Rules and ethics
Part of Property creators rules and ethics in England
Property creators data protection: mapping data flows
Property creators data protection: map identifiable data, roles and purposes across filming, enquiries, suppliers, transfers and marketing.
Property creators data protection begins with a data-flow map, not a generic consent form. For a project in England, map each identifiable person, image, voice, location, enquiry and account identifier from collection to deletion. This is general UK guidance and cannot decide a real lawful basis or filming dispute.
The Data (Use and Access) Act 2025 amended, rather than replaced, the UK GDPR, Data Protection Act 2018 and PECR. Check the current legislation and ICO guidance that apply to each processing activity before publication.
What to take away
- Map every identifiable person, image, voice, location, enquiry and account identifier from collection to deletion before relying on any consent form.
- The Data (Use and Access) Act 2025 amended rather than replaced the UK GDPR, Data Protection Act 2018 and PECR.
- The factual decision-making relationship determines controller or processor role, and one business can hold different roles.
- Consent to appear, a location release and copyright permission are not interchangeable with a UK GDPR lawful basis.
- Publishing a clip, sending an enquiry and adding somebody to a mailing list are separate purposes needing separate analysis.
Map roles and purposes
For every flow, record the person or organisation deciding why and how data is used. The ICO's controller and processor guidance says the factual decision-making relationship determines the role; the same business can hold different roles for different processing.
A creator may follow an agency's filming instructions, then independently reuse footage for a portfolio. The second purpose needs its own role analysis. Identify controllers, processors and sub-processors, then document responsibilities and rights routes.
Record the lawful route before capture
Create one row per purpose: producing the commissioned asset, publishing an identifiable person, operating an enquiry form, sending follow-up, measuring use and retaining an archive. Name the lawful basis, necessity reasoning, recipients, retention and privacy information for each. Consent to appear, a location release and copyright permission are not interchangeable with a UK GDPR lawful basis.
Avoid unnecessary exact addresses, access instructions, alarm or camera positions, occupancy routines, planned absences and visible identity or financial documents. The ICO's data-minimisation page requires a rational link between information and purpose.
Ordinary identifiable footage is not automatically biometric data. However, the ICO explains in its special-category guidance that specific technical processing for unique identification can make biometric data special category, and intended inferences about matters such as health or ethnicity can trigger further conditions. Do not run recognition or sensitive inference on property footage without a specialist assessment.
Control suppliers and transfers
The ICO lists required matters in its Article 28 contract guidance, including documented instructions, security, sub-processors, assistance and return or deletion. Check the applicable service tier, processing and audit evidence.
Cloud access from outside the UK may be relevant even when storage appears local. The ICO's international-transfer guide describes a three-step approach; assess whether the arrangement is a restricted transfer and identify the applicable mechanism. Other UK GDPR obligations still apply. A privacy lawyer should determine the position.
Separate publication from marketing
Publishing a clip, sending an enquiry to its intended recipient and adding somebody to a mailing list are different purposes. The ICO's direct-marketing planning guidance treats email, text and social direct messages as electronic mail. Do not bundle future marketing into filming or enquiry permission.
Set access, deletion, correction, withdrawal and incident routes. The ICO's data-security guide sets out risk-based confidentiality, integrity, availability and recovery considerations. Stop publication for an exposed security detail, unclear controller role, missing rights record or unassessed transfer, and obtain named privacy, property, rights, security and accessibility review.
Before you act
- Map each data flow from collection to deletion.
- Record the lawful basis and necessity reasoning per purpose.
- Check Article 28 contract terms and sub-processors.
- Assess any restricted transfer with a privacy lawyer.
- Keep marketing separate from filming and enquiry permission.
- Set access, deletion, correction, withdrawal and incident routes.
Common questions
What should a property creator map before filming or collecting leads?
Map each identifiable person, image, voice, location, enquiry and account identifier from collection to deletion. The article says data protection begins with a data-flow map, not a generic consent form, and that this is general UK guidance which cannot decide a real lawful basis or filming dispute.
When does footage of people become special category data?
Ordinary identifiable footage is not automatically biometric data. The ICO says specific technical processing for unique identification can make biometric data special category, and intended inferences about health or ethnicity can trigger further conditions. Do not run recognition or sensitive inference on property footage without a specialist assessment.
Can a creator add an enquirer to a mailing list using the same permission?
No. The article says publishing a clip, sending an enquiry to its intended recipient and adding somebody to a mailing list are different purposes. The ICO treats email, text and social direct messages as electronic mail, so do not bundle future marketing into filming or enquiry permission.
