How UK GDPR shapes what a PR agency can put in a media list

What to take away

Why a media list is personal data under UK GDPR

A media list holds names, work emails, phone numbers, job titles and sometimes personal mobile numbers. Each of those identifies a living person, so the list is personal data. The fact that the person is a journalist does not remove protection.

Agency teams often treat the database as a contact directory. That framing misses the point. Under UK GDPR you are a controller for the list, and you must be able to explain where each record came from and why you hold it.

The Information Commissioner's Office sets out the six lawful bases and what each requires. You pick one before processing, not after a complaint arrives. See the A guide to lawful basis for the tests you must meet.

The list also carries accountability duties. You need a record of processing, a privacy notice that covers media relations, and a way to answer rights requests. A spreadsheet with no owner fails those tests quickly.

Most agencies run three lists in practice: national news desks, trade press and regional titles. Each may have a different source and a different review rhythm. Treating them as one blob hides the risk.

If you map how contacts move from a press release reply to a stored record, the compliance questions become concrete. Our guide to media lists and stakeholder data shows that flow before any label is applied.

Lawful basis for PR outreach: legitimate interests and consent

Legitimate interests is the usual basis for PR outreach to editorial contacts. You have a business need to pitch stories, and the journalist has a professional interest in receiving relevant material. That balance must be documented.

The legitimate interests test has three parts. Identify the interest, show the processing is necessary, then balance it against the individual's rights and expectations. A one-line claim in a policy is not enough.

Consent is harder to rely on for a living list. It must be freely given, specific, informed and unambiguous, and it can be withdrawn. If a journalist withdraws, you must stop using their details and suppress the record.

Public task and contract bases rarely fit agency media relations. Contract might cover a client's own staff, not external journalists. Public task belongs to public bodies, not to agencies pitching coverage.

The journalism exemption in UK GDPR is narrow. It can apply to processing for journalistic purposes with a public interest, but a PR agency selling coverage to a client is not the press. Do not assume it covers your list.

Document the basis per list and per purpose. A single database used for pitching, events and awards needs a basis for each use, or separate lists with separate notices.

The wider rulebook matters too. Our dated map of regulations shows how UK GDPR sits alongside PECR, the CAP Code and sector rules from the FCA and Ofcom.

Special category data and political, health or trade union contacts

Special category data includes health, political opinions, trade union membership, sexual orientation, race and religion. A media list can hold this without anyone intending to collect it.

A political correspondent's beat tells you something about their work, not their personal politics. A health reporter's inbox may hold medical details they shared in a pitch thread. Those details are special category data once recorded.

Trade union contacts are a common trap. A press officer for a union is not automatically a union member, but a note saying 'union rep' or 'NUJ member' can reveal membership. That note needs a lawful basis under Article 9.

Article 9 requires a separate condition, such as explicit consent or a substantial public interest. Legitimate interests alone does not cover special category data. You need the extra condition and an appropriate policy document.

Practical steps help. Strip unnecessary detail from contact notes, avoid logging personal circumstances, and keep sensitive threads out of the shared database. If a client campaign needs health contacts, agree the condition in writing first.

A journalist may volunteer personal information in an email. That does not give you a free pass to store it. Delete what you do not need and record why you kept the rest.

Sourcing contacts: PECR, business-to-business marketing and the ICO checklist

Alongside UK GDPR, PECR also governs electronic marketing. It covers email, calls and texts, and it has specific rules for business-to-business marketing that many agency teams misread.

Corporate subscribers get different treatment from individual subscribers. Sole traders and some partnerships count as individuals, so the consent rules are stricter. A generic info@ address at a large company is usually a corporate subscriber.

The safest sourcing route is a public, professional source. A newsroom page, a bylined article or a press release footer gives you provenance you can record. Bought lists and scraped addresses are much harder to defend.

The Business-to-business marketing | ICO guidance explains when you can email corporate subscribers and when you need consent. Read it before you import any purchased file.

The Direct marketing checklist | ICO is a practical audit tool. It asks whether you have a lawful basis, a clear privacy notice, a suppression list and a way to honour objections. Work through it once per list.

Keep the source for every record. A field called 'provenance' with a URL and a date is worth more than a long list of job titles. It shows the record was not invented.

When you compare suppliers, ask how they source and refresh data. Our review of media contact tools covers how to test Vuelio, CisionOne and ResponseSource on exactly that point.

A worked media list audit: fields, provenance and the DPIA trigger

A media list audit is a structured review of every field, every source and every purpose. Run it at least once a year, and after any merger, pitch win or database migration.

The audit below uses a fictional agency, Northline Communications, and its regional press list of 4,200 contacts. The numbers are illustrative, not benchmarks.

The audit found three problems. First, 600 records had no provenance beyond 'old CRM import'. Second, 180 records carried political notes that looked like special category data. Third, the personal mobile field had no stated purpose or review date.

Northline fixed the list in five steps:

The DPIA trigger is size and risk, not just headcount. A large database, systematic monitoring or special category data can all require a data protection impact assessment. The Data Protection Impact Assessments (DPIAs) | ICO guidance sets out when an assessment is expected and what it must cover.

For Northline, the 4,200-contact list with sensitive notes met the threshold. The DPIA took two days and produced a mitigation plan: field-level rules, annual review and a named owner. Smaller, low-risk lists may only need a short screening note.

Building a retention schedule and handling subject access requests

A retention schedule names each data type, how long you keep it, why, and who reviews it. Without one, lists grow until something breaks.

A simple template works. List the data category, the lawful basis, the retention period, the review trigger and the owner. Add a disposal method: delete, anonymise or archive.

For media lists, common periods are 12 to 24 months for active contacts and 6 months for sensitive fields like personal mobiles. Review on engagement: if a journalist has not opened or replied in a year, suppress or delete.

Suppression lists must outlive deletion. If someone objects, keep the minimum needed to honour that objection. Do not keep the full record just to remember the objection.

Subject access requests from journalists are rare but real. A journalist may ask what you hold about them, especially after a dispute. You must respond within one month, with limited extensions for complex requests.

The Subject access requests (also known as SARs or right of access) | ICO guidance explains how to verify identity, what to redact and when you can refuse. Redact third-party names and confidential client information, but do not use redaction to avoid answering.

Train account teams to recognise a request. A message saying 'send me everything you have on me' is a subject access request, even if it arrives in a pitch thread. Escalate it the same day.

Our guide to UK legal boundaries sets out how these duties fit with client contracts and professional conduct rules.

Breach notification duties when a media database is exposed

A breach is any security incident leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data. A leaked media database counts.

You must notify the ICO within 72 hours of becoming aware of a breach that risks people's rights and freedoms. You must also inform those affected without undue delay when the risk is high.

A media database breach can be high risk because it holds contact details and notes about beats and interests. If special category data is exposed, assume high risk unless you can show otherwise.

Keep an incident log. Record what happened, what data was involved, how many people, what you did and who decided. The log is evidence of accountability even when notification is not required.

Practical controls reduce the damage: role-based access, two-factor authentication, no shared logins, and a leavers process that removes access the same day. Test restores of the database so you know what a loss would mean.

If a supplier hosts the database, your contract needs breach notification clauses with a short deadline. You remain responsible to the ICO and to the journalists on the list.

Common questions