Data protection when sharing keyword research with an agency

What to take away

Decide whether the agency is a processor or a separate controller before any file leaves your team, because the role sets the paperwork.
A processor needs UK GDPR Article 28 terms in a written contract.
Strip names and identifiers from exports before sharing them with writers or agencies.
Ask each supplier where personal data is stored, whether it uses sub-processors and whether transfers take place.
Sending UK-held personal data abroad can be a restricted transfer that needs a transfer mechanism.

Processor or controller: the question to answer first

Decide the agency's role before you send anything. A processor acts on your instructions, while a separate controller makes its own decisions about the data. The role decides which written terms you need, and the ICO guide on whether you are a controller or processor explains the roles.

Agency role	What it means	What you put in place
Processor	Acts on your instructions	UK GDPR Article 28 terms in a written contract
Separate controller	Makes its own decisions about the data	A contract that identifies each party's responsibilities
Receives aggregate files only	Query reports and volumes that identify no one	No personal data in the file to protect

What the Article 28 terms cover

If the agency is a processor, put the UK GDPR Article 28 terms in a written contract. They cover six things:

Instructionsthe agency uses the data only as you direct.
Confidentiality for the people who handle it.
Security of the data while the agency holds it.
Sub-processorswhether the agency may use them, and on what terms.
Help with participants' rights and with breaches.
Return or deletion of the data when the work ends.

The contract checks for research suppliers cover the commercial side of the same agreement.

Prepare the file before it leaves

Send the least the work needs. Aggregate query reports sit outside personal data, but a user level export with client IDs or IP addresses does not. Strip names and identifiers from exports before they go to writers or agencies, and take only what the analysis needs from recordings.

Personal vs non-personal data

Personal data

Interviews: Yes
Surveys: Yes
Analytics exports: If user-level
Recruitment lists: Yes

Not personal data

Interviews: No
Surveys: No
Analytics exports: If aggregate
Recruitment lists: No

Interviews and surveys leave notes, transcripts, audio files and free text answers that can identify a participant. Recruitment lists count too, and contact details should be removed when recruitment ends. Analytics exports are less obvious, so check them for user level fields.

Check that your lawful basis covers the hand-over

Sharing is processing, so the basis you recorded at collection has to cover it. Article 6 of the UK GDPR requires a lawful basis for each processing activity, and research often rests on legitimate interests, which is not a free pass.

Choose lawful basis

Is the research low impact and internal?

Yes

Legitimate interests

Consent may be required

Check that the basis you chose still fits a hand-over to a supplier. Tell participants about the recipients too: a privacy notice covers the controller, purposes, lawful basis, recipients, retention criteria, rights and any international transfers.

Keep research files separate from marketing lists, so research consent is not stretched to cover email. The ICO regulates all four UK nations and expects you to know why you hold data, how long you keep it and who can see it. The bigger risk is wasted fieldwork, not fines, because rebuilding a panel costs more than the paperwork.

Questions to put to each supplier

Ask every supplier the same short set of questions, and keep the answers with the contract:

Where is personal data stored or accessed?
Does the agency use sub-processors, and which?
Do transfers outside the UK take place, and under which safeguard?
What is returned or deleted when the work ends?
Who handles access, erasure and objection requests from participants?

Make sure the contract identifies the applicable transfer safeguard and each party's responsibilities.

When the supplier or participants are outside the UK

Data protection is not devolved, so an England team follows the same statute as one in Glasgow or Cardiff. If you offer services to people in the EU or monitor their behaviour there, the EU GDPR may apply alongside UK law.

A restricted transfer is a separate question. The ICO says every restricted transfer must be covered by one of its transfer mechanisms, starting with UK adequacy regulations.

If you send UK-held personal data abroad, check whether those regulations cover the destination. Otherwise use an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

For wider context, see which UK regulations shape keyword research in England. The wider rules and ethics guide puts these duties in context.

Records to keep once a supplier holds the data

A supplier is a recipient, so add it to your records when the hand-over happens. Keep an Article 30 record of processing activities where required, including purposes, data categories, recipients, retention periods or criteria, transfers and security measures.

Log each access, erasure and objection request, assess it and respond within the applicable UK GDPR deadline. Check the ICO's data protection fee checker and pay the fee if required. Use the ICO's DPIA screening questions before high-risk processing, and complete a data protection impact assessment where required.

A checklist before you share

Outcomes turn on your facts, so individual cases need a qualified adviser.

Work out whether the agency is a processor or a separate controller.
Put Article 28 terms in writing for any processor.
Strip names and identifiers from the exports.
Remove recruitment contact details once recruitment has ended.
Record where the data will be stored and by whom.
Name the transfer safeguard for any supplier outside the UK.
Add the supplier to your record of processing activities.

Common questions

Is an agency always a processor?

No. Work out whether it acts on your instructions or is a separate controller. The answer decides which written terms you need and who answers to participants.

Do I need Article 28 terms for search volume data?

Usually not. Aggregate volumes and autocomplete strings do not identify anyone. The terms matter once the file holds a recorded interview or a row that ties a query to an email address.

What is a restricted transfer?

Sending UK-held personal data to an organisation outside the UK. Check whether UK adequacy regulations cover the destination. Otherwise use an appropriate safeguard, such as the IDTA or the UK Addendum to the EU Standard Contractual Clauses.