Rules and ethics
Part of Video marketing agency compliance checks for UK campaigns
Nine data protection checks for video marketing agencies
Data protection for video marketing agencies comes down to the lawful basis, a retention schedule, deletion proof and evidence behind every claim in the edit.
What to take away
- The mistake most teams make first is treating a signed contributor release as the whole answer. Nine data protection checks for video marketing agencies start with the lawful basis instead. Footage of an identifiable person is personal data, and a release covers only part of the duty.
- Decide the lawful basis before the camera rolls. Consent and legitimate interests create different records and different risks.
- Put retention and deletion dates in the contract, so rushes do not sit on an agency drive for years.
- Treat fixed surveillance recording as its own regime, with signage, a documented purpose and a route for access requests.
- Every claim in the finished video needs evidence behind it, because consumer protection law applies to the edit as much as to the script.
Who is the controller when a video marketing agency films people?
Under the UK GDPR, the controller decides why and how personal data is processed. Brands often assume the production company carries that duty because it holds the footage. That assumption is usually wrong.
Who is the controller?
Who sets the purpose?
commissioner is controller
agency may be controller
If you commission the film and set the purpose, you are the controller and the agency acts as your processor. Where the agency also uses clips for its own showreel, both parties may be joint controllers for that use.
Settle this in writing before the shoot. Our guide to video marketing agencies commercial contracts sets out the clauses that carry the most weight.
Where a shoot uses fixed cameras that record continuously, the ICO's CCTV and video surveillance guidance sets out the signage, retention and access rules that apply.
Controller status turns on the facts, so individual arrangements need a qualified adviser.
What lawful basis covers filming identifiable people?
Consent is one option, not the only one. Legitimate interests can support general filming where the person is incidental to the scene and holds no reasonable expectation of privacy.
Consent vs legitimate interests
Consent
- Best for
- interviews, testimonials
- Privacy expectation
- high
- Withdrawable
- yes
- Special category data
- needs Article 9 condition
Legitimate interests
- Best for
- incidental filming
- Privacy expectation
- none reasonable
- Withdrawable
- not applicable
- Special category data
- needs Article 9 condition
For interviews, testimonials and close-up portraits, consent is easier to defend. It must be specific, informed and withdrawable, which is a higher bar than a signature on a release form.
Health, ethnicity, religion and similar details are special category data. Filming them needs a separate condition under Article 9 of the UK GDPR, and a signed release does not supply one.
How long can you keep raw footage?
Storage limitation is the rule that catches most productions. Rushes, casting tapes and unedited interviews are personal data, and holding them just in case is hard to justify.
Set a retention period for each category and record it. For example, a brand that archives every rushes folder for three years is holding identifiable footage long after the campaign ends.
Deletion should be provable. Ask the agency to confirm in writing that files, backups and rough cuts have gone, then keep that confirmation with the project file.
What are the nine data protection checks for a video marketing agency?
The Consumer Protection from Unfair Trading Regulations 2008 prohibit misleading actions and omissions, and they apply to video content that promotes a product or service.
- Map every point where personal data enters the productioncasting tapes, contributor interviews, location releases, drone footage and testimonial clips.
- Name the controller for each activity in the statement of work, alongside the wider duties in our video marketing agencies UK rules and compliance guide.
- Record the lawful basis and complete a legitimate interests assessment where that basis applies.
- Write retention periods, deletion dates and backup handling into the contract schedule.
- Brief the crew on signage, restricted areas and who handles an objection raised on location.
- Keep evidence for every factual claim and check the cut against the rules the ASA and CAP administer.
- Route access, objection and erasure requests to a named person, with a diary note for the one-month response window.
- Run a data protection impact assessment before any shoot that monitors a public area or captures special category data at scale. UK GDPR Article 35 requires it for high-risk processing.
- Audit the editing and storage stack. Cloud tools such as Adobe Creative Cloud, Frame.io, Dropbox and Google Drive need an Article 28 processor contract and transfer safeguards if data leaves the UK.
Common questions
Does a model release replace a privacy notice?
No. A release deals with permission to use someone's likeness, while a privacy notice explains what you do with their personal data. You usually need both, and the notice should reach people before filming starts.
Who is liable if footage is misused?
Liability follows the roles in the contract and the facts of the processing, so a controller can be answerable for a processor's breach. Individual cases need a qualified adviser.
Do the same rules apply across the UK?
Yes. The UK GDPR and the Data Protection Act 2018 apply in England, Scotland, Wales and Northern Ireland, and the ICO regulates across all four. Filming on location does not change the regime when you cross a border.
