Guidance

Influencer Marketing Privacy Notice

Published 12 March 2025

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

1. Your Data

1.1 Purpose

The purpose for which we are processing your personal data is to undertake due diligence checks on potential influencer partners. 

In the majority of cases, the Cabinet Office uses agencies to help us select appropriate influencers to support government communication campaigns. Agencies will provide the Cabinet Office with a short list for each communication campaign.  As part of this process, agencies will perform due diligence checks across social and news media to help the Cabinet Office  decide who to award the contract to. The Cabinet Office will then conduct a review of the shortlist, before making a decision. As part of this review, the Cabinet Office may wish to run further due diligence checks itself. The rationale for the decision will be laid out in a selection report. In some cases, agencies are not used and the Cabinet Office will conduct all checks itself. 

Due diligence checks are carried out to ensure that individuals are not engaged whose social media profiles and content could undermine a specific campaign. A campaign could be undermined by engaging an individual who has expressed extreme views (as defined in the GCS SAFE Framework) or who presents a reputational risk to the Government, for example because they have previously expressed views that are contradictory to the specific campaign message. The general purpose is to ensure that government advertising meets the challenges of online communications whilst providing information that is vital in improving the lives and livelihoods of the UK public. 

All assessments are based on specific campaigns. Just because an influencer has been deemed unsuitable for one campaign does not necessarily exclude them from use in other campaigns. 

1.2 The data

To provide effective recommendations, Cabinet Office and/or contracted agencies will process personal data which may include the following: 

Name, social media name/identifier, sexuality, race, religion, political or philosophical beliefs, and criminal convictions. 

The personal data will be processed where it is relevant to an influencer’s suitability for the particular campaign, including any risk that their engagement could undermine the campaign’s purpose or message. 

1.3 Data controllers

If Cabinet Office and an agency perform the due diligence checks, they are independent data controllers of the personal data processed. If Cabinet Office performs the checks alone, they are the sole data controller.

1.4 Legal basis of processing 

The legal basis for processing your personal data is because it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. Here the legitimate interests being pursued are those necessary to ensure that the use of influencers in government campaigns is appropriate and not detrimental to the relevant campaign, thereby ensuring the delivery of public services is effective and supports ministerial priorities (Article 6(1)(f) UK GDPR).

Special category or criminal offence data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data is for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or relating to criminal offence. The legal bases for processing your sensitive and criminal offence personal data are: 

• the processing relates to personal data which are manifestly made public by you on your social media platforms or in the media (para 32, sch.1, Data Protection Act 2018). 

• processing is of data concerning ethnicity, religious or philosophical belief, health including disability or sexual orientation, and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained. In this case that is our Public Sector Equality Duty under the Equality Act 2010 (para 8, sch.1, Data Protection Act 2018).  

• processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment. In this case that is Cabinet Office’s public function to publish communications about Cabinet Office policies and initiatives (para 6, sch.1, Data Protection Act 2018). 

1.5 Recipients

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services. 

1.6 Retention 

Your personal data will be kept by the Cabinet Office for 12 months. Campaigns run on financial-year cycles so will be completed within 12 months and the influencer activity will have finished. 12 months enables us to have an audit record if decisions are challenged and a record of recent decisions regarding a particular influencer. Cabinet Office may retain some personal data beyond this period where necessary to do so for the purpose of legal proceedings. 

1.7 Where your data was not obtained from you 

Your personal data will be obtained by the Cabinet Office, or by our agencies, directly from you or via publicly available accounts on social media platforms. They may also have been obtained from news websites. Only data that is already in the public domain is processed. 

2. Your rights 

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement. 

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

If you wish to make a request, please contact our Data Protection Officer whose details are provided below. 

3. International Transfers 

As your personal data is stored on our Corporate IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or reliance on a UK International Data Transfer Agreement.

4. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at: 

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

or 0303 123 1113, or icocasework@ico.org.uk. 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

5. Contact Details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office,
70 Whitehall,
London,
SW1A 2AS

or 0207 276 1234, or you can contact gcs@cabinetoffice.gov.uk. 

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk. 

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.