Rules and ethics
Part of UK rules for finance creators in 2027, kept as five separate questions
Data protection for finance creators, mapped by purpose, basis and deletion point
Map finance creator data use in England by purpose, lawful basis, notice, minimisation, supplier contract, marketing rule and deletion point.
Finance creators data protection starts with a map of what personal information enters the work and why. Newsletter addresses, enquiry messages, audience research, lead forms, competition entries and analytics identifiers should not be placed under one vague consent statement.
The applicable framework is UK-wide: the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations. The Data (Use and Access) Act 2025 amended those rules. This guide was checked on 5 September 2026 and needs qualified privacy review for the real processing.
What to take away
- Map each use of personal information to a purpose, lawful basis and deletion point before processing begins.
- Tell people about sponsor transfers and recipients at the collection point, not in general site terms.
- Collect only the financial detail the purpose needs, and restrict access to what is held.
- Put supplier roles, security, transfers and deletion duties in a written contract.
- Treat electronic mail marketing as a separate rule set under PECR, with its own consent and opt-out checks.
Give each use a purpose and basis
List the information, person affected, source, purpose, recipient, storage location and deletion point. Decide who is controller, joint controller or processor. A sponsor that chooses how lead data will be used may have a different role from a supplier that follows documented instructions.
The ICO's updated lawful-basis guide says the basis should be chosen before processing and recorded. No basis is automatically better. If the purpose changes, the original decision may need reassessment. The linked ICO page is named 'A guide to lawful basis'.
A worked example of a completed data map:
| Information | Purpose | Basis | Recipient | Deletion point |
|---|---|---|---|---|
| Newsletter email address | Send weekly money tips | Consent | Email service provider | Until unsubscribe plus 30 days |
| Enquiry message | Answer reader question | Legitimate interests | None | 12 months after last reply |
| Competition entry | Run prize draw | Consent | Prize fulfilment firm | 90 days after winner announced |
| Sponsor lead data | Share with sponsor for follow-up | Consent | Named sponsor | 12 months after collection, unless contract says otherwise |
| Analytics identifier | Measure page use | Consent or legitimate interests | Analytics provider | 14 months |
Tell people what will happen
Put the privacy information beside the collection point or provide a clear layered route to it. The ICO lists the information that may be required in a privacy notice, including identity, purposes, lawful basis, recipients and transfers where applicable. The linked ICO page is named 'What privacy information should we provide?'.
Do not bury a sponsor transfer in general site terms. If a reader's details will move to a financial firm, state the recipient or category, purpose and relevant choices before submission. A disclosure that content is an advertisement is not a privacy notice.
Data-subject rights include access, rectification, erasure, restriction, objection and portability. Tell people how to exercise them. Report a personal data breach to the ICO within 72 hours where it risks rights and freedoms.
Collect less financial detail
Ask whether the editorial or commercial purpose can be achieved without balances, account numbers, debts, health information or free-text money stories. The ICO's data-minimisation guidance says personal information should be adequate, relevant and limited to what is necessary. The linked ICO page is named 'Data minimisation'.
Avoid using real financial accounts in content tests. Redact unsolicited details from working notes where the agreed process allows. Restrict access and keep each record only to the deletion point shown in your map.
Put supplier roles in writing
Email, analytics, research and fulfilment suppliers can process personal information. The ICO's detailed page on controller and processor contracts explains when a written contract is required and what it should address. The page is under review following DUAA changes, so recheck it before signing. The linked ICO page is named 'Contracts and liabilities between controllers and processors'.
Record security, subprocessors, international transfers, assistance with rights requests, deletion or return, audit information and incident reporting. A vendor's standard terms do not prove that the chosen configuration is suitable.
Treat marketing as a separate rule set
Electronic mail can include email, text and some direct messages. The ICO's electronic-mail marketing guidance explains PECR alongside data-protection duties and was updated in April 2026. Confirm the subscriber type, sending route, identity and opt-out process. Research participation is not automatically marketing permission. The linked ICO page is named 'Guidance on direct marketing using electronic mail'.
The ICO's DUAA overview says the Act amended rather than replaced the earlier framework and describes newer complaint-handling duties, so use current topic guidance, document decisions and provide a usable privacy complaint route.
Pause a launch when the purpose, recipient, lawful basis or supplier role remains unclear. Data protection cannot be demonstrated by a privacy-policy link alone.
Before you act
- List the information, purpose, recipient and deletion point.
- Choose and record a lawful basis before processing.
- Put privacy information beside the collection point.
- Ask whether the purpose needs the financial detail.
- Record supplier roles, transfers and deletion terms in writing.
- Confirm the sending route and opt-out before marketing.
Common questions
When should a lawful basis be chosen?
The ICO's lawful-basis guide says the basis should be chosen before processing and recorded. No basis is automatically better. If the purpose changes, the original decision may need reassessment, so the choice is not a one-off task.
Does research participation count as marketing permission?
No. The ICO's electronic-mail marketing guidance explains PECR alongside data-protection duties, and research participation is not automatically marketing permission. Confirm the subscriber type, sending route, identity and opt-out process before sending, and treat electronic mail marketing as its own rule set.
