Rules and ethics
Part of Sponsorship rates: the UK ad rules that shape your fee
Sponsorship rates and data protection in England: UK GDPR, PECR and the ICO fee
How UK GDPR and PECR consent rules and the ICO data protection fee of £52 to £3,763 add work and cost to a sponsorship deal, and how to price that into your rate.
What to take away
- Personal data in a sponsorship deal falls under the UK GDPR and the Data Protection Act.
- Marketing emails and texts need specific consent (PECR).
- Consent capture, record keeping and deletion take hours. Put those hours in the rate you quote.
- This is general guidance. A qualified adviser should review a real campaign.
Why data protection affects sponsorship rates
Data protection is not a side issue for your rates floor. It decides what a brand may lawfully do with audience data you hold, and that changes the work you must price. If a campaign needs consent capture, you carry that admin cost, so it belongs in the quote.
A giveaway shows how this works. You collect names, emails and sometimes postal addresses, and all of them are personal data. You must determine your lawful basis before you start using personal information, and you must document it (see the lawful basis guide).
Where PECR bites hardest
A brand may ask for your email list as part of a deal. Sharing it with a third party needs a clear lawful basis and an understandable privacy notice.
For emails and texts the position is simple: do not send marketing emails or texts to individuals without specific consent.
There is a limited exception for your own previous customers, often called the soft opt-in. It does not apply to prospective customers or new contacts, for example people on a bought-in list. A list built for one purpose should not be reused for another without a fresh check.
Buying a list or scraping emails for a sponsored push is a risk you should price in or refuse. Our hidden costs article covers other costs that rarely appear in a first quote.
The ICO data protection fee
Some creators and agencies must pay an annual data protection fee, which is a fixed business cost behind every rate. There are three tiers from £52 to £3,763, and for most organisations the fee is £52 or £78 (fee registration FAQs).
| Tier | Test | Fee |
|---|---|---|
| Tier 1 | Turnover up to £632,000, or no more than 10 staff | £52 |
| Tier 2 | Turnover up to £36 million, or no more than 250 staff | £78 |
| Tier 3 | Anyone outside tiers 1 and 2 | £3,763 |
Direct debit payment brings the fee down by £5. Someone who needs to pay and does not could be fined up to £4,000. Spread the fee across your deals for the year instead of treating it as a one-off surprise.
A comparison of duties by campaign type
The table maps common campaign elements to the data protection work they create. The right-hand column is a pricing prompt, not a figure.
| Campaign element | Data protection work | Effect on your rate |
|---|---|---|
| Sponsored post with no data collected | None beyond normal records | No uplift |
| Giveaway collecting names and emails | Lawful basis, privacy notice, retention and deletion | Add admin hours |
| Brand asks for your email list | Check lawful basis and notice before sharing | Add review hours or decline |
| Email or text promotion to your own list | Specific consent, or soft opt-in for past customers | Add consent-capture hours |
| Brand supplies its own list | Check the brand's notice and consent cover your sending | Add checking hours |
How to build compliance into a rate
Follow these steps before you quote.
- Map the personal data the campaign touches. If there is none, the uplift is zero.
- If emails or phone numbers are involved, estimate hours for consent capture, privacy notice drafting and deletion.
- Multiply those hours by your hourly rate and add the result to your base fee.
- Check whether the brand's own privacy notice covers the campaign. If not, the brand fixes it or you charge for the gap.
- Record your lawful basis and retention period in a short note.
Example: pricing a giveaway
The numbers below are illustrative arithmetic, not market rates. Suppose you estimate 2 hours for the consent wording, 1 hour for the privacy notice and 1 hour for deletion after the campaign, and you value your time at £50 an hour.
That is 4 hours at £50, so the data protection uplift is £200. If the brand's own notice already covers the giveaway, the privacy notice hour drops out and the uplift falls to £150. Show the uplift as a separate line on the quote.
Related checks
A signed contract does not settle every duty at once. Disclosure of a paid partnership is a separate matter from data law, so keep a disclosure policy alongside your data notes. The wider UK rules and compliance guide shows how both fit a fee.
Use the quality checklist before you sign, and read UK regulations to see which regulator owns each rule. Keep records of every decision, because they support your answer if anyone asks how you handled the data.
Before you quote
- List every piece of personal data the campaign collects or receives.
- Name the lawful basis for each use and record it.
- Check consent before any email or text promotion.
- Add consent, notice and deletion hours to the rate.
- Show the data protection uplift as its own quote line.
