Which UK regulations shape keyword research for content teams?

What to take away

Which UK laws apply to keyword research?

Keyword research is mostly a data activity. If you collect search terms, click data or user profiles, UK GDPR and the Data Protection Act 2018 apply. The Data (Use and Access) Act 2025 updates parts of that framework, including retention and access rules.

One regime sits underneath all of this: PECR, the Privacy and Electronic Communications Regulations 2003. If your keyword research uses cookies, pixels or analytics scripts, PECR requires consent for anything that is not strictly necessary, and it also sets the rules for electronic marketing. In practice, your analytics and rank-tracking tools fall under PECR before the wider data protection regime bites.

The Act sits on the statute book as Data (Use and Access) Act 2025. It creates no separate keyword research rule, but it changes the wider regime governing audience data used in content planning. Two changes matter for research teams: a list of "recognised legitimate interests" where processing can go ahead without a full balancing test, and new exceptions that allow limited analytics cookies to be set without a consent banner.

Lawful basis is the first question to settle. Legitimate interests can cover routine audience research, but you have to document the balancing test. Data minimisation applies too: collect the search terms you need, not whole browsing histories. Retention schedules should name a period and a deletion method.

Separately, most organisations that process personal data must register with the ICO and pay the data protection fee unless an exemption applies, and the ICO's register of fee payers is public. Accountability also expects a record of processing activities, which is where each keyword research project should list its purpose, lawful basis and retention period.

If you sell keyword research as a service, consumer law also applies. The Consumer Rights Act 2015 covers digital content and services, including what happens when a service is not performed with reasonable care. Alongside it, the Digital Markets, Competition and Consumers Act 2024 gives the Competition and Markets Authority direct powers to enforce consumer protection law and to penalise misleading commercial practices.

How does ICO guidance affect AI-assisted keyword tools?

Many keyword tools use AI to cluster terms or generate briefs. When they process personal data, the ICO expects a lawful basis, an impact assessment where risk is high, and transparency about automated decisions.

The ICO's AI and data protection risk toolkit is the reference point, alongside its wider guidance on artificial intelligence, covering AI-assisted content governance and tools that infer audience intent from personal data.

Transparency matters as much as the model itself. If a tool profiles users to predict intent, people should be told in plain language. A vendor contract does not transfer your obligations, so ask what data leaves your systems and where it is held.

If a tool processes only aggregated search volumes, this guidance is less relevant. Add names, emails or CRM records and it applies.

What does disclosure require in the UK?

Disclosure means telling readers and clients what you did. Publish research as marketing content and say which tools you used, what data you relied on and whether figures are illustrative.

Affiliate links or paid placements alongside keyword findings must be disclosed, as must client data used in a public case study, even anonymised. The CAP Code, written by the Committee of Advertising Practice and enforced by the Advertising Standards Authority, requires marketing communications to be obviously identifiable as such, so a paid placement needs clear "ad" or "paid promotion" labelling.

Keep a short method note with each published study: source, date, sample size and cleaning steps. That note answers most disclosure questions before they are asked.

Our guide to writing a keyword research disclosure policy covers the wording and records that make this practical.

Decision table: situation, choose, avoid

How should teams plan for 2027?

The Data (Use and Access) Act 2025 is recent, and secondary legislation and regulator guidance will keep developing. Build review points into your content calendar so the process is checked against current law.

Keep a record for each project: what data went in, which tools processed it, who saw the output and when it was deleted. Assign an owner for each review so the task does not drift between quarters.

For a wider view, read our keyword research UK rules and compliance guide for 2027. It maps the statutes, regulators and practical steps in one place.

Common questions

These are the questions content teams ask most often once the statutes above are mapped to a research process.

Does UK GDPR apply to keyword research?

It applies when research involves personal data, such as names, emails or identifiable browsing records. Aggregated search data alone falls outside it.

Do I need a DPIA for AI keyword tools?

The ICO expects one where processing is likely to result in high risk, and publishes a DPIA template to work from. If a tool profiles people or handles sensitive data, treat a DPIA as necessary. Small projects using aggregated data rarely need one, but record your reasoning either way.

Can I publish keyword research without disclosing my tools?

More than one regime applies rather than a single statute. The CAP Code, enforced by the ASA, requires paid placements to be labelled "ad" or "paid promotion", and consumer law requires claims about findings to be honest and not misleading. Personal data used in a published case study is covered by UK GDPR.

Who should check my keyword research process?

A data protection lead can review personal data handling, and a qualified legal adviser should review contracts and consumer-facing terms.