Rules and ethics
Part of Multilingual social marketing rules and ethics: what to record
Data protection for multilingual campaigns starts with refusing proxy inference
Map multilingual campaign data in England without proxy inference, and separate UK GDPR, DUAA, PECR, transparency, rights and security decisions.
What to take away
- A name, postcode or nationality does not establish a person's language, literacy, consent or vulnerability. Ask for a self-described language and format need instead.
- UK GDPR and the Data Protection Act 2018 carry the core duties. The Data (Use and Access) Act 2025 amended them, and PECR still governs electronic marketing.
- Record who decides why each processing step happens. A supplier label in a contract does not settle controller or processor status.
- A platform consent mode, ad setting or audience control does not select a UK GDPR basis or satisfy PECR.
- Build a data map holding purpose, source, permitted use and retention before translation work starts.
Refuse proxy inference before you translate
Multilingual data protection begins with purpose and data flow, not a translated consent box.
A name, postcode or nationality does not establish a person's language or literacy. It does not establish culture, vulnerability or consent either.
Ask for a self-described language and format need only where the declared purpose requires it. Record the task, source, date, permitted use and retention separately from marketing eligibility.
Research participation, service-language choice, testimonial permission and later sales contact are separate activities. Do not move a preference from one context into another without a new purpose and a review.
Teams wanting a method for asking, recording and retiring language data can follow our guide to researching a multilingual audience without labelling people by language.
Example: a name-based inference in paid social
Illustration, not a named client. A team wants to reach Polish-speaking shoppers in one English city, so it filters a customer list by surname patterns and uploads the matches as a social advertising audience.
That is inference, not observation. A surname proves nothing about language, reading level or consent, and the upload creates a fresh purpose needing its own basis, notice and retention period.
Take a second pattern. A brand holds direct messages with people who replied to a Welsh-language post, then adds those handles to a marketing list. Where the ICO treats a social direct message as electronic mail, that step needs a PECR permission route.
Identify roles from decisions
Controller status follows from who determines the purposes and essential means of processing. Record the evidence step by step instead of relying on a supplier's self-description.
- Record who set the campaign purpose and audience rule.
- Record who chose retention length and deletion triggers.
- Record who answers rights requests and breach queries.
- Record whether the supplier may process the data for its own purposes.
Where a processor relationship applies, the contract must cover processing details, instructions, sub-processors, rights assistance and deletion. ICO guidance on terms that must be included in the contract lists those clauses.
That evidence has to match the signed terms. Read our breakdown of what a multilingual social marketing contract must pin down, from parties to exit, before signing.
Build the data map and set retention
| Data map field | What it holds |
|---|---|
| Task and purpose | The job the data serves and the lawful basis chosen |
| Source | Where each item came from and the notice shown at the time |
| Language evidence | Self-described need, never a name or postcode guess |
| Roles | Controller, joint controller or processor for that step |
| Recipients | Platforms, agencies and any export destination |
| Retention | Period, review trigger and deletion log |
Set retention per purpose, not per database. A matched advertising audience can expire when the campaign closes, while a support record may need longer. Log each deletion so the next review can verify it.
Publication stays on hold while the data map, role analysis, transparency or withdrawal route is incomplete.
Read the framework and PECR together
- Check duties under UK GDPR and the Data Protection Act 2018, including fairness, minimisation, accuracy and transparency.
- Check the commencement position for the Data (Use and Access) Act 2025 provisions you rely on. The Act is 2025 c. 18, and the ICO's page on what the DUAA means for organisations sets out what it treats as in force.
- Apply PECR separately to electronic marketing and to technology that stores or reads information on a device.
- Record the permission route for each message type and keep the evidence in the campaign file.
A consent mode setting is not a lawful basis, and it is not PECR consent for every channel.
Where the ICO treats a social direct message as electronic mail, the soft opt-in may be available. It requires details collected during a sale or negotiations, a similar product, and an opt-out at collection and in every message. Otherwise consent applies. The ICO's guidance on direct marketing using electronic mail covers those conditions and similar stored messages.
Common questions
Can a name, postcode or nationality show someone's language needs?
No. None of those facts establishes language, literacy, culture or consent. Ask the person, or use published language statistics for planning rather than individual targeting.
Does a platform consent mode satisfy UK GDPR and PECR?
No. It records a platform-level choice, but it does not select your lawful basis or give PECR permission. Keep your own record of message type, recipient status, preference evidence and opt-out handling.
Who is the controller when a platform, an agency and a brand all touch the data?
It depends on who decides the purpose and essential means at each step. Platform terms, an agency contract and your own instructions are all evidence, and joint controllership is possible.
How long can inferred language data be kept?
Prefer self-described data, and keep an inference only while the stated purpose lasts. Tie a match list to the campaign end date, then delete it and log the deletion.
