Rules and ethics
Part of Social media training rules and compliance: adjustments, accounts, assets
Learner data protection for social media training: purposes, roles and separate PECR checks
Set out learner data protection for social media training with a purpose inventory, controller and processor roles, separate PECR checks and a pre-launch checklist.
Social media training data protection begins with a purpose inventory, not a consent box. An English course may handle enquiries, workplace details, access requirements, attendance, recordings, assessment, platform identifiers and follow-up marketing. Record each purpose separately and use synthetic accounts and content until a named UK privacy reviewer has cleared any production use.
What to take away
- Record each processing purpose separately rather than relying on a single consent box.
- The Data (Use and Access) Act 2025 changed but did not replace the UK GDPR, DPA 2018 and PECR.
- A provider is not automatically a processor for every purpose in a training contract.
- PECR applies a separate electronic-communications analysis to later course promotions.
Use the current UK framework
The Data (Use and Access) Act 2025 changed, but did not replace, the UK GDPR, Data Protection Act 2018 and PECR. The ICO's June 2026 organisational summary says all its data-protection provisions are in force. That page is regulator guidance; the 2025 Act is primary legislation.
For every purpose, record the controller, any joint controller or processor, lawful basis, fields, source, recipients, retention, rights route, transfer and security. The ICO's April 2026 lawful-basis guide requires a valid basis and warns that a changed purpose may need a fresh decision. Do not infer that contractual attendance terms settle every reuse.
A worked purpose inventory makes that record concrete. The table below uses typical fields and indicative retention. Adjust each row to the actual course and document the reason.
| Purpose | Fields | Lawful basis | Indicative retention |
|---|---|---|---|
| Enquiry handling | name, email, phone, message | legitimate interests, or consent if required | 12 months after last contact |
| Attendance and assessment | name, attendance, marks, certificate record | contract | 6 years after course end |
| Access adjustment | health or access details | explicit consent or another Article 9 condition | 12 months after course end, then delete unless a claim is live |
| Course promotion | email address, consent status, opt-out | consent or soft opt-in | until withdrawal, then suppress for 24 months |
Set retention by purpose, not by system. Diary a review at least once a year and whenever the purpose changes. Delete or anonymise when the period ends.
Keep sensitive needs on a tighter path
An access request may reveal health information; an exercise could expose political opinions, trade-union membership or other special-category data. Avoid collecting it unless the purpose requires it and a specialist has documented the additional conditions and safeguards. Use a limited adjustment channel, restrict access and separate it from performance records.
Explain who sees recordings, trainer notes and marked submissions. Give learners the applicable privacy information before collection and a workable route for rights and complaints. The ICO's data protection by design guidance was updated in February 2026 following DUAA changes and calls for privacy to be embedded from the start.
Contract for actual roles
A provider is not automatically a processor for everything. It may decide some purposes itself and act on the buyer's instructions for others. If a processor relationship exists, the ICO's controller and processor contract guidance explains the written Article 28 arrangement and subprocessor requirements. The page is currently marked under review, so recheck it on publication day.
The contract and data map should agree on instructions, confidentiality, security, assistance with rights, incidents, audits, return or deletion and subprocessor changes. A signed data-processing clause does not prove those operations work.
Run PECR and security as separate gates
The ICO's Electronic mail marketing guidance (part of its Guide to PECR) applies a separate electronic-communications analysis to later course promotions. Research participation, learner registration and receipt of a certificate are not automatic sign-up routes.
For consent, use a separate unticked box that names course promotions, for example: "Send me course updates and promotions by email." Keep a record of when the learner opted in and provide an opt-out in every message.
The soft opt-in can cover similar courses where the learner's details were obtained during a sale or negotiations and each message offers a simple opt-out.
If course pages or learning systems use cookies, pixels or similar tools, review the ICO's Storage and access technologies guidance, final April 2026 version. A UK GDPR basis alone does not answer the PECR question.
Test role creation, least access, export, correction and deletion with synthetic records. Test backup treatment, incident reporting and account recovery. Stop live enrolment if role map disputed, notice wrong, access route exposes another learner or deletion cannot be evidenced.
Page remains an editorial hold until named reviewers examine the actual design. They cover privacy, PECR, employment, research. They cover security, accessibility, contract.
Before you act
- Build the purpose inventory and set retention for each purpose.
- Name the privacy reviewer and record their clearance before live enrolment.
- Route access and adjustment data through a restricted channel.
- Recheck the ICO Article 28 contract page on publication day.
- Log the result of each synthetic-record test.
Common questions
What should a social media training provider record for each processing purpose?
For every purpose, record the controller, any joint controller or processor, lawful basis, fields, source, recipients, retention, rights route, transfer and security. The ICO's April 2026 lawful-basis guide requires a valid basis and warns that a changed purpose may need a fresh decision.
When does a training provider act as a processor rather than a controller?
A provider is not automatically a processor for everything. It may decide some purposes itself and act on the buyer's instructions for others. Where a processor relationship exists, the ICO's controller and processor contract guidance explains the written Article 28 arrangement and subprocessor requirements.
Why is a UK GDPR basis not enough for course promotion emails?
The ICO's Electronic mail marketing guidance applies a separate electronic-communications analysis to later course promotions. Research participation, learner registration and receipt of a certificate are not automatic sign-up routes. If course pages use cookies or pixels, a UK GDPR basis alone does not answer the PECR question.
