Packaging marketing data protection explained for England teams

Personal data : Information about an identifiable person that a campaign collects or uses.

UK GDPR : The framework governing an organisation's processing of personal data.

PECR : Rules that apply to electronic marketing and cookies or similar technologies.

Lawful basis : The reason for processing personal data for a particular purpose.

Profiling : Using information such as purchase history to vary packaging inserts or offers.

DPIA : An assessment made before processing likely to create high risk to people.

Processor : A supplier that handles personal data for an organisation, such as a printer or fulfilment house.

Trace personal data across a campaign

Start by identifying where a pack or related campaign collects or uses personal data. A QR code, prize draw entry or loyalty sign-up can bring the unboxing experience into contact with data protection duties, even if the packaging itself carries no personal details.

The UK GDPR and Data Protection Act 2018 apply in England, while PECR adds requirements for electronic marketing and access to information on a device. These rules can matter at different points in one campaign, so map the data route from collection through use, sharing and deletion. The wider data protection law context helps distinguish those obligations.

Match each use to a lawful basis

Choose and record a lawful basis for every purpose before processing begins. The UK GDPR lists seven lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests and, since the Data (Use and Access) Act 2025, recognised legitimate interests. A commercial campaign may rely on some of these, but PECR can impose separate requirements for a message or device access.

For example, using a customer's name and address to fulfil an order for a personalised box is based on contract, rather than consent. A newsletter sign-up connected to a pack insert may use consent. Legitimate interests may be suitable for fraud checks or basic campaign analytics if the organisation documents its balancing test.

Use this routing sequence before collecting or using campaign data:

Changing the basis after processing has started can be difficult, which makes an early decision useful. A disclosure policy should make the purpose and basis consistent with the information provided across the campaign's different channels.

Keep electronic marketing apart from device access

PECR treats electronic messages and access to information on a person's device as separate questions. For email, text and automated calls to individuals, prior consent is generally required unless the soft opt-in applies.

That exception, in PECR Regulation 22, applies only when the sender obtained the contact details during a sale or negotiation of a sale, markets its own similar products or services, and offered an opt-out when the details were collected and in every message. Marketing to someone who only entered a prize draw would not meet it.

A QR-code landing page raises a different issue. PECR Regulation 6 covers cookies and similar technologies that store information on, or access information from, a person's device. Non-essential cookies, including analytics or advertising cookies, require consent before use; the exception is technology strictly necessary to provide a service someone requested. The promotion rules offer further campaign context.

Do not treat a pre-ticked box as consent. Keep a record of what a person agreed to and when, and provide a clear route to submit a request or opt out. The distinction matters because permission for an electronic message does not itself settle whether a cookie may be placed on a device.

Review profiling before varying the pack

Profiling includes using purchase history to change which inserts or offers people receive. Explain that use transparently and identify its lawful basis before it begins. Audience research provides context on how data can inform audience decisions, but does not remove the need to assess the campaign's own processing.

The UK GDPR restricts decisions based solely on automated processing when they have legal or similarly significant effects, and the Data (Use and Access) Act 2025 reworked those rules. Safeguards can include human intervention and a right for a person to contest the decision; check the ICO's current guidance before relying on automated decisions.

A DPIA is required before processing likely to result in high risk to people. Large-scale profiling or new technology can indicate that risk, but the particular processing must be assessed against the ICO's criteria. Record the purpose, data minimised and retention period as part of the assessment.

Set boundaries with processors and transfers

Printers, fulfilment houses and courier partners may be processors when they handle campaign data for an organisation. Written processor contracts should describe the organisation's instructions, required security and breach notification arrangements. Check that campaign tracking software meets current security expectations, including whether the supplier holds ISO/IEC 27701 certification for privacy information management, which BSI describes in its data privacy guidance.

If campaign data will be transferred outside the UK, check the international transfer rules before it takes place. Where needed, use an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and complete the required transfer risk assessment.

Make notices, rights and records practical

Provide a privacy notice when personal data is collected or obtained from another source. Under UK GDPR Articles 13 and 14, explain who is responsible, why the data is used, the lawful basis and retention period, who receives it and how people can exercise their rights.

Depending on the circumstances, people may have rights to access, rectify or erase data, restrict processing, obtain portability or object. Give them a clear way to make a request and establish a process for responding. Keep records of processing activities under Article 30 where required, including purposes, data, recipients, retention periods and security measures.

Check whether the organisation must pay the ICO data protection fee and appear on its register; controllers that are not exempt must pay. The ICO's online data protection fee self-assessment tool on its website can help determine whether an exemption applies. A data protection officer is required for public authorities or bodies and for certain organisations whose core activities involve specified large-scale processing or monitoring.

Prepare for a personal data breach as part of the same operational process. If a breach risks people's rights and freedoms, notify the ICO within 72 hours of becoming aware of it. Campaign procedures should connect requests, records and incidents, alongside the broader compliance guide.

Worked example: a QR code on a gift box

A brand adds a QR code to a gift box. It leads to a page with a prize draw, a newsletter box and an analytics script. Each element has its own check.