Rules and ethics
Part of What are the shopping feed rules and ethics in the UK?
Shopping feeds data protection without the legal guesswork
Data protection duties for shopping feeds in England: controller roles, international transfers, claims accuracy and a supplier scoring rubric.
What to take away
- If your Northampton homeware shop pushes 4,000 SKUs to a marketplace, you are still a data controller for the customer records you hold.
- Lawful basis, retention limits and transfer rules apply to feed fields such as email, phone number and delivery address.
- Product claims carried in feed titles and descriptions sit under consumer protection law, not only advertising codes.
- Ask every supplier where feed data lives, who can see it and how long it is kept, then get the answers in writing.
- Keep one page listing every feed destination and review it each quarter.
For personal data in shopping feeds, the governing framework is the UK GDPR, supplemented by the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the UK's data protection regulator. Most organisations processing personal data must pay the ICO data protection fee unless exempt; check whether your business must pay and appear on the ICO's public register of fee payers.
Does a product feed count as personal data?
Yes, when it carries anything that identifies a person. A stock-only feed of SKUs and prices holds no personal data. Add a customer email for a marketplace order and the file becomes personal data. Hashed email addresses are still personal data. Pseudonymised data is not anonymous data.
Is the feed personal data?
Does the feed identify a person?
lawful basis and retention rule
no personal data duties
That distinction decides your paperwork. One feed may need a lawful basis and a retention rule; the other needs none.
Who is the controller when a platform hosts your feed?
The retailer usually stays the controller. A marketplace, feed tool or agency that processes the file only on your instructions is normally a processor; a platform deciding its own purposes may instead be a controller for that use. That split matters when a shopper asks for their data.
Controller versus processor duties
Retailer (controller)
- Subject access requests
- Must answer
- Correcting errors
- Must correct
- Deleting records
- Must delete at retention end
Platform, tool or agency (processor)
- Subject access requests
- Acts on instructions
- Correcting errors
- Acts on instructions
- Deleting records
- Acts on instructions
You must answer subject access requests, correct errors and delete records when retention ends. A supplier cannot absorb that obligation for you.
If you are mapping duties across channels, returns and pricing obligations sit alongside feed duties.
How do you handle transfers outside the UK?
Sending personal data to a platform abroad can be a restricted transfer. The ICO's guidance on international data transfers explains when a transfer can rely on adequacy regulations or needs a safeguard such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Complete a transfer risk assessment where required.
Check where data is stored, not where the company is registered. A UK-limited supplier can still process your feed in another country. Record the applicable transfer route or safeguard in the contract. Some platforms also mirror your feed into analytics tools, which creates a second transfer to check.
What claims in a feed can lead to enforcement?
Feed titles and descriptions are commercial claims. The Consumer Protection from Unfair Trading Regulations 2008 prohibit misleading actions and omissions, and trading standards officers in England can act on them. Discount claims in a feed must match the price a shopper actually pays.
Say next day only when you can deliver next day across the area you name. Say leather only for leather. The advertising rules in England include CAP Code requirements, which may apply alongside consumer law.
This is general guidance. Trading standards services in England handle local enforcement, and Scotland and Northern Ireland have their own arrangements. A specific dispute needs a qualified adviser.
How should you treat vulnerable customers in feed marketing?
The FCA's guidance on the fair treatment of vulnerable customers sets expectations that marketing should not exploit limited understanding or financial pressure. Its approach is borrowed widely beyond regulated sectors.
Avoid urgency wording aimed at people in debt. Keep eligibility conditions visible whenever an offer has them. Check which customer groups receive each campaign, because purchase history can flag hardship.
When shopping feed data drives marketing emails or texts, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) apply alongside UK GDPR. For individual subscribers, unsolicited marketing generally requires consent unless the soft opt-in applies: details must have been obtained during a sale or negotiations for a sale, messages must promote your own similar products, and an opt-out must be offered when details are collected and in every message. Different rules apply to corporate subscribers, but UK GDPR still applies when personal data is used.
How do you score a supplier's data protection answers?
Score each answer from one to five. Multiply the score by the weight to get a total out of 60.
Scoring a supplier's data protection answers
| Area | What good looks like | Weight | Your score |
|---|---|---|---|
| Lawful basis | A named basis for each personal field | 3 | 1-5 |
| Retention | A deletion date and evidence it runs | 3 | 1-5 |
| International transfers | Named safeguard and destination country | 2 | 1-5 |
| Access control | Named staff roles and an audit log | 2 | 1-5 |
| Breach handling | A route that reaches you within 72 hours | 2 | 1-5 |
A total below 48 signals gaps to fix before launch.
Common questions
These answers assume the feed contains personal data; stock-only data does not trigger the same duties.
Do I need consent to put customer emails in a shopping feed?
Usually not. Consent is one lawful basis among the six UK GDPR bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Processing necessary to fulfil a shopper's order can rely on contract; choose and record a basis for each purpose, and assess the balance of interests if relying on legitimate interests.
Does a feed tool need a data processing agreement?
Yes, if it handles personal data for you. Ask for the agreement before the first sync, and check it covers every feed destination.
How long may we keep feed data?
No single UK GDPR period applies to all feed data: keep personal data only as long as its stated purpose requires and document a deletion point. For example, the Companies Act 2006 requires private companies to keep accounting records for three years and public companies for six years from the date the records are made. That does not mean every feed field or customer record must be retained for that long.
What if a supplier will not answer?
Treat that as a score of one. Send only non-personal fields to that destination, or move to another supplier.
