Rules and ethics
Part of Before you plan content, the keyword research rules and ethics to follow
Keyword research disclosure policies for UK teams
A practical UK guide to keyword research disclosure policies, covering ad labels, data protection, claim evidence and an approval log for content teams.
What to take away
- A keyword research disclosure policy records how you label paid or sponsored content, who signs it off and how you log the evidence.
- The ICO’s data-protection guidance is relevant when keyword research involves personal data; document the lawful basis, retention period and subject access request process.
- For promotional content, the CAP Code’s rules on misleading claims and substantiation matter.
- US enforcement matters toothe FTC keeps a register of penalty offence notices, so claims built on keyword research carry legal risk in both markets.
- Write the policy down, date it and review it each year before you refresh your keyword plan.
Why the policy matters now
Search teams now research demand for regulated products, from credit to health supplements. The words you target shape the claims you end up making. A disclosure policy turns that link into a written control.
A dated policy and approval log can help demonstrate internal controls if an advertising complaint arrives, but neither guarantees compliance. The same record helps when you map keyword research to UK rules and compliance across a full planning cycle.
Who owns the policy
Name one owner. In most teams that is the content lead, with legal or compliance reviewing once a year. The owner keeps the disclosure wording, the approval log and the review date.
Policy Contents Checklist
- Scope of keyword research covered
- Disclosure wording to use
- Approval route and sign-off
- Evidence held on file
- Named owner and review date
What the ICO expects
When you use personal data to build audience segments, UK GDPR and the Data Protection Act 2018 apply. Follow the ICO’s data-protection guidance and assess what personal data you are processing. The Online Safety Act 2023 concerns duties for in-scope online services; it is not a general keyword-disclosure or data-protection rule.
ICO Data Records To Keep
- Lawful basis for tracking
- Retention period for keyword data
- Handling of special category data
- Who can access sensitive keyword lists
Document the lawful basis for processing and set a justified retention period. Check whether your organisation must register with the ICO and pay the data protection fee, or whether an exemption applies, and have a process for handling subject access requests. If you process special-category data, you need an additional condition under UK GDPR; health-related searches may reveal such data, while financial subject matter alone is not automatically special-category data.
The UK position: UK GDPR applies across England, Scotland, Wales and Northern Ireland, so one data-protection policy can cover all four nations unless a devolved rule says otherwise.
What the CAP code expects
The CAP Code (UK Code of Non-broadcast Advertising and Direct & Promotional Marketing) is the UK’s advertising self-regulatory code. Rules 2.1 and 2.3 cover identifying marketing communications and making commercial intent clear; rules 3.1 and 3.7 cover misleading claims and substantiation. The CAP Code’s promotional marketing rules apply where content is a promotion.
Statutory consumer law is separate. Relevant regimes include the Consumer Protection from Unfair Trading Regulations 2008 and the unfair-commercial-practices provisions of the Digital Markets, Competition and Consumers Act 2024. The Competition and Markets Authority (CMA) is a statutory consumer-law enforcer; the Advertising Standards Authority (ASA) administers the CAP Code.
For paid or affiliate content, make the commercial nature obvious. The ASA expects marketing communications to be recognisable as advertising; a clear “Ad” label is a recognised option, though the CAP Code does not prescribe one universal phrase for every context. For price or savings claims, keep supporting evidence before publication.
Cross-border risk
If a campaign targets US consumers, US rules may also apply. The FTC publishes notices of penalty offences concerning conduct including misleading endorsements and unsubstantiated health claims.
If you target US consumers, add a second sign-off for health, finance and endorsement claims. Note the differing rules when you check UK regulations against overseas markets.
This article is general guidance. Individual cases need a qualified adviser.
Building the approval log
Keep one table with five columns: page, keyword set, disclosure wording, approver, date. Add the evidence link for any claim.
| Content type | Disclosure wording | Approver | Review |
|---|---|---|---|
| Editorial guide | None required | Content lead | Annual |
| Sponsored article | "Paid partnership with [brand]" | Content lead plus legal | Per campaign |
| Affiliate page | "We may earn commission" | Content lead | Annual |
| Regulated claim | "Evidence held on file" | Legal | Per page |
The table is illustrative, not a legal template. Adapt the columns to your own sign-off route.
Testing and review
Run one check a quarter. Pick three live pages and confirm the disclosure is visible, the approver is named and the evidence exists. Fix what fails.
Review the whole policy each year as an internal schedule, or sooner if the ICO or the ASA publish new guidance. Date every version.
Common questions
Does a disclosure policy need to cover keyword research itself?
There is no separate legal disclosure requirement for keyword selection itself. Cover the use of personal data, the labelling of advertising and evidence for claims where those issues arise.
How long should the policy be?
Two pages is workable. Longer documents tend not to be read, and the value is in the approval log, not the prose.
Does the policy differ in Scotland, Wales or Northern Ireland?
UK GDPR applies across all four nations. Advertising rules are also UK-wide, so a single policy normally suffices unless a devolved rule applies to your sector.
Who should sign off sponsored content?
The content lead can own routine pages. Bring in legal for regulated claims, health or finance topics and any campaign aimed at US readers.
