Data controller clause

The ICO told me that there is no need to register a business if the information collected is for the purposes of marketing the business to its customers.

If the business published a free membership site offering its customers information and using Google Ads for revenue and Google Analytics for analysis, would it still need the data controller clause in your privacy policy template?

79 viewsdata protection law

Alasdair Taylor's Answer

There is no need to notify if the business is only using personal data for one of the exempt purposes, and marketing to your own customers is an exempt purpose. The exemption is set out in section 5 of the Schedule to The Data Protection (Notification and Notification Fees) Regulations 2000. It covers the processing of personal information where:

The processing-

(a) is for the purposes of advertising or marketing the data controller?s business, activity, goods or services and promoting public relations in connection with that business or activity, or those goods or services;

(b) is of personal data in respect of which the data subject is – (i) a past, existing or prospective customer or supplier; or (ii ) any person the processing of whose personal data is necessary for the exempt purposes;

(c) is of personal data consisting of the name, address and other identifiers of the data subject or information as to other matters the processing of which is necessary for the exempt purposes;

(d) does not involve disclosure of the personal data to any third party other than – (i) with the consent of the data subject; or (ii) where it is necessary to make such disclosure for the exempt purposes; and

(e) does not involve keeping the personal data after the relationship between the data controller and customer or supplier ends, unless and for so long as it is necessary to do so for the exempt purposes.

Assuming you do not need to register, that does not mean that you are not a data controller. This exemption applies only to the requirement to notify, not to the other requirements of the Data Protection Act. Accordingly, you should still include in your privacy policy a statement identifying the relevant data controller. 

Ask a question

Question in one sentence
Select a topic that best fits your question.

Search questions


Using this legal Q&A, users can get guidance on business-related legal questions from our legal experts.

The guidance is not legal advice; no lawyer-client or similar relationship is created by the Q&A.

By using the Q&A, you agree to the limitations and exclusions of liability set out in our terms and conditions.

SEQ Legal
Copyright © 2021 Docular Limited | All rights reserved