Why packaging marketing checks on essential requirements and UK data protection matter before print

What to take away

The Office for National Statistics recorded 337,000 business births in 2023, so supplier churn is high and compliance checks need a review date.
The Packaging (Essential Requirements) Regulations 2015 require minimisation and limit the sum of lead, cadmium, mercury and hexavalent chromium to 100 ppm by weight, so pack specs must be checked before print.
Data protection rules apply when a campaign collects addresses, emails or returns data, enforced by the Information Commissioner's Office across the UK.
Ecommerce platforms and fulfilment partners should work to Cyber Essentials or ISO/IEC 27001.
This is general guidance, not legal advice; individual cases need a qualified adviser.

Why packaging regulations catch marketing teams out

Packaging marketing often starts with a creative brief and a print deadline. The legal duties sit with the pack, not the campaign.

Under the Packaging (Essential Requirements) Regulations 2015, packaging must be minimised to the minimum adequate amount to maintain safety, hygiene and acceptance for the packed product and the consumer. The sum of lead, cadmium, mercury and hexavalent chromium must not exceed 100 parts per million by weight. The Packaging (Essential Requirements) Regulations 2015 are the primary source.

Compliance owner in artwork approval

Creative brief and print deadline set
Check essential requirements apply
Name owner in artwork approval flow
Change mailer, insert or outer box
Reapply essential requirements
Keep dated specification per production run
Supplier substitutes material: evidence shows compliance

Compliance is not a one-off sign-off. Change a mailer, insert or outer box and the essential requirements apply again.

If a supplier substitutes a material, the evidence you hold shows the pack still complies.

What data protection means for unboxing campaigns

When a customer scans a QR code, claims a gift or joins a list, you are processing personal data. The UK GDPR and the Data Protection Act 2018 apply, and the Information Commissioner's Office is the regulator. Consent must be specific to the packaging campaign, not bundled into a general sign-up.

A compliant consent line could read: 'I agree to [Brand] using the email address I provide to send unboxing offers and product updates. '

Data protection for unboxing campaigns

Scan QR code, claim gift or join list
UK GDPR and Data Protection Act 2018 apply
Consent specific to packaging campaign
Limit fieldsschool name, child's age
Delete data the campaign does not use
Set and document scan data deletion date
Map data flows before launch

A competition that asks for a school name or a child's age collects more sensitive data. Limit the fields you ask for and delete anything the campaign does not use.

Retention matters too. If you hold scan data to measure an unboxing experience, a suggested retention period is 12 months from collection. For competition entries, delete data 6 months after the winner is announced unless a legal reason requires longer. Our guide to packaging marketing data protection in England explains how to map these data flows before launch.

Cybersecurity standards for ecommerce platforms

Packaging campaigns often rely on landing pages, redemption portals and fulfilment systems. Weak access controls can expose customer data. Named standards include Cyber Essentials and ISO/IEC 27001, and BSI publishes cybersecurity standards guidance for ecommerce teams.

Ask suppliers how they handle access, logging and incident response, then put those answers in the contract.

Platform contracts should name who reports a breach and within what time. A named route matters more than a generic support email.

Supplier continuity before a print run

The Office for National Statistics publishes changes to business data covering births, deaths and survival rates. Check Companies House filings before committing to a long print run.

A compliance checklist before you print

Confirm the pack meets the essential requirements on minimisation and heavy metals.
Check the current text of the 2015 Regulations and keep a dated copy of the specification used for each production run, with a named approver and review date.
Map every data field the campaign collects and its retention period.
Check platform security against Cyber Essentials or ISO/IEC 27001.
Verify supplier status and keep your own copies of artwork and dielines.

How packaging marketing rules fit together

Packaging marketing sits across consumer protection, data protection and product rules. The Competition and Markets Authority can act on misleading environmental claims, and the Advertising Standards Authority applies the CAP Code to marketing communications.

Our packaging marketing UK rules and compliance guide for 2027 shows how these regimes interact, with notes on where England, Scotland, Wales and Northern Ireland differ.

Common questions

How do I check a supplier's environmental claims?

Ask for evidence behind any recyclability or recycled content claim, then check it against the CAP Code and CMA guidance. If the claim cannot be substantiated, remove it from the pack.

Does packaging marketing need a privacy notice?

Yes, if you collect personal data through a QR code, competition or redemption page. The notice must explain what you collect, why, and how long you keep it.

What happens if packaging fails the essential requirements?

Local trading standards enforce the essential requirements. Penalties on summary conviction can include a fine up to level 5 on the standard scale, currently up to £5,000 in England and Wales. The pack may need to be withdrawn.

Do these rules apply across the UK?

The essential requirements and data protection rules apply UK-wide. Some environmental and waste rules differ in Scotland, Wales and Northern Ireland, so check the devolved regulator where your packs are sold.