What the ICO expects when you collect public social data for brand monitoring

What to take away

What the ICO treats as personal data in a public social post

The fact that a post is public does not remove it from UK data protection law. If a post relates to an identified or identifiable living person, it is personal data. That includes a username, a profile photo, a job title in a bio, or a complaint that names a branch manager in Leeds.

Even a post with no name can be personal data where the person can be singled out by combining details. A handle used across platforms, a location tag in Glasgow, or a reference to a distinctive role can all make someone identifiable.

The ICO's guidance on what counts as personal information, including its guidance on identifying individuals indirectly, is the starting test here, and it is deliberately broad.

Brand monitoring teams often assume they only hold "public sentiment". In practice you hold text, timestamps, handles, follower counts, images and inferred attributes such as likely age bracket or region. Inferences drawn from posts are personal data too, and they attract the same obligations as the source post.

Special category data is the sharper edge. Posts revealing health, sexual orientation, ethnicity, religion or trade union membership are special category data under UK GDPR Article 9 and need both an Article 6 lawful basis and an Article 9 condition. A listening query built around a medical condition, for example, will pull in special category data even if that was not the intent.

There is a distinction between monitoring a topic and monitoring a person. Tracking mentions of a product is one thing. Building a profile of an individual critic across months of posts is another, and the second is far harder to justify.

Where data protection law reaches into social listening, the deciding factor is usually the subject, not the platform.

Criminal offence data adds a further layer. Posts about arrests, charges or convictions are restricted under the Data Protection Act 2018, which is the statutory basis for the UK regime. If your queries can surface that material, say so in your records.

Lawful basis choices for brand monitoring under UK GDPR and the Data Protection Act 2018

You must have a lawful basis before you start processing, and you must record it. UK GDPR Article 6 sets out the six options; the ICO's Lawful basis interactive guidance tool and lawful basis guidance can help you assess and document your choice in your privacy information. Pick one and be able to defend it.

Legitimate interests is the usual choice for brand monitoring. It can work, but it requires a three-part test: identify the interest, show the processing is necessary for it, and balance it against the individual's rights and expectations. That balance is where most programmes fail.

Consent is rarely practical for listening. You cannot obtain valid consent from every person whose public post you collect, and consent that is not freely given or is impossible to withdraw is not consent at all. Do not claim it because it sounds safer.

Public task or legal obligation may fit public bodies monitoring commentary on their services, or firms handling regulated complaints. Contract is a weak fit for broad monitoring, because the person posting is usually not your customer at the moment of collection. Vital interests is the sixth lawful basis, but it is rarely a fit for routine brand monitoring.

Whichever basis you choose, the choice must match the purpose. Using legitimate interests for service improvement is one thing. Reusing the same dataset for advertising targeting or profiling is a new purpose and needs its own assessment.

The Data Protection Act 2018 supplements UK GDPR with provisions on law enforcement processing, exemptions and the ICO's powers. It does not create a shortcut for public data. A disclosure policy that covers sources, limits and corrections is how most teams make the basis concrete for staff.

ICO deadlines and baseline duties for monitoring teams

UK GDPR Article 5(1)(e) requires personal data to be kept no longer than necessary for its purpose; Articles 6 and 9 cover lawful bases and special category data. Article 30 covers records of processing activities, and Article 35 covers data protection impact assessments. The ICO's Accountability framework helps teams organise evidence of compliance.

Most controllers must pay the ICO data protection fee unless exempt under the Data Protection (Charges and Information) Regulations 2018; check the ICO's fee self-assessment and public register. Under Article 33(1), notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it if it is likely to risk people's rights and freedoms. If the breach is likely to result in a high risk, Article 34 also requires communication to affected people without undue delay.

Under UK GDPR Article 12(3), respond to a subject access request without undue delay and within one month of receipt. You can extend the response period by up to two further months where the request is complex or you have received multiple requests, but must tell the requester within the first month.

Screening a social listening project for a DPIA

You must carry out a DPIA if processing is likely to pose a high risk to individuals. The ICO's guidance, Data protection impact assessments (DPIAs), identifies systematic monitoring as a high-risk criterion; UK GDPR Article 35(3)(c) specifically names systematic monitoring of publicly accessible areas on a large scale. Assess the actual scope and risk of your listening project rather than assuming every project automatically meets that statutory trigger.

Screening comes first. Use the ICO's DPIA screening checklist to assess criteria including evaluation or scoring, significant automated decisions, systematic monitoring, sensitive or highly personal data, large-scale processing, matching or combining datasets, data about vulnerable people, innovative technology, and preventing people from exercising a right or using a service. Two or more hits are a strong indication that a full DPIA is needed; document your reasoning if you reach a different conclusion.

The DPIA is a living document. A new platform, a new AI classifier or a new market such as Scotland should trigger a review, because each changes the risk picture. Where a project is genuinely low risk, record the screening decision and the reasoning, so the choice is auditable later.

Retention, erasure and individual rights in monitoring datasets

Retention is where monitoring programmes quietly break the law. Keeping everything indefinitely "because storage is cheap" fails the storage limitation principle in UK GDPR Article 5(1)(e): personal data must not be kept longer than necessary for its purpose. Set a period per data type and purpose, and justify it.

A common pattern is short retention for raw posts and longer retention for aggregates. Raw post text and handles might be held for a defined window, while anonymised counts and themes are kept for trend reporting. Once data is truly anonymised, UK GDPR no longer applies to it.

Erasure must be real. Deleting a post from a dashboard while a copy sits in a data lake, a spreadsheet or a vendor's backup is not erasure. Map every copy, including exports and cached copies held by third-party tools.

Individuals have rights over monitoring data. They can request access, object to processing based on legitimate interests, ask for erasure, and ask for rectification where a post is misattributed to them. The ICO's Right of access guidance explains the access right; your team needs a route to find all records for one person across platforms and tools.

Objection is the right most likely to bite. If someone objects to being monitored under legitimate interests, you must stop unless you can show compelling grounds that override their interests. In practice, adding them to an exclusion list is the simplest response.

Automated decisions and profiling need separate attention. Sentiment scoring that affects how a complaint is handled could count as a decision with legal or significant effect. Keep a human in the loop and document it. From bounded request to approved deletion, the workflow should show who authorises each removal.

Where other regimes intersect with ICO duties

The ICO is the relevant regulator for data protection compliance. Ofcom's online safety duties apply to regulated user-to-user services; collecting public posts for brand monitoring does not, by itself, make a monitoring team subject to those duties.

If your monitoring activity forms part of an online service likely to be accessed by children, the ICO's Children's code (Age appropriate design code) is relevant to that service's processing of children's data. Encountering a child's public post alone does not automatically make the code apply. If you share material about a credible threat, record why and with whom it was shared.

Advertising claims drawn from monitoring raise a separate advertising-compliance issue; they do not replace the ICO duties to identify a lawful basis and provide privacy information.

If monitoring outputs inform pricing or competitor decisions, assess any relevant competition-law obligations separately. The fact that information comes from public posts does not remove data-protection duties.

Financial services, health and telecoms firms may have additional sector-specific obligations. Keep those separate from the data-protection baseline and consult the layers of UK law that reach social listening.

Reading ICO enforcement action and decision notices as risk signals

The ICO publishes enforcement action, including fines, reprimands and decision notices. These are the clearest public signal of what the regulator treats as serious, and they are worth reading as a risk register rather than as news.

Recurring themes in enforcement include processing without a proper lawful basis, keeping data longer than needed, failing to provide clear privacy information, and weak security. Each maps directly onto a listening programme.

A reprimand is not a soft outcome. It is a public finding that processing fell short, and it often comes with an order to change practice within a set period. For a brand team, that is a template for what an ICO audit of your monitoring would look for.

Read the notices for the facts, not just the penalty. The aggravating factors usually describe missing records, absent DPIAs and rights requests handled badly. Those are the same gaps a compliance review will find in your own programme.

Keep a short internal summary of relevant notices and the lesson each one carries. Review it when you change platforms, queries or retention settings. That habit turns enforcement reading into a control rather than a reading exercise.

Documenting the accountability record your monitoring team must keep

Accountability means being able to show how you comply, not just asserting that you do. The ICO's Accountability framework can help structure your evidence. Keep records required under UK GDPR Article 30 where the duty applies, alongside a documented lawful basis, DPIA outcomes, retention schedules and rights request logs.

A retail brand in the West Midlands monitors mentions of its stores across three platforms. Screening flags systematic monitoring and large scale, so a full DPIA runs. Legitimate interests is recorded with a balancing test.

Raw posts are kept for a set period, aggregates longer. An exclusion list handles objections. A quarterly review checks deletion logs and any new platform. The accountability file holds all of it.

Common questions

Do we need consent to monitor public posts?

Usually no. Consent is impractical when you cannot reach every person whose post you collect. Legitimate interests is the common basis, provided you complete and record the balancing test.

Is a DPIA always required for brand monitoring?

Not always, but systematic monitoring of public platforms at scale is a named trigger. Screen every project, and run a full DPIA where the criteria are met.

How long can we keep social posts?

There is no single fixed retention period for all social posts. UK GDPR Article 5(1)(e) requires a period tied to your purpose; keep raw posts for less time than aggregates where appropriate, and be able to show deletion actually happens.

What happens if someone objects to being monitored?

You must stop processing their data unless you can show compelling grounds that override their interests. Adding them to an exclusion list is the usual practical step.

Can we reuse monitoring data for advertising?

Only if the new purpose is compatible with the original one or you have a fresh basis. Reuse for targeting needs its own assessment and updated privacy information.

Who regulates our listening programme?

The ICO for data protection, with Ofcom, the ASA and the CMA relevant depending on content, claims and market conduct. Sector regulators may add their own rules.