Rules and ethics
Reviewing a creator media kit against UK rules on claims, permissions and personal data
Creator media kits rules for England and the UK: review portfolio claims, permissions, personal data and disclosure with a dated legal review for 2027.
What to take away
- Sort each kit version by recipient and capacity, because business-to-business packs and publicly readable packs can attract different rules.
- Give every objective claim a recordmetric, source, date range and definition.
- Copyright arises automatically, so a missing notice never proves you may republish a selected asset.
- Treat brand approval and copyright permission as separate answers to separate questions.
- Keep identifiable follower records, client contacts and attachments out of the public pack.
Scope: media kits, portfolio tools and UK law
This review covers a creator's media kit and the portfolio tool that assembles, hosts or exports it. It deals with audience statements, selected work, permission evidence and personal data. Supplier discovery, agency service pages and campaign execution sit outside it.
England is the operating context. UK covers England, Scotland, Wales and Northern Ireland; Great Britain excludes Northern Ireland. The instruments cited below apply across the UK.
Classify the recipient before choosing the rules
A pack addressed to a brand buying services is business advertising. GOV.UK's guidance on advertising regulations routes that to the Business Protection from Misleading Marketing Regulations 2008, which ban misleading advertising to traders. Write a recipient statement for each version: who receives it, in what capacity, and for which decision.
Who receives the media kit?
Who will receive this version?
Business buyer -> BPMMR route
Consumer-facing -> DMCC Act 2024 route
A publicly readable pack follows a different route. The CMA records that the consumer-protection changes in the Digital Markets, Competition and Consumers Act 2024 took effect on 6 April 2025. A reproduced endorsement can raise a consumer question even when the pack mainly seeks business work.
Keep statute apart from the advertising codes. The ASA applies the CAP Code, which is not legislation, and a scope exclusion does not remove other legal duties. Checking the advertising claims in a creator media kit before it goes out works through claim wording in more detail.
A claim record that explains the page
Start from the exact statements proposed for publication. Where the Code applies, CAP section 3 requires documentary evidence for objective claims, as the ASA's section 3 text sets out.
Separate platform measurement from your own interpretation. If the evidence counts accounts, do not call it purchasers. If it covers one quarter, keep that quarter visible.
Example: one claim record row
One claim record row
- Metric
- Average views per long-form video, YouTube
- Source
- Platform analytics export, 3 September 2026
- Date range
- 5 June to 2 September 2026
- Definition
- Views counted 24 hours after publication, Shorts excluded
Permissions for client work and logos
Copyright arises automatically for qualifying work. GOV.UK's copyright permissions guide explains permission and permitted-use routes, but it does not authorise a particular portfolio extract. Ask your reviewer about any reliance on an exception, because a context-dependent rule is not a general portfolio exemption.
Example: one asset-schedule row
One asset-schedule row
| Asset | Rightsholder evidenced | Permission relied on | Limit |
|---|---|---|---|
| Brand film still | Agency email, 14 July 2026 | Licence for social and web, no paid media | Expires 31 December 2026 |
Read the permission against the output. Authority to show work privately rarely covers a public page, and a licence for one format may not extend to a downloadable deck.
Keep commercial context in edited extracts, because a cropped reel can lose the sponsorship statement that travelled with it.
Sample caption, cropped reel: "Paid partnership with [brand], filmed March 2026. Clip shortened; full post linked below."
A disclosure policy for media kit samples is a sensible home for that rule.
Personal data in a public media kit
Separate the public presentation from the underlying evidence. A buyer may need an audience summary without identifiable follower records. Review what the recipient receives, including embedded images and attachments.
The ICO's data protection principles guide covers minimisation, accuracy and storage limitation under UK GDPR, and flags the Data (Use and Access) Act 2025 updates. Recheck it before release rather than trusting an older checklist.
Example: one data-map row
One data-map row
| Item | Purpose | Access | Destination |
|---|---|---|---|
| Follower email list | Newsletter only, not published | Creator only | Email platform, UK region |
Where the host acts as a processor, an Article 28 contract is needed. Hosting, analytics and the supplier's own uses may need separate analysis.
Pre-publication workflow
- Write the recipient statement and label the version public or restricted.
- Complete a claim record for every objective figure.
- Complete the asset schedule and attach permission evidence.
- Complete the data map and remove anything the recipient does not need.
- Export the final file, check qualifications survived, and record the approver and date.
For the trail between an approved kit and a requested change, Carrying an approved creator media kit version from requested change to delivery sets out the version record.
Common questions
Which advertising rules apply to a kit sent to brands rather than shown to consumers?
Business-to-business advertising falls under the Business Protection from Misleading Marketing Regulations 2008, which prohibit misleading advertising to traders. A publicly readable kit can also raise consumer questions under the Digital Markets, Competition and Consumers Act 2024.
Do I need permission to show client work and logos?
Yes. Copyright arises automatically for qualifying work, so each proposed use needs its own licence.
What personal data can appear in a public media kit?
Little. Use audience summaries rather than identifiable follower records, and trim testimonials to what the page needs. ICO minimisation, accuracy and storage limitation apply.
What should be reviewed before releasing a new version?
The recipient statement, claim records, asset schedule, data map and the exported file. Record the approver and the date.
In this guide
- Creator Media Kits UK Regulations: Rules for Email PitchesCreator media kits UK regulations for email pitches: check PECR consent, soft opt-in, CAP Code remit and business-to-business advertising rules.
- Checking the advertising claims in a creator media kit before it goes outCreator media kits advertising rules for England: check audience claims, selected work, qualifications and commercial context in each portfolio export.
- How much personal information does a creator media kit really need to disclose?Creator media kits data protection in England: map personal information, minimise portfolio disclosures and assess hosting, access and complaint handling.
- Three contract terms behind a creator media kit that deserve a proper readCreator media kits commercial contracts in England: a non-ranked review list covering portfolio licences, processing terms and payment responsibilities.
- A disclosure policy for creator media kit samples that survives a cropCreator media kits disclosure policy for England: preserve commercial context in portfolio samples and set clear review, export and correction responsibilities.
