Creator tax data protection: duties before storing

What to take away

Start with the mistake, not the tool

Most creators buy the tool first, whether that is a spreadsheet, an invoicing app or a mailing list platform, then seek a reason to hold whatever it collects.

The law expects the opposite order. Under the UK GDPR you need a lawful basis before processing starts, and you must be able to explain it. A privacy notice written afterwards rarely matches what the business actually does.

Which lawful basis fits creator tax records

Accounting work normally rests on legal obligation. You keep invoices and payment records because tax law requires it, not because a client ticked a box. Consent is a weak fit there, since nobody can withdraw it to erase a VAT record. Contract suits the point where a client shares details so you can deliver a paid commission.

A short record of processing helps here. Note the purpose, the data types, the basis and the retention period for each set. Review it whenever a client or a platform changes how you work.

Core UK data protection duties

The UK GDPR is supplemented by the Data Protection Act 2018. Check the ICO’s data protection fee self-assessment and pay the fee if required; most organisations processing personal data must pay unless an exemption applies. The ICO maintains a register of fee payers, but paying the fee does not replace your data-protection duties.

UK GDPR Article 32 requires security measures appropriate to the risk, such as controlling access to records and protecting them from loss or unauthorised access. If a personal data breach is likely to risk people’s rights and freedoms, report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Tell affected people without undue delay if the breach is likely to create a high risk.

People have rights including access, correction and, in some circumstances, erasure, restriction, data portability and objection. A subject access request (DSAR) usually needs a response within one month, though the deadline can be extended for complex requests. A legal duty to retain tax records may mean you cannot erase those records immediately.

If an invoicing, storage or mailing-list provider processes personal data for you, UK GDPR Article 28 requires a written contract. It must cover documented instructions, confidentiality, security, sub-processors, assistance with rights requests and compliance duties, deletion or return of data, and audit rights. For personal data sent outside the UK, check whether UK adequacy regulations apply or use an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and complete a transfer risk assessment where required.

HMRC’s record-keeping requirements help you separate a tax file from a marketing database. For wider filing context, see the creator tax compliance guide.

Set retention before you store anything

Retention is where quiet problems start. A tax file and a campaign list have different lifespans, so mixing them creates avoidable work. Decide a period per data set, write it in a one-page schedule, then delete on time. If a client asks which records you hold about them, that schedule is your answer.

For example, a studio keeping invoice records for six years might hold newsletter signups for two. Put both dates in one schedule so nobody has to guess later.

Creator services are usually standard-rated at 20%, but some publications fall into reduced or zero-rated categories. Check HMRC’s VAT rates on different goods and services guidance before saving a rate to a client record. For VAT record-keeping, HMRC’s VAT Notice 700/21: keeping records explains what to retain.

Email lists, ads and disclosure

Email marketing sits under PECR as well as the UK GDPR. The soft opt-in may cover messages to your own existing customers about similar products or services, but you must offer an opt-out when collecting their details and in every message. Other marketing emails generally need consent. The ICO’s guidance on direct marketing using electronic mail sets out these conditions.

Records matter as much as wording. Keep the opt-in text and the date alongside each subscriber entry, because a list without its source is hard to defend.

Paid partnerships add a second layer. Rule 2.1 of the CAP Code says marketing communications must be obviously identifiable as such, and the ASA’s advice for businesses explains what that means for labelled posts. The creator tax disclosure policy in England discusses how disclosure wording connects with what you invoice.

Score your own setup

Test the workflow before a client or a platform asks awkward questions. Score each line from zero to two: zero for missing, one for partial, two for documented and applied. For example, a two-person studio scoring 7 out of 12 has usually sorted its marketing and neglected retention.

This guide is written for England-based creators, and the data protection and advertising sources cited apply across the UK. Where a filing rule differs in Scotland, Wales or Northern Ireland, follow the devolved guidance. General guidance only: individual cases need a qualified adviser.

Common questions

Do I need consent to hold a client's invoice details?

No. Legal obligation or contract normally covers invoicing, and a client cannot withdraw consent to erase a VAT record anyway.

How long should creator tax records be kept?

For a sole trader’s Self Assessment, HMRC generally requires records to be kept for at least five years after the 31 January submission deadline for the relevant tax year. A limited company must generally keep accounting records for six years from the end of its financial year; VAT records are generally kept for six years, subject to exceptions. Check HMRC record-keeping guidance for your circumstances before deleting anything.

Can I buy an email list to promote a service?

No. PECR requires consent, and the soft opt-in only reaches your own existing customers.

Does ad disclosure belong in a data protection policy?

The duties are separate, but they collide in practice. Labelled posts create records you may need to produce later, so keep both in the same schedule.