Travel creator campaigns data protection explained for UK teams

What to take away

Data protection in travel creator campaigns means knowing who is responsible for each set of personal data and having a lawful basis to use it. The main duties sit with the brand as controller, but creators and agencies can carry them too.

Who is responsible for what

The starting question is who decides why personal data is used. That party is the controller under UK GDPR, and the answer shapes every contract you sign.

Brands, creators and agencies in the chain

A brand running a paid trip usually decides the purpose and means, so it is the controller. A creator filming on that trip may be a controller for their own mailing list or comment moderation. An agency can be a processor if it only acts on written instructions.

Put that split in the contract before the first brief goes out. Name who handles complaints, who holds the suppression list and who answers an erasure request. If a creator sells merchandise or runs a newsletter, they need their own privacy notice, not yours.

For the wider contractual picture, the travel creator campaigns UK rules and compliance guide sets out the other duties that sit alongside data protection.

Creator handovers and audience lists

A common request is a creator handing over email addresses collected during a giveaway. That is a change of purpose, and the original notice probably does not cover it. Ask for consent to the handover at the point of collection, or do not take the list.

If you do receive a list, check the wording the creator used. Consent must be specific, informed and freely given. A tick box that bundles a newsletter with a competition entry is weak evidence. Article 7(1) of UK GDPR puts the burden of proof on you.

Electronic marketing and consent

E-marketing rules apply to email, text and some social messaging, not just to bulk email platforms. A direct message asking someone to join a campaign can fall inside them.

What PECR requires for outreach

The ICO guide to PECR covering electronic marketing rules relevant to influencer outreach explains that consent is normally needed to market to individuals by electronic means, with a limited soft opt-in for existing customers. Keep the opt-in record, the date and the source.

The email rule sits in regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003. Consent for the underlying personal data sits in Article 6(1)(a) of UK GDPR.

Consent records, wording and retention

Build a simple log: name, source, date, wording shown and the action taken. Store it where you can retrieve it within one month. Consent does not last forever, so refresh it when the purpose changes.

A workable consent line reads: 'I agree to [brand name] emailing me about trips and campaigns, and to [brand name] sharing my email address with the agencies working on those campaigns.' Keep the exact wording with the record.

For campaign consent records, 24 months from the last interaction is a typical retention period. Set the period by the purpose, write it in the data map and delete the record once it passes.

An erasure request under Article 17 covers data a creator holds on your behalf. Pass the request down the chain in writing and confirm when it is done.

The ICO has published fines of £20m for British Airways and £18.4m for Marriott, both in 2020 over data security failures.

Decision table

Misleading claims and platform duties

The data side does not sit apart from advertising standards. A campaign that hides the commercial relationship can mislead, and that is a separate risk.

Advertising rules that overlap

Unfair commercial practices law, including the Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024 (DMCC Act 2024), captures misleading endorsements, not the Pensions Act 2008. Platform policy adds another layer: Misrepresentation - Advertising Policies Help sets content standards that affect where paid creator content can run.

The overlap matters because a disclosure failure often surfaces through the same complaint as a data mishandling issue. The travel creator campaigns advertising rules set out labelling and platform requirements in detail.

International transfers

Multi-country campaigns usually move personal data out of the UK. Chapter V of UK GDPR, Articles 44 to 49, governs those transfers.

An adequacy regulation under Article 45 is the simplest route, and the ICO lists the countries covered. Otherwise use the International Data Transfer Agreement or the Addendum to the EU standard contractual clauses, both Article 46 tools, with a transfer risk assessment.

Map where the data actually sits for every creator and agency in the chain, including the mailing platform and the spreadsheet behind it. Put the chosen mechanism in the contract.

This is general guidance only. Individual cases need a qualified adviser, particularly where a campaign spans several countries or involves health, religion or children's data.

Common questions

Do we need consent to email a creator about a campaign?

Usually yes, unless a soft opt-in applies. A one-off business-to-business approach to a corporate address is treated differently, but the safest course is a documented basis for every send.

Who answers a subject access request in a creator campaign?

The controller does. If a brand is the controller, the brand answers, even when an agency or creator holds the data. Contract terms should require them to pass requests on promptly.

Can we reuse a creator's audience list for our own marketing?

Only if the original consent covers that use. Take a new opt-in at the point of collection, or treat the list as unusable for your purposes.

How long should campaign data be kept?

There is no single figure. Set a period that matches the purpose, document it, and delete once it passes. A short review date in the data map keeps this honest.