How much personal information does a creator media kit really need to disclose?

Creator media kits data protection begins with an inventory of the information in the pack and the service hosting it. Separate what a buyer needs to see from the records used to substantiate it. This guide considers England use under the UK framework; it offers no individual legal advice.

What to take away

Map the data before choosing settings

List creator contact fields, client contacts, identifiable testimonials, audience exports and visitor records separately. Describe the purpose of each use, who can access it and where copies go.

The ICO's data-protection principles guide explains lawfulness, transparency, minimisation, storage limitation and accountability under UK GDPR Article 5. The page flags continuing review following legislative changes. Use it for those stated principles, with publication-day checking, rather than assuming it answers every new provision.

For the working pack, consider whether a summary can answer the buyer's question without identifiable records. Remove unnecessary message headers and contact details from proposed samples. This is an editorial minimisation exercise; a privacy specialist must assess whether the remaining information still identifies someone and whether the processing has an appropriate lawful basis.

Use the current legal timeline

The ICO's organisational DUAA guidance states that the Data (Use and Access) Act 2025 changes UK GDPR, the Data Protection Act 2018 and PECR without replacing them. Its 19 June 2026 update confirms that the data-protection provisions are now in force. A 2027 portfolio guide should not present these changes as an uncommenced proposal.

That guidance also explains the requirement to facilitate data-protection complaints, acknowledge them within 30 days and respond without undue delay. Put the operational route with the person responsible for privacy, rather than treating an unanswered general inbox as the complete process. Obtain qualified review of the procedure and its application to the publisher.

Examine the hosting relationship

Ask what the portfolio supplier does with uploaded information. Processing it only on the creator's instructions is a different question from using it for the supplier's own purposes. Record the actual processing roles before selecting contract language.

Where a controller uses a processor, ICO guidance on contract contents describes Article 28 requirements, including documented instructions, confidentiality and provisions for ending the processing. Its scope is UK data protection, including England; it is regulator guidance explaining statutory duties. A generic promise to keep data safe is not a substitute for analysing the arrangement.

Request the relevant terms and record the subprocessors, locations and deletion arrangements for review. Ask for clauses on documented instructions, confidentiality, subprocessor approval, breach notice timelines, deletion or return on termination, and audit or information rights. Do not infer that a UK sales address means all processing occurs in the UK.

International transfers need their own assessment; this article does not approve a transfer mechanism or supplier.

Control publication and copies

As a proposed safeguard, use separate public and restricted versions when they serve different reader needs. Keep the restricted copy limited to the intended recipient group, and check whether recipients can download it.

Set a review trigger for changed permissions, outdated contact details and withdrawn portfolio items. A workable default is 12 months after last contact for enquiry records, 24 months for active rate cards and 14 months for analytics logs. Treat these as typical examples, not legal minima.

Record where backup copies and exported decks would be found during a correction or deletion task.

For identifiable testimonials, use consent under UK GDPR Article 6(1)(a). Ask the person to agree to this wording. 'I agree that [creator name] may publish my name, role and quote in media kits and portfolio pages. I can withdraw consent at any time by emailing [contact].'

For audience exports, use the lawful basis that matches the content. Aggregated exports can rely on legitimate interests under Article 6(1)(f) after a balancing assessment. Identified exports need consent under Article 6(1)(a).

Use this notice for an identified export. 'I agree that [creator name] may share my name, role and audience details with [buyer] for [purpose]. I can withdraw consent at any time by emailing [contact].'

If the hosted portfolio includes cookies, analytics or email tracking, arrange a separate assessment under current PECR and data-protection rules. The permitted route depends on the technology and purpose. This page does not assume that every analytics feature is exempt from consent.

Follow one data flow from enquiry to deletion

A creator receives a buyer enquiry through the portfolio contact form. The form collects the buyer's name and work email. The supplier dashboard stores a copy and emails the creator. The creator checks the enquiry and sends a restricted rate card link. The buyer downloads the rate card and an aggregated audience summary.

The creator records the purpose, the recipient and the retention date. After the quote closes, the creator deletes the enquiry email, removes the buyer from the link and asks the supplier to delete the dashboard copy. The creator logs the deletion date and any remaining backup location.

Ask the reviewer to resolve gaps against current law before opening access.

Practical checklist

Common questions

Which fields belong in the public media kit and which belong in the restricted version?

Use the table in Map the data before choosing settings. The public version needs the creator name, role, approved quote, creator email and starting rate. The restricted version can add the full rate card, client contacts and identified audience exports for named recipients.

How long should a creator keep media kit records?

Use the default periods in Control publication and copies: 12 months after last contact for enquiries, 24 months for active rate cards and 14 months for analytics logs. Adjust by purpose and review.

What notice and lawful basis apply to testimonials and audience exports?

See the notice wording and lawful basis in Control publication and copies. Identifiable testimonials need consent. Aggregated audience exports can rely on legitimate interests after a balancing assessment. Identified audience exports need consent.