Rules and ethics
Part of Guide to GDPR-compliant referral tracking for UK brands
Guide to GDPR-compliant referral tracking for UK brands
How UK brands can build GDPR-compliant referral tracking, using clear lawful bases, Article 14 notices and retention records that satisfy the ICO.
What to take away
- Referral tracking involves three groups of peoplethe referrer, the invited friend and the staff who approve rewards.
- Each group needs its own lawful basis, its own privacy information and its own retention period.
- PECR governs the invitation message itself, so who sends it matters as much as what it says.
- Write the purpose down before the first tracking event goes live.
- Subject access and erasure requests must reach referral records, not only the customer file.
Map the referral journey before you write any tracking code
A referral journey involves three parties: the referrer, the friend who receives the invitation, and the staff who decide the reward. Data protection law treats each separately, and the Data Protection Act 2018 provides the statutory framework that applies to all of them.
Referral journey: three parties
- Referrer invites a friend
- Friend receives the invitation
- Click event is recorded
- Staff decide the reward
- Each party is treated separately
Most teams map only the customer record. The friend's details, the click event and the reward decision sit in different systems, so accountability thins out exactly where it matters.
Choose a lawful basis for each party
Consent is not the only option, and for the referrer it is often the wrong one. A referrer is usually an existing customer, so legitimate interests or performance of a contract may already cover the processing.
Lawful basis by party
Referrer
- Likely basis
- Legitimate interests or contract
- What to record
- Balancing test, reward decision
Invited friend
- Likely basis
- Consent or legitimate interests
- What to record
- Article 14 notice date, data source
Staff approving rewards
- Likely basis
- Legitimate interests
- What to record
- Access controls, purpose limitation
The invited friend is different. Their details arrive from a third party, so Article 14 of the UK GDPR requires you to tell them where the data came from, normally within one month of obtaining it. That transparency duty is the step referral programmes most often miss.
An invitation feature is not consent, and treating it as consent is one of the risk patterns we set out in four loyalty strategy risks around undefined data purposes.
| Party | Likely lawful basis | What to record |
|---|---|---|
| Referrer | Legitimate interests or contract | The balancing test and how rewards are decided |
| Invited friend | Consent, or legitimate interests with a documented test | Article 14 notice date and the source of the data |
| Staff approving rewards | Legitimate interests | Access controls and the purpose limitation |
Build the tracking in six steps
The order below keeps the legal decisions ahead of the technical ones.
- Write the purpose in one sentence before any code is written.
- Choose a lawful basis for each party and record why you chose it.
- Limit tracked fields to a referral code, a timestamp, an outcome and the reward state.
- Put a retention clock on every referral record and delete on schedule.
- Give the invited friend a plain notice at first contact, with a working opt-out.
- Test a subject access request and an erasure request across referrer and friend records.
PECR and the invitation message
The Privacy and Electronic Communications Regulations (PECR) apply to electronic marketing sent by a business, not to a message one friend sends another from a personal account.
The distinction matters when a referral platform sends the invitation on the brand's behalf. The brand becomes the sender, and PECR then applies: email, text and push invitations to individuals need consent. The soft opt-in exception does not cover a friend who has never bought from you.
If the invitation promises a reward, the advertising codes also apply. The CAP Code requires marketing communications to be identifiable as such, and the Advertising Standards Authority publishes the codes that govern the claim.
Records, retention and accountability
The ICO's UK GDPR guidance explains the accountability principle, which expects records of processing, a retention schedule and evidence that decisions were made before processing began.
Retention is where referral schemes drift. A click that never converted has no ongoing purpose, so a short default clock is easier to defend than an open-ended one. Record the clock and the deletion evidence.
Before launch, it is worth checking the invitation route and the reversal journey, because the data a referral collects has to be reversible on request.
This is general guidance on current UK law. Individual programmes need a qualified data protection adviser.
Common questions
Does a referral link count as personal data?
A link alone may not be personal data, but once it carries a code identifying a referrer, or is combined with an account ID, it relates to an identifiable person.
Can we rely on legitimate interests for the invited friend?
Only with a documented balancing test that takes account of the friend's reasonable expectations. Consent is easier to defend when the friend has no existing relationship with the brand.
How long should we keep referral records?
Match the period to the purpose. Conversion data needed for reward disputes lasts as long as the dispute window, while clicks that never converted can go much sooner.
Who is the controller when a platform hosts the tracking?
Usually the brand is the controller and the platform is a processor, but the contract decides. Check the data processing agreement before launch.
