Rules and ethics
Part of PPC agencies rules and ethics: a compliance guide for England
PPC agencies data protection duties rest on evidence and consent
A practical guide to the data and sources behind PPC agencies data protection, including UK GDPR lawful bases, ICO direct marketing rules and ASA evidence standards.
What to take away
- PPC agencies data protection means knowing which lawful basis covers audience and conversion data before a campaign runs.
- The ICO's direct marketing guidance treats consent, legitimate interests and the right to object as live questions, not paperwork.
- Claims and testimonials in paid search need evidence before publication, per the ASA's CAP guidance on claims and endorsements.
- Unfair commercial practices law sits alongside data rules, so misleading ad copy creates a separate exposure.
- Keep a source register that names the rule, the date and the person who checked it.
Where the data actually comes from
Paid search data is rarely one dataset. It arrives from Google Ads or Microsoft Advertising reporting, the advertiser's CRM, call tracking, and offline sales records. Each source carries its own lawful basis and retention period.
Paid Search Data Sources
- Google Ads reporting
- Microsoft Advertising reporting
- Advertiser CRM
- Call tracking
- Offline sales records
Agency teams often merge these into one audience segment. That merge is the point where data protection risk usually appears. If the CRM data was collected for order fulfilment, using it to build a paid search remarketing list is a different purpose.
Lawful bases in practice
UK GDPR requires a lawful basis for every processing activity. Consent is one option, but legitimate interests can cover some campaign measurement where the agency documents a balancing test.
Lawful Basis Decision
Is consent the chosen basis?
Consent must be freely given and recorded
Document a legitimate interests balancing test
For a fuller map of the wider rules, including contract and disclosure duties, see the PPC agencies: UK rules and compliance guide for 2027. It sets out how data, advertising and consumer rules overlap for UK advertisers.
PECR sits alongside UK GDPR and governs electronic marketing. The ICO's step-by-step guide to direct marketing for your small business explains consent and the soft opt-in for existing customers. Read it before building any remarketing list.
Claims and testimonial evidence
Paid search ads include claims about results, speed and savings. The ASA's guidance on claims, endorsements and testimonials requires advertisers to hold evidence before publication.
A testimonial from a client needs permission and must reflect a genuine view. A performance claim such as a percentage uplift needs a documented source. If the source is a single account, the ad should say so.
Consumer law overlap
The Climate Change Act 2008 is not a data statute, but it sits in the same regulatory family as rules prohibiting unfair commercial practices, including misleading advertising in PPC. Green claims in particular attract scrutiny.
Agency teams should treat environmental wording in ad copy as a claim requiring evidence, in the same way as a price or performance claim.
Source register and scoring rubric
A source register is a simple table listing each data source, its lawful basis, its retention period and the rule that governs it. It gives an audit trail if a complaint arrives.
The rubric below helps an agency or advertiser score a source before it enters a campaign.
| Criterion | What good looks like | Score (0-5) |
|---|---|---|
| Lawful basis | Named and documented for this purpose | |
| Notice | Privacy information covers paid search use | |
| Consent quality | Freely given, specific, recorded | |
| Retention | Period set and enforced | |
| Claim evidence | Source held before ad publication | |
| Accountability | Owner named and review date set |
Scores below three on any row should trigger a review before the source is used. The rubric is illustrative and not a regulatory standard.
Contracts and accountability
Data duties usually sit with the advertiser as controller, while the agency acts as processor or joint controller depending on the arrangement. That split should be written into the contract, not assumed.
For how those terms are usually drafted in England, see PPC agencies commercial contracts in England. It covers the clauses that allocate data responsibility between client and agency.
Individual cases need a qualified adviser. This article is general guidance only.
Common questions
Who is the controller when an agency runs paid search?
Usually the advertiser is the controller and the agency is a processor, but joint controllership can arise where both set the purposes of processing. The contract should state the position.
Can an agency use CRM data for remarketing?
The original lawful basis and privacy notice must cover marketing use. If they do not, the agency needs a new basis or fresh consent.
How long should campaign data be kept?
There is no single statutory period. Set a retention period that matches the purpose and record it in the source register.
Do ASA rules apply to paid search ads?
Yes. The CAP Code covers paid search copy, including claims, endorsements and testimonials, and the ASA can act on complaints.
