PR agencies data protection: map media data flows

A media list is not exempt from data protection because its entries concern people's jobs. A named journalist's email, a spokesperson's mobile number and notes about a stakeholder can all be personal data. Public availability also does not settle later use.

This is a practical guide to PR agencies data protection, starting with a specific data flow rather than a generic privacy clause. It covers an organisation operating in England under the UK data-protection framework. It does not assess a real database or provide legal advice.

What to take away

Draw the flow before assigning a label

Map collection, enrichment, selection, contact, monitoring, reporting, correction, suppression, retention and deletion. For each stage, record the data fields, person affected, purpose, system, recipient, geography, owner and evidence.

flowchart TD
 A[Collection] --> B[Enrichment] --> C[Selection] --> D[Contact]
 D --> E[Monitoring] --> F[Reporting] --> G[Correction]
 G --> B
 D --> H[Suppression] --> I[Retention review] --> J[Deletion]

Worked example: a client sets a campaign purpose and audience, then instructs an agency to select and contact media-list entries. If the agency handles those records only on the client's documented instructions, it may be a processor for that activity; if it separately reuses them for a purpose it decides, it may be a controller for that separate processing. Confirm the actual decisions and contract rather than relying on labels alone.

If the chosen media-list or monitoring service is Cision, Muck Rack or Meltwater, record it in the flow and assess access, exports, deletion and any subprocessors. A platform's name does not determine the parties' roles.

The ICO's controllers and processors guidance says roles follow decisions about purposes and means. An agency may process some client data on instructions yet act as a controller for another use it decides. A buyer, agency and monitoring supplier should not assign every activity one convenient label.

ICO guidance and the legal framework can change. Use this recheck trigger before relying on the current role analysis.

Separate data protection from channel rules

The Data Protection Act 2018 applies across the UK subject to its detailed provisions and must be read with the UK GDPR. The organisation needs a lawful basis and must address fairness, transparency, purpose, minimisation, accuracy, storage, security and rights for personal-data processing.

The Privacy and Electronic Communications Regulations 2003 (PECR) are a different gate. The ICO's business-to-business marketing page distinguishes corporate from individual subscribers, channels and objections. A media pitch may promote a client's goods, services, aims or ideals, so classify the actual message and recipient rather than assuming that "media relations" falls outside direct marketing.

Consent is not the only possible UK GDPR lawful basis, and a claimed lawful basis does not itself satisfy PECR. Equally, an editor answering a request does not give blanket authority to add other people to a campaign list.

Article 6 of the UK GDPR lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Choose and document the basis that fits the particular processing; a basis that applies to one activity does not automatically cover another.

Build a defensible contact record

For every entry, keep the original source and date, intended use, accuracy check, lawful-basis assessment, privacy-information route, suppression state and retention review. Separate professional subject notes from sensitive inferences. Do not collect private contact details merely because they are easier to use.

The agency should also route objections and corrections back to each relevant controller. A deletion in one working sheet is incomplete if copies remain in exports, shared mailboxes or a subcontractor's system.

ICO register, breaches and rights deadlines

The ICO publishes a register of fee payers. Search it for the relevant organisation and record the result with the data-flow evidence; an entry does not determine whether the agency is a controller or processor for each activity.

Under Article 33 of the UK GDPR, a controller must notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. A processor must notify its controller without undue delay.

Under Article 12(3) of the UK GDPR, respond to a data subject access request and other rights requests without undue delay and within one month of receipt. An extension of up to two further months may be available for complex or multiple requests; tell the requester about the extension and reasons within the first month.

Contract and secure the handling

Where the agency is genuinely a processor, the ICO's contract guidance covers instructions, confidentiality, security, subprocessors, assistance, audits and end-of-contract provisions. Commercial clauses do not create a lawful basis or convert an independent controller into a processor.

For supplier access, use the NCSC's supply-chain assurance principles to set reporting, audit and review evidence proportionate to the risk. That guidance does not certify any PR or monitoring platform.

Stop a send when the source, purpose, role, channel analysis, objection state or recipient is uncertain. A named privacy reviewer must approve the live flow, and the security owner must verify access, incident handling, export and deletion before personal data enters it.

Before you act

Common questions

Why is a media list not exempt from data protection?

Entries concern people's jobs, but a named journalist's email, a spokesperson's mobile number and notes about a stakeholder can all be personal data. Public availability also does not settle later use, so the agency still needs a lawful basis and must address fairness, transparency, purpose, minimisation, accuracy, storage, security and rights.

Can an agency be both a controller and a processor?

Yes. Roles follow decisions about purposes and means. An agency may process some client data on instructions yet act as a controller for another use it decides. A buyer, agency and monitoring supplier should not assign every activity one convenient label, so assess each activity separately.

What should happen before a campaign send goes out?

Stop the send when the source, purpose, role, channel analysis, objection state or recipient is uncertain. A named privacy reviewer must approve the live flow, and the security owner must verify access, incident handling, export and deletion before personal data enters it.