Rules and ethics
Part of Privacy first measurement rules: five decisions before you launch
Privacy first measurement data protection: UK GDPR record
Privacy first measurement data protection: turn a flow into a UK GDPR Article 30 ROPA, with purposes, roles, lawful bases, transfers and retention.
Privacy first measurement data protection starts with a purpose-by-purpose record of personal information, not a promise that the output is aggregated. The person-level events used to create a total may still fall within the UK GDPR even when the final chart names nobody.
This guide is for an England-based operation under the UK data-protection regime. It does not decide whether a particular identifier is personal data or provide legal advice. The cited ICO pages were examined on 5 September 2026 and several carry notices that they are under review following the Data (Use and Access) Act 2025.
What to take away
- A purpose-by-purpose record of personal information is the starting point, not a promise that output is aggregated.
- Person-level events used to build a total can still fall within the UK GDPR even when the final chart names nobody.
- Each use needs its own lawful basis, necessity reasoning and documented handling of objections, withdrawal and erasure.
- A PECR assessment for device storage or access is separate from the UK GDPR basis for later processing.
- Run a DPIA where processing is likely to present high risk, and reopen it after changes to purpose, identifier, destination, model, retention or supplier.
Describe the information before classifying it
Data inventory fields
- Event, timestamp, device value
- Account reference, campaign parameter
- Location, audience label
- Model input, export
- Source, recipient, join keys
- Retention, access, deletion route
Test identifiability across the whole environment. A random identifier can still single out or link activity. An aggregate may expose a small group. Supplier language such as "de-identified" should prompt a technical question about reversibility and available auxiliary data, not an automatic conclusion.
Give each purpose its own legal record
Reporting, audience creation, personalisation, advertising activation, security and product improvement are not one purpose merely because one platform supports them. For each purpose, record the lawful basis under Article 6 UK GDPR: consent, contract, legal obligation, vital interests, public task or legitimate interests. Select it before processing and document why it fits; where relying on legitimate interests, complete a legitimate interests assessment (LIA) recording the purpose, necessity and balancing test. The ICO's lawful-basis guidance explains the choice, but the basis and assessment must match the specific purpose and relationship with the person.
Create a controller record of processing activities (ROPA) under Article 30 UK GDPR. Article 30 does not prescribe a particular form; a register with a row for each distinct processing activity is a practical structure. Include these fields:
- Controller name and contact details; joint-controller and representative details, and the data protection officer's (DPO's) contact details, where applicable.
- The purpose or purposes of processing.
- Categories of data subjects and categories of personal data.
- Categories of recipients.
- Transfers to third countries or international organisations, including the destination and safeguard used. For a restricted transfer, record the applicable route, such as an adequacy regulation or the International Data Transfer Agreement (IDTA), and keep the safeguard documentation.
- Envisaged time limits for erasure, where possible. Use a retention schedule that records a period or criteria and a deletion trigger for each data class.
- A general description of technical and organisational security measures, where possible.
If acting as a processor, keep the separate Article 30(2) record for each controller, the categories of processing carried out on its behalf, relevant transfers and security measures. For an auditable measurement record, also add columns for the Article 6 basis and rationale, the PECR assessment, and the review owner and date; these are useful controls, not additional Article 30 fields.
Purpose legal record
- Narrowly worded purpose and intended decision
- Controller and any joint controllers
- Lawful basis and necessity reasoning
- Special-category or offence-data condition
- People affected and applicable rights
- Action on objection, withdrawal or erasure
This record is separate from a PECR assessment. Device storage or access may require consent or fit a statutory exception even when later processing has another UK GDPR basis.
Apply the principles to the design
Article 5 UK GDPR sets out seven data-protection principles: lawfulness, fairness and transparency; purpose limitation; minimisation; accuracy; storage limitation; security; and accountability. Turn each principle into a test.
Ask whether a field changes the stated decision. Remove it if it does not. Set a retention schedule for each data class, recording the period or objective criteria, the event that starts the deletion clock, and the route for deletion across warehouses, exports and backups. Limit access by role. Reconcile a sample report to its underlying records, because inaccurate joins can affect people as well as budgets. Keep evidence of the choices and failed tests.
Tell people what actually happens
Article 13 UK GDPR sets out information to give when personal data is collected from the person. The ICO's right-to-be-informed guidance says privacy information should cover matters including purposes, retention and sharing, and should be concise and accessible. A generic notice that says "we use data to improve services" is unlikely to explain advertising audiences, cross-service matching or modelled conversion reporting.
Use layered information where detail would otherwise swamp the immediate choice. Keep the short notice consistent with the full data map, contracts and live configuration. Update people before a new use starts where the guidance requires it.
Escalate risk before collection
Article 35 UK GDPR requires a DPIA before processing likely to result in high risk to people's rights and freedoms. Article 35(3) gives examples: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, with legal or similarly significant effects; large-scale processing of special-category or criminal-offence data; and large-scale systematic monitoring of publicly accessible areas. Use the ICO's DPIA guidance and screening material to assess the proposal; record data flows, roles, risks, mitigations and less intrusive alternatives. A DPIA is an analysis, not a form-filling exercise.
Approval should name the data owner, technical reviewer and qualified privacy reviewer. Reopen it after a new purpose, identifier, destination, model, retention rule or supplier change. No checklist or tool label can guarantee that continuing operation complies.
Before you act
- Open an Article 30 ROPA and record the controller or processor details, purposes, data-subject and personal-data categories, recipients, transfers and safeguards, retention, and security measures.
- Record the Article 6 lawful basis and rationale for each purpose; where relying on legitimate interests, retain the LIA and balancing test.
- List every collected or derived item with source, recipient, join keys, retention, access and deletion route.
- Test identifiability across the whole environment, including random identifiers and small groups.
- Assess PECR regulation 6 separately where device storage or access is involved.
- Turn each of the seven data-protection principles into a test.
- Keep the short privacy notice consistent with the full data map and live configuration.
- Name the data owner, technical reviewer and qualified privacy reviewer in the approval.
Common questions
Does aggregated measurement output fall outside the UK GDPR?
No. The person-level events used to create a total may still fall within the UK GDPR even when the final chart names nobody. An aggregate may also expose a small group, so identifiability should be tested across the whole environment rather than assumed from the output.
Can one lawful basis cover reporting, advertising and product improvement?
No. Reporting, audience creation, personalisation, advertising activation, security and product improvement are not one purpose merely because one platform supports them. The ICO says the appropriate basis depends on the purpose and relationship with the person, and it must be documented before handling.
When should a DPIA be reopened?
Reopen it after a new purpose, identifier, destination, model, retention rule or supplier change. The ICO expects an explanation of data flows, roles, risks, mitigations and less intrusive alternatives. Approval should name the data owner, technical reviewer and qualified privacy reviewer.
