Rules and ethics
Part of UK rules around a web project in 2027, from data protection to employment status
Data duties on a website project, split by purpose, role and technology
Map UK data duties for an England website project by purpose, role and technology, with separate PECR, contract, rights and security evidence.
UK data-protection duties and the Privacy and Electronic Communications Regulations (PECR) attach to facts, not to the phrase website project. Split the work three ways: purpose, role and technology. uk/guidance/data-use-and-access-act-2025-plans-for-commencement) records that most Part 5 data-protection and privacy provisions of the Data (Use and Access) Act 2025 commenced on 5 February 2026.
Section 103 and its related Schedule 10 followed on 19 June 2026 under the sixth commencement regulations.
Use the amended law and current ICO guidance, including any transition or review notice.
What to take away
- Map each processing purpose, party and device operation before agreeing notices, contracts or permissions.
- Roles follow actual purposes and means, so an agency can be controller for its own records and processor for a client's form.
- A UK GDPR lawful basis never replaces a PECR assessment for cookies, pixels, scripts and local storage.
- Processor terms, notices and rights routes must match what the site actually does.
- A finished review leaves a purpose record, signed processor terms, a device-storage inventory and a tested rights route.
Build a purpose-by-purpose record
Give each processing purpose its own row. The row names the people affected, the data categories, the source and the necessity test. It also records the role analysis, recipients and any international transfer.
Research and competitor work needs its own row, and the guide to researching rival agencies shows where the line against hoarding personal data falls.
Illustrative mapping for a small England agency site; the figures are examples, not benchmarks.
Purpose-by-purpose record
| Purpose | Agency role | Lawful basis | PECR trigger | Retention |
|---|---|---|---|---|
| Contact form enquiry | Processor for the client | Client legitimate interests | None, if no script fires on submit | 12 months (illustrative) |
| Site analytics | Processor, sometimes joint | Consent | Consent before non-essential storage | 14 months (illustrative) |
| Agency newsletter | Controller | Consent | Consent where a pixel tracks opens | Until consent withdrawn |
A later marketing purpose should not be folded into a service enquiry. Remove fields that appear only because a template offers them.
Decide roles from decisions
Ask who decides why the processing happens, which records are used, who receives them and how long they stay. ICO (Information Commissioner's Office) controller and processor guidance states that roles turn on actual purposes and means, not contract wording. An agency handling a client's submissions on instruction is a processor there, and a controller for its own payroll.
Where the agency is a processor, the contract must set out documented instructions, confidentiality, security, subprocessors and deletion or return. A label cannot repair conduct that runs outside those instructions.
Give people the right information
Map the collection point and the layered notice for every purpose. A footer link alone seldom delivers timely, clear information at a form or an embedded service. Notice wording should separate the buyer who commissions the work from the people whose data the site collects, the split covered in the audience research guide for a website project.
Define routes for access, correction, objection, erasure and complaint handling. Record which named person answers each route, and within what period.
Inventory cookies, scripts and device access
List every cookie, pixel, script and item of local storage that reads from or writes to a user's device. The ICO's guidance on cookies and similar technologies applies to the actual operation, so a strict-necessity claim needs a purpose that fails without the storage. Consent must be collected before non-essential storage runs.
A data protection impact assessment is a separate step. Treat it as an assessment method for high-risk processing, not as ICO approval.
Example: one contact form mapped
A client's contact form collects name, work email, company and message. It emails the client's sales inbox and keeps a copy in the agency's ticketing tool for 30 days.
One contact form mapped
- Purpose
- handling a sales enquiry.
- Agency role
- processor for the client, controller for its own ticket metadata.
- Lawful basis
- the client's legitimate interests.
- PECR
- none, provided no analytics cookie or pixel fires on submit.
- Retention
- ticket deleted after 30 days, the client copy held on the client's own schedule.
Before you act
- Create one row per processing purpose, with a named owner.
- Remove fields the purpose does not need.
- Sign processor terms covering instructions, confidentiality, security and subprocessors, using the records that keep a commission honest as the checklist.
- Inventory cookies, pixels and scripts before launch.
- Stop production-data use where role, permission or contract cannot be evidenced.
Where duties cannot be evidenced, stop using live data until they can. The review should produce a purpose record, signed processor terms, a device-storage inventory, a tested rights route and a decision log with owner names.
Common questions
How do you decide whether the agency is a controller or a processor?
Look at who sets the purposes and means. A client's instructions on form submissions make the agency a processor for that activity. Its own recruitment or payroll records make it a controller.
Does a lawful basis cover cookies and pixels?
No. PECR adds a separate consent and information duty for storage on, or access to, a user's device. Non-essential cookies need consent before they run.
What should the compliance review produce?
A purpose record, signed processor terms, a device-storage inventory, a tested rights route and a named decision log. A verbal assurance is not evidence.
