How to Collect and Use Customer-Declared Preference Data

Zero-party data is the marketing term for information a person intentionally and proactively gives an organisation: communication choices, product preferences, stated intentions, circumstances relevant to a service, quiz answers, profile settings, survey responses, configuration choices.

The term is useful because it separates what someone declares from what an organisation infers by watching them. It is not a statutory category, and it changes none of the legal or ethical responsibilities attached to the information.

A serious programme therefore asks more than how many answers it collected. It asks whether the customer understood the interaction, received something useful in return, could decline without penalty, supplied information actually suited to the decision, and can later correct or withdraw it.

For the technical environment in which this information is stored, governed and activated, see the companion guide to first-party data measurement and activation.

What zero-party data means

A practical definition is information a person intentionally and proactively provides, such as preferences, intentions, circumstances or communication choices.

It can be collected through a preference centre, a recommendation quiz, an assessment, a product configurator, onboarding, a survey, a feedback interaction, account settings, a conversation or a loyalty programme. Once collected, it also forms part of the organisation’s first-party data. The distinguishing feature is the collection interaction: the person is asked, rather than observed.

Why it is not a legal category

UK data-protection law creates no separate zero-party class with relaxed requirements. Where a declared preference relates to an identifiable person, the organisation still has to consider purpose, transparency, lawful basis, direct-marketing rules, data minimisation, accuracy, sensitivity, retention, sharing, security, individual rights and the consequences of the decision made with the information. The data-protection principles apply regardless of the marketing label. (1)

Intentional provision is not automatic consent

Where consent is the lawful basis relied on, it must be freely given, specific, informed and unambiguous, and it must be demonstrable and easy to withdraw. The ICO addresses this directly with an online survey example: submitting the form indicates agreement to the processing needed for the survey itself, but by itself it is not enough to show valid consent for further uses of the information. (2)

An email address given so that quiz results can be delivered does not authorise every later marketing use of that address.

Electronic marketing engages separate rules again. Intentionally providing a preference does not authorise email, text, advertising activation or unrelated profiling. Marketing email or text to individuals generally requires consent unless a limited exception applies, and the direct-marketing requirements have to be assessed separately for the channel, the purpose and the relationship involved. (3)

Declared and observed information answer different questions

Information type	Can help indicate	Cannot safely be assumed to reveal
Declared preference	What the person says they prefer in the stated context	A permanent preference or future behaviour
Declared intention	What the person currently plans or expects	What they will actually do
Declared circumstance	A situation the person reports	That it has been independently verified
Observed purchase	What was bought in that transaction	Motivation, satisfaction or future preference
Observed click	That an interface event was recorded	Genuine interest, understanding or intent
Observed non-response	That no response was recorded	Disinterest, refusal or lack of need
Inferred segment	A model’s classification	The person’s identity or self-description

Research on the intention-behaviour relationship shows that changing stated intentions does not translate one for one into changed behaviour. (4) Other research indicates that asking an intention question can itself affect the relationship between the reported intention and the later behaviour. (5)

The right response is not to declare behaviour truthful and statements unreliable. It is to preserve the source, the date and the question wording, distinguish fact from preference from intention from inference, validate where the decision requires it, and allow for uncertainty and change.

I hold a strong version of this, and I should disclose that I have a commercial interest in it, because the business I run now is built on purchase data only. My argument is that behavioural footprints are so individual that inferring intent from them is largely guesswork, while a completed purchase is a fact. Ten years of watching teams build elaborate assumptions on browsing patterns did not produce reliable decisions. That is a commercial position rather than a legal one, and a reader who disagrees with it can still use everything else in this article.

Start with a useful customer outcome

Do not begin with a list of things the marketing team would like to know. Begin with a customer task: finding a suitable product, configuring a complex purchase, reducing irrelevant communications, choosing a service plan, recording accessibility or delivery needs, saving settings for a later visit, giving feedback on a completed interaction.

For every question, complete this sentence. We ask this question so that we can provide this immediate or clearly explained outcome; the answer is used for this purpose, remains valid for this period, and can be changed through this route.

Do not collect an answer when the organisation cannot use it, when a less intrusive question would work, when the answer would not change the experience, when the organisation cannot keep it current, when declining would unfairly block an unrelated service, or when the proposed use would surprise the customer.

The exchange has to be worth something on the customer’s side, and most are not. Across a decade of loyalty programmes, the structures that actually got organisations what they wanted were the ones where the customer paid monthly. Paying creates a reason to come back that no points balance replicates. Programmes that instead trade small discounts for personal information are asking someone to price their own data, usually at a moment when they have no way to judge what it is worth. This is a commercial observation, not a legal one, but it predicts which preference programmes stay populated.

Preference centres

A preference centre lets a person review and change communication or experience choices.

The customer need is control over topics, channels, frequency or service settings in one understandable place. Changes should take effect predictably, and optional marketing choices must be visibly separate from settings required to deliver a requested service. Each setting should say what it controls, and time-sensitive preferences should be reviewed rather than treated as permanent. Confirm important changes, record timestamps, and allow self-service correction. Provide a visible route to unsubscribe, object, reset or request deletion. Apply settings at send or decision time, not only when the profile is first created.

Measure propagation time, suppression failures, successful updates, complaints and how many customers actually use the controls. The harm risks are confusing labels, bundled purposes, hidden global unsubscribe options, and settings that quietly fail to reach downstream systems.

A centre should distinguish service communications, marketing channels, content topics, frequency, recommendation preferences, data-sharing choices, and accessibility or delivery settings. Do not design it to discourage withdrawal.

Recommendation quizzes and assessments

A quiz helps customers navigate a range when the questions genuinely improve the recommendation.

The customer answers a small number of questions to rule out unsuitable options or understand a trade-off, and sees recommendations, guidance or an explanation immediately. State whether the quiz can be used anonymously or skipped. Describe whether answers affect only this recommendation or are saved, and set an expiry appropriate to the subject. Include options such as not sure or none of these, and let answers be reviewed before submission. Let account holders clear saved answers, and explain how anonymous-session data is handled. Use only inputs relevant to the recommendation, and do not silently convert a sensitive answer into an unrelated advertising segment.

Measure start rate, completion by question, missing answers, recommendation acceptance, correction rate, returns and incremental effect. The harm risks are leading questions, false diagnosis, sensitivity, stereotyped recommendations, unnecessary email gates and manipulative result screens.

Whether shortening the path helps at all depends on what is being bought, and this surprised me the first time I got it wrong. In fashion, making it easier to add to basket and sending people from adverts straight to category pages worked well. We ran the same pattern for a French car manufacturer and bounce rates went up slightly. High-consideration buyers were not looking for a faster route to a decision; they wanted to read and compare. We stopped that campaign and made the product detail pages easier to read instead, which improved bounce rate and engagement. A quiz that narrows quickly is a help in one category and an obstacle in another.

Configurators and planners

Configurators help customers assemble a product, plan a purchase or check compatibility.

The customer selects dimensions, constraints, features or compatibility requirements and receives a configuration, feasibility check, estimate or saved plan. Do not require unrelated profile information to see it. Distinguish technical requirements from preferences, and state how long a saved configuration remains available. Use range checks, compatibility rules and clear error messages, and let the customer revisit each input. Provide reset, delete and account-removal controls for saved plans. Use technical constraints to exclude unsuitable options and preferences to rank what remains.

Measure configuration completion, validation errors, unsupported combinations, later corrections, conversion and return reasons. The harm risks are steering customers towards higher-priced configurations, concealing cheaper compatible options, and presenting estimates as guarantees.

A budget a customer sets for one plan can guide that plan. It should not quietly become a permanent marker of what they can afford.

Onboarding questions

Onboarding can collect what is needed to set up an account or shape a first experience.

Ask only what makes the initial service usable. Label optional personalisation questions as optional, and do not let them obstruct core setup. Explain which answers configure the account and which may inform recommendations. Validate factual inputs where necessary and provide settings for later correction. Allow optional answers to be removed without closing the account. Apply answers to the onboarding path that was promised, not to unrelated later campaigns.

Measure abandonment by question, time to first value, error rate, later changes and incremental activation. The harm risks are excessive questioning, forced self-categorisation, inaccessible forms, and making optional data look mandatory.

Progressive collection is almost always better than asking every conceivable question before the customer has used anything.

Surveys and feedback

Surveys measure experience, gather ideas or explain why an outcome occurred. They are not lead-generation forms wearing a disguise.

Explain why the feedback matters, how much effort it will take, and whether participants receive results, service recovery or another benefit. State the research purpose, whether responses are linked to an account, and whether they will influence how that individual is treated. Pilot the questions, allow not applicable, and separate factual answers from opinion. Explain whether a submitted response can be withdrawn, particularly once it has been anonymised or aggregated. Do not quietly use research answers for individual advertising or eligibility decisions.

Measure response rate against the invited population, item non-response, sample composition, question-order effects, and what action was actually taken. The harm risks are survey fatigue, biased wording, sensitive questions, fear of retaliation, and presenting a non-representative sample as though it spoke for all customers.

Ask post-interaction questions once the customer has had enough time to form a view. There is no universal one-week rule.

Progressive collection

Progressive collection spreads questions across relevant moments instead of presenting one long form. It works when each later question connects to a current task. It does not license the gradual assembly of an unlimited profile.

Account-profile settings

Ask for durable settings customers would expect to manage. Separate facts, preferences and inferred defaults. Show when important information was last updated. Allow direct correction and reset. Measure staleness, corrections and downstream propagation.

Conversational collection

Explain whether the conversation is automated, recorded, or used to update a profile. Confirm important extracted preferences before saving them. Do not treat ambiguous conversational language as a durable instruction. Provide a transcript or a visible saved setting. Measure extraction errors, confirmation rates and correction requests.

Loyalty-programme preferences

Distinguish information needed to administer membership from optional marketing or personalisation. Do not imply that a reward requires unrelated data when it does not. Explain any sharing with programme partners. Let members change preferences without forfeiting earned benefits unless the setting is genuinely necessary. Measure benefit use, preference freshness, complaints and partner-propagation failures.

There is a trap here that repeats every trading season. When a competitor discounts, the reflex is to mirror it, and mirroring teaches customers to stop buying on their own cycle and wait for the next reaction. Sometimes the offer gets matched and they leave anyway. The diagnostic I use on a new account is to look at conversion peaks in analytics: if the peaks appear only during sale periods, with no smaller lifts around new-season releases, the customer base has been trained to buy on discount alone. A preference programme layered on top of that base is collecting the preferences of people waiting for a price, which is a commercial problem no question design will solve.

Write questions customers can answer

Question quality determines what every downstream metric means.

Ask one thing at a time. A customer may feel differently about price and delivery, so a question covering both produces an uninterpretable answer. Define the timeframe: which products someone is interested in is a different question from which category they are shopping for today. Provide response options covering plausible answers, including none, not applicable, not sure, prefer not to say, and other where meaningful. Avoid asking people to select a motivation they may not know or may not recognise in the categories offered. Avoid wording that implies one answer is responsible, fashionable or preferred by the organisation. Pilot new questions with people from the intended audience and look for inconsistent interpretation, not just completion.

Keep optional questions genuinely optional. Do not use visual prominence, defaults, countdowns or rewards to make refusal disproportionately difficult. The GOV.UK Service Manual recommends knowing why every question is asked, keeping questions simple, and allowing answers such as not sure where appropriate. (6)

The CMA’s evidence review on online choice architecture describes how interface structure, information and pressure can shape consumer decisions. It is a research review rather than guidance about how the CMA will act, but it is a useful framework for assessing whether a collection interaction has crossed from persuasion into manipulation. (7)

Validate declared information

Validation should be proportionate to the decision.

Structurally, check permitted formats, ranges, required combinations, impossible dates and contradictory answers. For a saved preference, confirm what will be recorded, in plain words, so the person can see it.

Observed behaviour may suggest a saved preference needs review, but it should not automatically overwrite a declared choice. Repeated use of a different product category may justify asking whether the saved preference still holds. It does not prove the original answer was false.

Use external verification only where genuinely necessary and proportionate. A colour or content-topic preference does not need verifying. A factual input used for safety, eligibility or a regulated decision may need stronger controls.

Store the exact question, the answer, the source interaction, the timestamp, the validity period, whether it was confirmed, whether it was verified, whether it is disputed, and the intended uses.

Resolve conflicts between stated and observed signals

A conflict is information, not permission to pick whichever signal produces more revenue.

Identify whether the signals concern the same concept. Check their dates and contexts. Determine whether the declared answer was always temporary. Preserve both sources where there is a legitimate need. Ask for confirmation when the decision matters. Never silently overwrite a channel objection or an explicit exclusion. Record how the conflict was resolved.

Take a customer who says they prefer email but has not opened recent messages. The content may have been irrelevant. The address may be secondary. Measurement may be incomplete. They may still prefer email to everything else. Or the preference may have changed. The observation does not justify switching them to SMS when no SMS permission exists.

Keep preferences current

Different answers have different useful lives. Some are session-only, such as a current shopping task or a temporary budget. Some are short-term, such as an imminent purchase intention. Some are event-linked, such as moving home or organising an occasion. Some are medium-term, such as product interests. Some are durable but reviewable, such as a channel or accessibility setting. And some stand until withdrawn, such as a direct-marketing objection.

Use explicit review dates where possible. A freshness process might surface the saved preference in the account, ask the customer to confirm it at a relevant moment, reduce activation as confidence falls, expire a temporary intention, and preserve an objection even when other profile fields expire.

UK principles require reasonable attention to accuracy, which is contextual rather than a duty to keep everything permanently current. (8) They also require that personal data is not kept longer than necessary, and the guidance sets no standard retention period for particular categories of marketing data. (9)

Activate only for the stated purpose

Before using a declared answer, compare the proposed use with the original question, the notice shown, the immediate value promised, the lawful basis, any direct-marketing requirements, sensitivity, reasonable expectations, the downstream recipient, the retention period and the likely effect on the person.

A skin concern supplied for a product recommendation should not become an advertising segment shared with several platforms. A delivery-access instruction should not be repurposed as a lifestyle inference. A survey response collected for aggregate research should not quietly determine an individual offer.

Purposes must be specified from the outset and any further use assessed for compatibility. (10) Where the purpose changes, redo that assessment before activation. Updating a privacy notice is not the same thing: providing the minimum required information does not by itself satisfy the wider transparency principle, still less make an unexpected use appropriate. (11)

Enable correction and withdrawal

Customers should be able to see and correct important saved information.

There is a right to have inaccurate personal data rectified, though this does not oblige an organisation to accept every requested amendment, and accurate records of a disputed opinion may be retained with appropriate context. (12) There is a right to erasure in qualifying circumstances, which is not absolute. (13) The right to object to direct marketing is different from both: it is absolute, with no exemptions and no grounds for refusing, and suppression is often more appropriate than deletion because it is what stops the person being marketed to again. (14)

A workable control model includes self-service profile editing, a clear unsubscribe route, a global marketing objection, a way to clear quiz or recommendation answers, correction tools for service teams, suppression that propagates to external destinations, records of which recipients were notified, and a clear distinction between deleting a preference and retaining a limited suppression record.

Do not make withdrawal materially harder than collection.

Measure collection quality

Completion rate is not a success measure on its own.

For the interaction, measure eligible people shown it, start rate, completion rate, time to complete, abandonment by question, validation errors, the rate of not sure and prefer not to say answers, accessibility issues and support contacts. For the information, measure missing required fields, contradictory answers, correction rate, confirmation rate, freshness, the proportion with known question wording and source, the proportion actually used for the stated purpose, and disputed answers. For customer control, measure time to update, time to propagate a withdrawal, suppression failures, deletion completion, complaints and reports of unexpected use. For outcomes, measure recommendation usefulness, reduction in unsuitable options, service completion, returns for the reasons the interaction was meant to prevent, satisfaction with that specific outcome, and incremental commercial effect.

Structure changes what these numbers mean, which is why they need reading together. The largest before-and-after change I saw in ten years came from adding structured A/B testing and gamified mechanics to an existing personalisation programme at a large menswear retailer. Reported conversion uplift went from seven to twelve per cent to around twenty-five per cent. I want to be precise about what that is and is not: it was a before-and-after comparison on one brand in one category, not a controlled test, so part of it may be the testing discipline finding better variants and part may be the mechanics themselves. It tells you the ceiling was higher than the team believed. It does not tell you the gamification caused the gap.

There is no universal completion, opt-in or coverage target. Establish a baseline for the specific interaction and diagnose why people do and do not take part.

Measure incremental activation impact

People who complete a quiz or fill in a preference profile differ from people who do not. They tend to be more engaged, further along, or more likely to buy already. Comparing completers with everyone else therefore measures the difference between those two groups, not the effect of the quiz.

I have watched an entire channel strategy get built on this mistake. Brands were delighted with the performance of their mobile apps, because app metrics beat website metrics on almost everything. But people buy from more than thirty brands a year and cannot keep all those apps, so the ones who install yours were already loyal. The app was not producing better customers. It was being downloaded by them. Declared-data programmes generate exactly the same illusion, and the fix is the same: compare like with like, or accept that the number is describing your audience rather than your intervention.

Use a design that isolates the effect of applying the information. Collect the preference, then randomise eligible participants between a preference-informed and a standard experience. Randomise whether a non-essential collection interaction is offered at all. Compare different question sets while holding the resulting experience constant.

Collection metrics do not establish that activating the information improved an outcome. Test the resulting decision against an appropriate comparison and measure incremental contribution, suitability, complaints, corrections and customer harm. The first-party data guide covers the wider measurement architecture.

A result can be commercially positive and still unacceptable if it depends on misleading design, excessive collection or harmful treatment.

For broader test design, see measuring personalisation effectiveness, the personalisation KPI reference and the first-party data implementation framework. For programme-level measurement, see measuring marketing performance.

Collection-method scorecard

Method	Strong fit	Weak fit	Primary quality metric	Principal risk
Preference centre	Communication and durable account choices	Discovering unprompted needs	Propagation accuracy	Confusing or obstructive controls
Recommendation quiz	Complex choice with meaningful differentiators	Simple products where questions add friction	Recommendation suitability	Sensitive or stereotyped profiling
Assessment	Education or guided self-evaluation	Diagnosis without an appropriate basis	Answer comprehension and outcome utility	False authority
Configurator	Compatibility, dimensions and feature trade-offs	Extracting unrelated lifestyle data	Valid configurations	Steering towards higher-cost options
Onboarding	Information needed for first value	Building a complete marketing profile	Time to first value	Forced disclosure
Survey	A defined research or feedback question	Individual targeting disguised as research	Sample and item quality	Bias and unexpected reuse
Account settings	Durable preferences and facts	Temporary intentions	Freshness and corrections	Stale activation
Conversation	Contextual assistance	Silent extraction of durable traits	Confirmation and extraction accuracy	Ambiguity and overcollection
Loyalty preferences	Member benefits and chosen interests	Bundled partner marketing	Benefit delivery and propagation	Coercive value exchange

Common mistakes

Treating every answer as fact

Label preferences, intentions, circumstances, opinions and verified facts differently.

Requiring an email before showing a result

Ask whether the address is genuinely needed to deliver the immediate value, and keep the marketing choice separate from it.

Collecting answers without an activation plan

Unused data still carries maintenance, security and governance cost.

Reusing answers for unrelated campaigns

That a customer answered voluntarily does not make every later use expected.

Overwriting explicit choices with behavioural inference

An inferred preference should never override an objection, an exclusion or a channel choice.

Retaining temporary intentions indefinitely

A purchase intention from last year may be actively misleading today.

Optimising for completion through pressure

High completion produced by defaults, obstruction or misleading incentives is not a quality result.

Assuming a customer data platform is required

A governed profile service, a CRM or an application database may be enough. Choose infrastructure after defining the decision and the control requirements, not before.

Frequently Asked Questions

Conclusion

Customer-declared information is useful when it helps a person accomplish something, and when the organisation can explain, validate, maintain and control what happens next.

A responsible programme asks only necessary questions, provides clear and timely value, preserves question wording, source and date, distinguishes preferences from verified facts, makes optionality genuine, limits activation to explained purposes, supports correction, withdrawal and deletion, expires time-sensitive intentions, tests commercial effect incrementally, and measures harm and customer control alongside conversion.

The objective is not the largest preference profile. It is making a defined interaction more useful, without pretending that voluntary disclosure removes the need for governance.

For the wider strategic context, including permissioned portability and privacy-enhancing technologies, see the future consumer-data landscape. For the fairness and trust questions underneath all of this, see ethical consumer-data use and the relationship between privacy, personalisation and trust.

References

1. Information Commissioner’s Office. A guide to the data protection principles. Regulatory guidance. No reference number; relates to UK GDPR Article 5. No publication date shown; latest date displayed 23 March 2026. Carries a banner stating that the guidance is under review and may change following the Data (Use and Access) Act. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/

2. Information Commissioner’s Office. What is valid consent? Regulatory guidance. No reference number; relates principally to UK GDPR Articles 4(11), 7 and 8. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner following the Data (Use and Access) Act. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/

3. Information Commissioner’s Office. Guidance on direct marketing using electronic mail. Regulatory guidance. No reference number. No original publication date shown; last updated 28 April 2026. No draft or under-review status shown. Note that the shorter Electronic mail marketing page in the Guide to PECR has not been revised for the 2026 charity soft opt-in and should not be relied on for that point. United Kingdom. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/

4. Thomas L. Webb and Paschal Sheeran. Does changing behavioral intentions engender behavior change? A meta-analysis of the experimental evidence. Peer-reviewed meta-analysis. DOI 10.1037/0033-2909.132.2.249; PMID 16536643. Published March 2006; no later update. Not UK law; draws largely on social and health psychology interventions and does not quantify the reliability of marketing preference data. https://pubmed.ncbi.nlm.nih.gov/16536643/

5. Pierre Chandon, Vicki G. Morwitz and Werner J. Reinartz. Do Intentions Really Predict Behavior? Self-Generated Validity Effects in Survey Research. Peer-reviewed research article. DOI 10.1509/jmkg.69.2.1.60755. Published April 2005; no later update. Not UK law; studies the effect of measuring purchase intentions and does not imply that every question alters later behaviour. https://doi.org/10.1509/jmkg.69.2.1.60755

6. GOV.UK Design Community. Designing good questions. Government service-design guidance. No reference number. Published 22 June 2018; last updated 24 June 2026. Written for government services rather than marketing research; supports question clarity but does not determine data-protection compliance. United Kingdom. https://www.gov.uk/service-manual/design/designing-good-questions

7. Competition and Markets Authority. Evidence review of Online Choice Architecture and consumer and competition harm. Research and analysis paper. No reference number shown. Published 5 April 2022; no later update shown. The CMA states that the review is not exhaustive and is not guidance determining how it will act in future cases. United Kingdom. https://www.gov.uk/government/publications/online-choice-architecture-how-digital-design-can-harm-competition-and-consumers/evidence-review-of-online-choice-architecture-and-consumer-and-competition-harm

8. Information Commissioner’s Office. Principle (d): Accuracy. Regulatory guidance. No reference number; relates to UK GDPR Article 5(1)(d) and to the definition of inaccurate in the Data Protection Act 2018. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/accuracy/

9. Information Commissioner’s Office. Principle (e): Storage limitation. Regulatory guidance. No reference number; relates to UK GDPR Article 5(1)(e). No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner, and states that UK GDPR sets no specific time limits for particular categories of data. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/

10. Information Commissioner’s Office. Principle (b): Purpose limitation. Regulatory guidance. No reference number; relates to UK GDPR Article 5(1)(b) and refers to Article 30 on records of processing. No publication date shown; last updated 23 March 2026. No review banner shown. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/

11. Information Commissioner’s Office. Right to be informed. Regulatory guidance. No reference number; relates to UK GDPR Articles 13 and 14. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner, and distinguishes the minimum information requirements from the wider transparency principle. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/

12. Information Commissioner’s Office. Right to rectification. Regulatory guidance. No reference number; relates to UK GDPR Article 16. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-rectification/

13. Information Commissioner’s Office. Right to erasure. Regulatory guidance. No reference number; relates to UK GDPR Article 17. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner, and states that the right is not absolute. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/

14. Information Commissioner’s Office. Right to object. Regulatory guidance. No reference number; relates to UK GDPR Article 21. No publication or update date shown on the page; accessed 28 July 2026. Carries the under-review banner. The absolute treatment described applies to direct marketing; objections on other grounds are subject to different rules. United Kingdom. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/

Position as at 28 July 2026. UK data-protection guidance is unusually unsettled at the time of writing. Most of the ICO principle and individual-rights pages cited above carry a banner saying they are under review following the Data (Use and Access) Act 2025, and the direct-marketing guidance in this area was itself last revised in April 2026. The regulator is also mid-transition: the Information Commission has been established and is expected to take over the ICO’s functions later in 2026, so the issuing body named in these references may change. Verify the current status of any source before relying on it for a compliance decision.