Promotional products data protection for UK buyers

What to take away

Promotional products data protection covers the UK GDPR and Data Protection Act 2018 duties that apply when you hold someone's details to send a branded item. The Privacy and Electronic Communications Regulations 2003 (PECR) also apply if the campaign includes electronic marketing, such as email or text.

For the wider legal picture, the promotional merchandise UK rules and compliance guide sets out the surrounding rules before you brief a supplier.

Who is accountable for personal data in a merchandise campaign

The controller and processor split

The buyer decides why the names are used, so the buyer is the controller. A supplier that stores the address file, prints labels or runs fulfilment is a processor. Processors may only act on documented instructions from the controller.

Check whether your organisation must pay the ICO data protection fee. If it is not exempt, pay the fee and ensure its entry on the ICO's public register of fee payers is current.

The boundary moves if a supplier reuses your gift list for its own marketing, because then it becomes a controller. A supplier that also decides why the data is used, for example by running its own prize draw from entries you pass on, takes on controller duties for that activity.

These duties apply in England and across the rest of the UK, so a supplier in Glasgow follows the same UK GDPR rules as one in Leeds.

Items you hand out must also meet the consumer product safety duties set out in GOV.UK's guidance on consumer product safety and protection.

What a written processing agreement should contain

Under Article 28 of the UK GDPR, the written processing contract must describe the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of people involved, and the controller's rights and obligations. It must require the processor to follow documented instructions, maintain confidentiality and security, obtain written authorisation for sub-processors and impose equivalent duties on them, assist with rights requests and compliance, support audits, notify the controller of breaches without undue delay, and return or delete data at the end.

Say what happens to the address file at the end of the campaign. Ask how artwork and address files are cleared after dispatch, since backups are a common weak point. Where the supplier uses its own courier platform or mailing house, list those sub-processors and require approval before any change. Ask whether any supplier or sub-processor will store or access the data outside the UK. If so, check that the transfer is permitted under UK GDPR; this may require an adequacy regulation or a safeguard such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

Lawful bases for using names in a gift campaign

Consent, legitimate interests and business gifts

Pick a basis before you buy the first mug. Consent works when people actively ask for mailings or gifts, and it must be as easy to withdraw as to give.

Legitimate interests can cover business-to-business thank-yous where the relationship is genuine, so record the balancing test rather than the conclusion. Consent can be withdrawn at any time, so keep a suppression list and refresh the fulfilment file before each send.

Give recipients a privacy notice. When you collect details directly, meet UK GDPR Article 13; when details come from a client or another source, meet Article 14. Explain who you are, why and on what lawful basis you use the data, who receives it, how long you keep it, recipients' rights and how to complain to the ICO; for indirectly collected details, identify the source and explain any international transfer.

PECR applies alongside data protection law. For unsolicited email or text marketing to individual subscribers, obtain consent unless the soft opt-in applies; a UK GDPR lawful basis on its own is not enough.

Special category data and employee gift lists

Health data is special category data, so dietary needs on a hamper list need an extra condition and tighter access. Restrict allergy notes to the people packing the hampers rather than the whole marketing team.

Employees' details are still personal data, and internal spreadsheets still need a retention rule.

Records, rights and enforcement

Retention, records and erasure requests

Keep a record of processing activities under UK GDPR Article 30 where the requirement applies. A controller's record should include its contact details, purposes, categories of people and data, recipients, international transfers, envisaged retention periods and a general description of security measures; recording each campaign's data source and deletion date helps demonstrate your approach.

People can ask for a copy of their data, object to marketing or ask for deletion. Respond without undue delay and normally within one month of receiving the request; the period can be extended for complex or multiple requests if you tell the person within that first month. Erasure is not automatic, so assess whether the right applies and pass requests involving supplier-held data to the printer or fulfilment house promptly.

If a client asks how you handle names and gift lists, a written promotional merchandise disclosure policy answers the question before it becomes a complaint.

Sanctions, claims and unfair trading

Misleading wording around a promotion can breach the unfair trading rules summarised in the explanatory memorandum to the Consumer Protection from Unfair Trading Regulations 2008.

Advertising claims on the item or leaflet also sit under the CAP Code. The Advertising Standards Authority lists the sanctions it can apply when an advertiser will not comply. The Advertising Standards Authority can act on a complaint from a single recipient, so one badly worded leaflet carries risk.

A processor must tell the controller about a personal data breach without undue delay. If a breach is likely to risk people's rights and freedoms, the controller must notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware; if the risk is high, it must also inform affected people without undue delay. Individual cases always need a qualified adviser.

Common questions

Do we need consent to send branded merchandise to clients?

No, not always. Business gifts to existing contacts can rest on legitimate interests or contract if you can show the reason and log it. Consent is the safer route for consumer lists and for anything that reads as marketing.

How long can we keep a gift list?

Only as long as the purpose needs it. For example, a team sending £25 thank-you gifts might keep the dispatch list for 12 months and clear the artwork at 30 days.

What happens if promotional merchandise data protection goes wrong?

The Information Commissioner's Office can investigate complaints, and serious failures can lead to fines and reputational damage. Most problems start with an inherited spreadsheet nobody owns.