Social listening UK regulations: five compliance layers

Source permissions are not implied by visibility

This guide maps social listening UK regulations while separating legal duties from platform terms. Public visibility does not itself authorise unrestricted collection. For each source, record the permitted route and limits on fields, purpose, retention, display and deletion. Platform terms are contractual, can change, and describe what a service permits rather than what UK law makes lawful.

England has no single social listening statute: applicable rules depend on access, identifiability, possible inferences and intended use. Stop if written permission excludes the planned act, and never bypass a blocked route. Intentional unauthorised access to computer material is an offence under section 1 of the Computer Misuse Act 1990.

Keep the terms version and date on file, and treat a permitted feed as the only safe starting point. The working map is a record of decisions, not legal clearance; UK legal reviewers should verify each operation before it is relied on.

Identifiable people bring data protection duties into scope

The UK GDPR applies only when information relates to an identifiable living individual. A post carrying a name or handle may meet that test, so define purpose, lawful basis, roles, notice, rights, retention and security before collection; record those choices in the data protection review.

Public availability does not remove the notice duty. The ICO privacy information guidance says privacy information remains due when personal data comes from publicly accessible sources unless an exception or exemption applies; a DPIA is needed if informing people is impossible or disproportionate in that specific context.

Later email targeting is not the same step as collection. Regulation 22 of PECR applies to unsolicited electronic mail sent for direct marketing to individual subscribers. Keep that later marketing use distinct from the UK GDPR question, which depends on whether collected information relates to an identifiable living individual.

Sensitive inferences and significant decisions need a higher check

If profiling infers ethnicity, beliefs, politics, health status, sexual orientation or sex life, it processes special category data. Identify a specific UK GDPR Article 9(2) condition alongside the Article 6 basis: Article 9(2)(a) requires explicit consent, Article 9(2)(e) applies only where the data subject manifestly made the data public, and Article 9(2)(g) requires a substantial-public-interest basis in UK law and a matching condition in Schedule 1 to the Data Protection Act 2018. If the material relates to criminal convictions or offences, check UK GDPR Article 10, section 10 of the Data Protection Act 2018 and the applicable Schedule 1 condition; Part 2, condition 10 (preventing or detecting unlawful acts) is available only if its requirements are met, not as a general permission for allegations.

Article 22 of the UK GDPR restricts solely automated decisions with legal or similarly significant effects. A topic label is not automatically such a decision, but require legal review before a label affects access, status or opportunity. Use the AI applications gate to identify cases for review against Article 22; it is not a separate legal test.

Reused content and public claims need separate tests

Platform access does not necessarily permit campaign screenshots, so assess copyright independently. Copyright prevents others using a work without permission. Section 30 of the Copyright, Designs and Patents Act permits quotation only where it is fair dealing, no more than the purpose requires, and sufficiently acknowledged.

A public claim based on listening evidence needs its own check: where the claim is an advertisement, assess it against the CAP Code, administered by the Advertising Standards Authority (ASA), and see the CAP Code advertising rules. A bounded sample cannot establish an England-wide preference, so describe the finding at the scope supported by the sample rather than generalising it. Keep the claim within the evidence.

Supplier duties and incident response need named owners

Contracts should allocate permissions, instructions, roles, security, rights support, deletion and audit duties. Article 28(3) bars a processor from engaging a sub-processor without written authorisation from the controller. Request supporting paperwork through supplier diligence and review allocation and exit terms in commercial contracts.

Assign every incident an owner. A notifiable personal data breach must be reported to the ICO without undue delay and within 72 hours of becoming aware of it. Include crisis monitoring in the same response plan, and rehearse escalation before an incident occurs.

Name UK legal, privacy, advertising, IP, security and ethics reviewers. Reopen approval after any material change, and narrow or stop unresolved activity rather than calling it compliant. Keep the decisions distinct, and give each review an owner before activity proceeds.