Rules and ethics
Part of Landing page software rules and ethics: a UK review guide
Landing page data protection: five questions to set each role
Five questions assign a controller or processor role to each landing page purpose, with a first-view table for the form, Meta pixel and GA4.
Roles decide who writes the privacy notice, who answers a rights request and which UK GDPR contract terms must exist. On a landing page they differ row by row, because a supplier may process form data on instructions and use other data for itself. This is general information, not legal advice, and a named UK data-protection and PECR specialist must review the real processing.
What to take away
- Assess controller and processor roles for each activity, not once per supplier.
- A contract heading cannot override what the parties actually decide or do.
- A supplier that also uses data for its own purposes needs a separate row.
- If a supplier is a processor, check instructions, sub-processors and deletion terms.
- Keep the page on hold if a role is unknown.
Start with the two definitions
The ICO's guidance explains that a controller, alone or jointly with others, determines the purposes and means of the processing of personal data. A processor processes personal data on behalf of the controller. Everything else follows from asking who decides.
A supplier may process some data on instructions and use other data for its own purposes. The question is therefore asked per activity, not per supplier. Assess each one, and preserve the reasoning in the file so a reviewer can follow it later.
If a processor acts without the controller's instructions in a way that determines purpose and means, the ICO says it will be a controller for that processing, with the same liability. A processor may still make its own day-to-day operational decisions.
Five questions for every row
Ask the same questions for each purpose on the mapping table, in this order, and write the answers beside the roles field.
- What is the purpose of this activity, and who set it?
- Who decides which fields are collected and how long they are kept?
- Does the supplier act only on documented instructions?
- Does the supplier also use the data for its own services?
- Who handles a rights request for this row?
If the answer to question four is yes, treat the supplier's own use as a separate purpose with its own row. Do not fold it into the row for the business's purpose, because the notice, basis and retention may differ.
A role for each landing page purpose
Each row below gives a starting answer for one activity on a typical page. Treat it as a first view to test against the facts, because roles come from conduct and the supplier's own terms.
| Activity | Business | Supplier or platform | What settles it |
|---|---|---|---|
| Form submission held in the page software | Controller, for handling the enquiry | Processor, if it acts only on the business's instructions | The contract and what the supplier does with the data |
| Ad measurement with a Meta pixel | Controller, for its own advertising purpose | Meta sets purposes for its own services, so it decides for itself there | Whether the two decide together on the same operation, which would need a joint arrangement under Article 26 |
| GA4 measurement on the same page | Controller, for measurement | Depends on whether the provider uses the data for its own purposes | The analytics terms, read row by row |
| Enrichment, scoring or sharing | Controller, if it specifies the use | Processor if acting on instructions; controller if acting for itself | Who specified the use, and who benefits from it |
The pixel and GA4 rows stay separate. GA4 on the same page needs its own row, with consent for storage and access under PECR and a separate basis for measurement. A role found for one technology is not assumed for another.
Clear team roles matter here, because someone must be named to decide each purpose. A role table with no named decision-maker cannot be checked.
Contract terms when the supplier is a processor
If a supplier is a processor for an activity, examine the binding terms, instructions and sub-processors. A contract heading cannot override what the parties actually decide or do, so compare the terms with the row you wrote.
Under Article 28(3)(a), the ICO explains, the contract must say the processor may only process personal data in line with the controller's documented instructions, unless UK law requires otherwise.
Article 28(2) bars a processor from engaging another processor without the controller's prior specific or general written authorisation. Check the supplier's sub-processor list against the recipients on every row before the page goes live.
Article 28(3) sets out the rest of the contract. Look for each of these terms in the supplier's paper:
- Confidentiality for the people who handle the data.
- Security measures that fit the processing.
- Help with rights requests, security duties and impact assessments.
- Deletion or return of the data when the service ends.
- Information for audits and inspections.
Where roles meet PECR and transfers
Inventory cookies, pixels and scripts before release, using the release checklist. A role finding under data protection does not answer the separate PECR question about storing or accessing information on a device, so keep the two in different columns.
Consent for storage and access belongs in the legal analysis field of each row. Map international access as well as hosting, and record actual recipients, safeguards and review dates against the supplier named in the roles field.
Keep the page on hold if a purpose, recipient, role, basis, PECR position, transfer or deletion route is unknown. An unknown role is a reason to wait, not a field to fill with a guess.
Before you act
- Assess controller and processor roles for each activity.
- Write the answers to the five questions beside each row.
- Give the supplier's own use of data a separate row.
- Compare processor terms with the row, including sub-processors.
- Name the person who decides each purpose.
- Hold the page if any role is unknown.
Common questions
How do you determine controller and processor roles?
From conduct, not contract headings. Assess each activity, because a supplier can be a processor for one use and a controller for another.
Can the same supplier be both?
Yes, for different activities. A supplier may process form data on instructions and use other data for its own purposes, which is why each purpose has its own row.
What should be checked if a supplier is a processor?
The binding terms, the documented instructions and the sub-processors. Compare each against the row, and keep the page on hold until the role and the terms agree.
