PR agencies rules and ethics: a UK legal and ethical guide

An organisation cannot clear PR work by asking whether the agency is "compliant". It must examine the proposed act, the people involved, the audience, the channel and the evidence.

A press release offered to an editor, a paid creator post, an email to a named contact and a meeting with a minister can sit in different legal or regulatory frames.

The operating case is an organisation based or trading in England. Much of the primary framework is UK-wide, the Equality Act 2010 principally covers Great Britain, and some regulated-product rules distinguish Great Britain from Northern Ireland. Those boundaries are stated rather than converted into England-only law.

The records were reviewed on 6 September 2026. The 2027 date is a revalidation point, not a forecast. The draft gives legal information and decision controls, not legal advice, media clearance or a promise of coverage.

What to take away

Start with the act, not the job title

There is no single statute for PR work in England. The applicable rule depends on the specific activity. Buying an advert, pitching editorial material, holding a journalist's details, commissioning an image and lobbying a minister each sit under a different regime, so map the task before approving it.

"PR agency" is a commercial description. It does not decide whether an entity is a controller, an advertiser, a trader, a consultant lobbyist or the owner of commissioned work. One firm may occupy different roles across a single appointment.

Build an activity register before preparing a brief. Each row should identify:

That register prevents two common category errors. First, the person who writes a statement is not necessarily authorised to confirm the underlying fact. Second, the person who receives material does not become the agency's distribution channel. A journalist or editor retains their own editorial judgement.

Read the source hierarchy correctly

The words "rule", "guidance" and "code" are not interchangeable. The following map reflects pages available when this draft was checked.

Regulator guidance can be highly useful without being legislation. A consultation is a proposal, not current law. A page marked under review remains a warning to check its status, not an invitation to guess the future text. Record those distinctions in the approval file.

Apply the profession's own ethics codes

Statute is not the whole boundary. The Chartered Institute of Public Relations publishes a Code of Conduct that binds its members, and the Public Relations and Communications Association publishes a Professional Charter, a Code of Conduct and a Consultancy Management Standard for agency practice. Those instruments address honesty and accuracy, conflicts of interest, gifts and hospitality, confidentiality, and the fair treatment of clients, employers, journalists and the public.

Professional codes are disciplinary rather than criminal, but they apply on top of the law to the same act. Record which code binds the named practitioners, who enforces it, and how the agency logs a conflict of interest, a refusal to mislead or a disputed fact. A trade-body logo or a directory entry does not show that the code was followed on a particular appointment.

Define every participant before assigning duties

The buyer decides why it needs support and supplies or verifies organisational facts. That buyer may not be the legal entity signing the agreement. Record both.

The agency accepts only the work and authority written into scope. If it appoints a monitoring service, freelance creator or overseas research supplier, that subcontractor needs its own rights, access, security and data-role assessment. Flowing a clause down the chain is evidence of allocation, not proof that the activity is lawful or well controlled.

A spokesperson can deliver an approved line. They should not silently become the source for technical, medical, financial or operational claims outside their authority. Stakeholders may need service information, consultation or a response route. An audience member seeing later commercial material has a different relationship. The release record should not collapse either group into "the public".

The media contact is another distinct person. Their business details may be personal data. Their previous interest in a subject does not amount to a promise to read, publish or endorse a later pitch. An agency should not sell "relationships" as though it controls an editor's decision.

Lobbying, gifts and contact with officials

Meeting a minister, an MP or a civil servant brings in rules the CAP Code does not touch. Consultant lobbying is regulated by the Transparency of Lobbying, Non-Party Campaigning and Trade Union Administration Act 2014, which created the Office of the Registrar of Consultant Lobbyists and its register. A consultancy that lobbies for payment on behalf of clients may have to register and file information returns, while employees lobbying only for their own employer sit outside the register.

Public affairs work also appears on the industry registers, including the PRCA Public Affairs Register, which grew out of the Association of Professional Political Consultants register. Contact between ministers and outside interests is governed by the Ministerial Code, and contact with officials by the Civil Service Code.

Gifts, hospitality and other advantages offered to officials or journalists are not a labelling question. The Bribery Act 2010 creates offences of offering, promising or giving a financial or other advantage intending to improperly perform a function, and a corporate offence where a commercial organisation fails to prevent bribery by those acting for it. Log every gift, incentive, hospitality and paid trip with its value and approver, and take specialist advice before any offer to a public official.

Separate earned editorial from paid or controlled communication

CAP's February 2025 remit explanation says press releases and editorial material normally fall outside the Code, while advertisements, advertorial and some marketer-controlled communications can be inside it. The exact arrangement matters.

The CAP Code covers paid advertising within its remit. It does not cover editorial or press-release material, so a Code review cannot clear a press release.

Ask who paid, what benefit was provided, who selects the words, who chooses placement and whether a publisher or creator exercises independent control. Preserve contracts, briefs and approvals that answer those questions. Do not use an "editorial" label to conceal a commercial relationship.

Where the Code applies, its recognition section requires marketing communications to be obviously identifiable. The CMA's August 2025 guidance for businesses and brands separately addresses incentivised online content and intermediary responsibilities. A contractual allocation between client and agency does not prevent a regulator from examining either party's conduct.

An earned story may quote a press release without turning the whole publication into the client's advert. Equally, paying for distribution does not guarantee that every resulting item has the same status. Keep a placement-level record and obtain a qualified UK advertising and consumer review.

Media law sits outside the codes

The codes and statutes above do not cover everything that can go wrong with a story. Defamation, privacy and contempt are decided by the courts, not by a regulator with a pre-publication approval service.

The Defamation Act 2013 introduced a serious harm threshold. A body that trades for profit must usually show serious financial loss. The Act sets out defences including truth, honest opinion and publication on a matter of public interest. A libel claim must normally be brought within one year of publication.

Other gates include contempt of court while proceedings are active, misuse of private information, harassment, and data protection claims brought by individuals. There is no clearance body, so a media and defamation review is the only control before release.

Check names, allegations, images and captions. A press release can defame a competitor, and a social post can breach a court order. Keep the reviewed wording, the evidence and the reviewer's note with the release ticket.

Approve claims before polishing copy

Every objective assertion needs a file that identifies the proposition, evidence owner, original source, relevant population, geography, date and expiry trigger. The approval should also cover photographs, charts, captions, omissions and the overall impression, not just the sentence that contains the number.

CAP's March 2026 misleading-advertising advice discusses substantiation, material information and the audience's likely interpretation. CAP states that this advice is not legal advice and does not bind the ASA. Use it to structure checks, not as a certificate.

A client assertion is not automatically independent evidence. A media mention does not validate the claim it repeats. An award, register entry or absence of a ruling is not proof of product quality. If the source covers a different edition, territory or period, narrow the words or stop release.

Regulated sectors need another gate. The FCA's financial-promotions page points to media-neutral and product-specific requirements. The MHRA's medicines advertising guide distinguishes audiences, products and territories. These examples show why a general PR approval cannot replace the client's competent sector review.

Treat contact data as data, not inventory

A spreadsheet of journalists, creators, public officials and stakeholder representatives can contain personal data even when work addresses are public. Map the source, purpose, lawful basis, privacy information, accuracy, selection, disclosure, objection, suppression, retention and deletion for every use.

Neither the Data Protection Act 2018 nor PECR says that a public email address is permission for every use.

Article 6 of the UK GDPR supplies the lawful bases — consent, contract, legal obligation, vital interests, public task and legitimate interests — and Article 9 adds a further condition for special category data such as health, racial or ethnic origin, religion, political opinions, trade union membership, genetic and biometric data, and sex life or sexual orientation. Write the chosen basis down before the list is used.

A controller must also pay the ICO's data protection fee and appear on the ICO's register of fee payers unless an exemption applies, under the Data Protection (Charges and Information) Regulations 2018. That fee is separate from any enforcement penalty, and the client and the agency should each check their own position rather than assume the other party has paid.

The ICO's controllers and processors guidance says roles follow real decisions about purposes and means. When checked, it carried a notice that Data (Use and Access) Act changes had put it under review. Do not assign the agency a processor label merely because that is convenient for the contract.

Electronic direct marketing requires a separate PECR analysis. The ICO's business-to-business marketing guidance distinguishes corporate and individual subscribers, public data and objections, and was also under review. A pitch promoting goods, services, aims or ideals can require classification even if it is sent to a professional address.

Do not extend consent given to the client into permission for an agency's own list. Do not assume a prior reply authorises future unrelated contact. If source, purpose, subscriber type, channel or suppression status is unresolved, the send should remain blocked.

Protect confidential material without promising privilege

Confidentiality starts with practical access. Identify which facts the buyer may share, who can see them, which systems hold them, whether subprocessors are involved and when copies must be returned or deleted. Separate verified facts from allegation, speculation and internal advice. A working label such as "confidential" or "privileged" does not itself establish legal privilege.

NCSC supply-chain assurance guidance supports proportionate contractual reporting, review and audit arrangements. It was reviewed by NCSC on 22 October 2025 and is aimed at large organisations and the public sector. It is a useful control source, not certification of an agency or platform.

Record secure access, multifactor authentication where selected by the security owner, incident routes, alternative contact methods and revocation at exit. A named security reviewer should decide the controls for the actual information and threat model.

Contract for rights, approvals and exit

Commissioning text, photography, video or design does not automatically give the client every copyright interest. IPO guidance says the creator is usually first owner of commissioned work unless the parties agree otherwise in writing. Payment alone is not an assignment of rights.

The contract should identify the asset, creator, ownership or licence, permitted media, territory, term, alteration, credit, third-party material and handover.

The same precision belongs in the service schedule. Define what the agency will produce, what the buyer must supply, who approves facts, what is excluded, how changes work, and what counts as acceptance. Leave fees, VAT treatment, liability, insurance and remedies to evidence and specialist negotiation rather than copying a generic clause.

Data terms depend on the actual relationship. The ICO's controller-processor contract guidance lists required subjects where a processor relationship exists, including instructions, confidentiality, security, subprocessors, assistance, audits and end-of-contract treatment. It expressly does not cover the wider commercial negotiation and was marked under review.

Exit should return source files, approval logs, contact provenance, open corrections and evidence needed to continue safely. Revoke accounts and document lawful retention or deletion. Neither party should lose the ability to correct a live statement because the appointment ended.

Add accessibility and equality before release

Accessible communication is not created by attaching an alternative after publication: plan audience needs, format, reading order, captions or transcripts and contrast. Also plan language and an accessible response route.

GOV.UK's inclusive communication guidance was updated on 17 June 2026 and written for government communicators. Private organisations may use it practically, but it does not decide their Equality Act duties.

Keep the legal assessment and the usability evidence separate. A lawyer may advise on scope; users and accessibility specialists can test whether an artefact works in the intended channel. Neither result compensates for missing factual approval, rights or security.

Use disclosures that match the real relationship

A disclosure file should record funding, sponsorship, gifts, agency involvement, supplied material, commercial control, conflicts and correction routes. Place necessary information where the audience encounters the relevant content. A generic agency footer may be too remote to explain a paid creator post, while an earned article may not require the same statement at all.

AI assistance needs a factual record, not a slogan. ASA and CAP's May 2025 article on AI disclosure says the UK has no blanket legal duty to label AI use in ads; existing Code rules apply whatever the production method.

Record inputs, rights, human checks and alterations, then assess whether an omission would mislead or another rule or contract requires disclosure. An AI notice cannot repair fabricated evidence or an unauthorised likeness.

Operate one release ticket with independent gates

The ticket should travel with the artefact, not sit in a separate policy folder. It needs named owners and dated evidence for:

Each gate is signed off by a named specialist before release, and each source in the file is labelled by status: statute, code or guidance.

These gates are non-compensating. Strong claim evidence does not excuse hidden sponsorship. Clear sponsorship does not cure a false assertion. A processor clause does not authorise direct marketing. A senior client's approval does not transfer copyright owned elsewhere.

Set outcomes as release, hold, narrow or withdraw. Record the reason and who may authorise a retest. For a developing issue, define how new facts replace old copy and how recipients receive the correction. Never imply that removal from one channel erases every distributed copy.

Worked examples of the four outcomes:

Publication-day review for 2027

Before this material or any operational checklist is used in 2027, open every primary source again. Confirm current text, territorial reach, commencement, regulator status and any transition. Check whether ICO guidance under review has been replaced, whether CAP has amended the relevant Code sections, and whether sector rules or the client's authorisation have changed.

Assign named UK reviewers rather than a collective "legal approved" field. Depending on the work, that may include media and defamation counsel, advertising and consumer specialists, a privacy and PECR reviewer, IP counsel, an accessibility lead, security owner, consultant-lobbying adviser, sector compliance officer, commercial lawyer and tax adviser.

If the relevant person, evidence or rule status is missing, the safe editorial decision is a narrower communication or continued hold. This guide cannot certify an agency, appointment or campaign, and it gives no assurance of publication, endorsement or legal outcome.

Common questions

Does a press release fall under the CAP Code?

CAP's February 2025 remit explanation says press releases and editorial material normally fall outside the Code. Advertisements, advertorial and some marketer-controlled communications can be inside it. The exact arrangement matters, so ask who paid, who selects the words and who controls placement.

Can a client assertion serve as evidence for a claim?

No. The article states that a client assertion is not automatically independent evidence, and a media mention does not validate the claim it repeats. Each objective assertion needs a file identifying the proposition, evidence owner, original source, population, geography, date and expiry trigger.

Is a spreadsheet of journalist contacts personal data?

It can be, even when work addresses are public. The article says to map the source, purpose, lawful basis, privacy information, accuracy, selection, disclosure, objection, suppression, retention and deletion for every use of that contact data.