (CMA) is among the bodies enforcing those provisions.

Consumer law requires evidence for green claims, prices and performance statements, while the ASA applies the CAP Code separately. The team treats environmental wording in advertising copy as a claim needing evidence, on the same basis as a price or performance claim.

The contract review establishes whether the advertiser is controller and the agency processor, or whether they are joint controllers, depending on their arrangement. The parties should record the division rather than assume it. Commercial contracts in England describe clauses that allocate data responsibilities between client and agency.

Under UK GDPR Article 28, each controller must have a written contract with every processor. It must describe the processing and require documented instructions, personal data protection, subprocessor controls, assistance with data-subject rights and security duties, as well as return or deletion of information when the service ends.

The record carries the decision into practice

For each source, the agency keeps a decision record rather than a list of rules alone. Its source register identifies the data source, lawful basis, retention period and governing rule, creating an audit trail if a complaint is received.

The register should preserve the evidence supporting decisions. Where required, records of processing under UK GDPR Article 30 must cover purposes, data categories, recipients, retention and security measures. Where the agency relies on legitimate interests, it records the LIA and its conclusion.

The agency also considers whether the processing is likely to create high risk to people's rights and freedoms. In that case, the controller must carry out a data protection impact assessment (DPIA) under UK GDPR Article 35. Remarketing involving tracking, profiling or data matching should be assessed against that threshold, but a DPIA is not automatically required for every campaign.

The team checks whether the agency must pay the ICO data protection fee. Organisations acting as controllers generally have to pay unless exempt, so the agency assesses its own processing and role. The ICO can investigate, issue enforcement notices and impose monetary penalties for breaches; available powers and maximums depend on the breach.

The source register can assess whether each basic control is in place: a named lawful basis for the purpose, privacy information covering paid search, freely given and specific recorded consent, a set and enforced retention period, evidence held before an advertisement appears, and a named owner with a review date. Each criterion uses a score from zero to five.

A score below three on any criterion should prompt review before the source is used. This rubric is illustrative, not a regulatory standard. In the scenario, those results help the team see whether a source can proceed, needs further evidence or should be held back until its use has been properly assessed.

Rules carried forward from the decision

The agency's working rule is to check purpose, lawful basis, notice, consent and retention for every source before combining it with campaign information. It tests advertising claims before publication, records the reasons for its decisions, and puts the division of controller and processor responsibilities in writing.

Usually the advertiser is controller and the agency processor, although joint controllership can arise when both determine processing purposes. CRM information can be used for remarketing only when its original lawful basis and privacy notice cover marketing; otherwise, a new basis or fresh consent is needed.

There is no single statutory period for keeping campaign data. The agency chooses a retention period that matches the purpose and records it in the source register. The CAP Code applies to paid search copy, including claims, endorsements and testimonials, and the ASA can act on complaints.

For an individual case, seek advice from a qualified adviser.