Set a creator tax disclosure policy that survives an audit

What to take away

Decide what your policy has to cover

Start with the decision in front of you. A brand sends a contract, you publish the post, an invoice goes out, and each step creates a disclosure duty.

The policy should name who labels content. On a solo operation that is you. Once you hire an editor, the duty sits with whoever publishes, so the policy must say who signs off.

Two duties sit inside one document. The first faces the audience: how a paid post is labelled. The second faces HMRC: how each payment is recorded and declared. Define both, because a post can carry a perfect label and still leave income out of the return.

List every income stream the policy has to cover: brand fees, affiliate commission, platform payouts such as ad revenue share, and the value of gifted products and trips. Gifts and free trips received in return for promotion are trading income, not personal presents, so they need a line in the folder even when no money changes hands.

The wider filing picture is in the site's creator tax rules and compliance guide, which shows how the annual return fits with disclosure duties.

Label paid partnerships the way the rules expect

A disclosure policy is not a tax document on its own. It is the control that stops a commercial post going out unlabelled.

The Committee of Advertising Practice code requires ads to be obviously identifiable. A clear "Ad" or "Paid partnership with [brand]" at the start of the caption is the usual answer. Buried hashtags do not count.

If a post breaches the code, the Advertising Standards Authority can publish the ruling and ask platforms to remove the ad. The ASA's published sanctions guidance sets out that escalation.

The same duty applies to stories, podcasts and pinned comments: if the brand paid, the audience must know.

Keep the records HMRC would ask to see

Disclosure and tax overlap at the evidence stage. Every sponsored post needs a matching contract, invoice and bank line.

Name the folder structure. For example, a creator earning £2,000 a month from brand deals might file by brand and month, with the invoice number in the file name. That is an illustrative figure.

A workable clause reads: "All income from brand deals, affiliate commission, platform payouts and gifted items is logged in the income folder and included in my Self Assessment return." Name the person who checks it and the date of the last review.

Self Assessment usually requires records for at least five years after the 31 January filing deadline. The policy should say who backs up the folder.

The duty to keep those records comes from the Taxes Management Act 1970, which applies to anyone who files a Self Assessment return. Most self-employed creators file form SA100 with the SA103 self-employment pages, so the policy should say where the figures for those pages come from.

If you take on an editor or videographer, employment status questions follow. The GOV.UK guidance on employing people covers the checks that apply when you hire staff, including right to work and payroll.

If you are registered for VAT, add a line saying who raises VAT invoices and where the VAT records are kept. VAT is checked separately from income tax, and the invoice numbering has to match the income folder.

What an HMRC compliance check asks for

A compliance check, which is what most people mean by an audit, usually opens with a letter or a call naming the return under review. HMRC then asks for the records behind that return: contracts, invoices, bank statements, platform payout statements and expense receipts.

If the records do not arrive, HMRC can issue an information notice under Schedule 36 to the Finance Act 2008. The notice sets a deadline and can be appealed.

Errors in a return are handled under Schedule 24 to the Finance Act 2007, and failing to keep adequate records can itself attract a penalty under the Taxes Management Act 1970. A policy will not stop a check, but a dated folder and a named owner make the answers quick to give.

Handle audience data inside the same policy

A disclosure policy that ignores data protection leaves a gap. Giveaway entries, newsletter sign-ups and remarketing lists all collect personal data.

The ICO's step-by-step guide to direct marketing for small businesses explains consent, soft opt-in and the privacy information you must give people. Your policy should follow the same rules.

That guide sits on top of the Data Protection Act 2018 and UK GDPR, with the Privacy and Electronic Communications Regulations 2003 (PECR) covering email and text marketing. Name the lawful basis for each list in the policy and keep the privacy notice alongside it.

Say how long you keep entrant lists and who can access them, then delete what you no longer need.

The site's creator tax data protection guide covers the sources you can rely on when documenting that processing.

Review, version and assign sign-off

Date every version and note what changed. Review it when a platform updates its branded content tools, when you take on help, or when a brand contract adds a disclosure clause.

Who signs off the policy?

The creator owns it. A bookkeeper can check the tax records, but the publishing decision stays with the person posting.

How often should it be reviewed?

At least once a year, plus after any platform or contract change. Put the review date in your calendar.

If a label goes out wrong, fix it, note the correction and log it. Repeated breaches attract regulator attention.

Glossary

Common questions

Does England have a separate disclosure rule?

No. The advertising code and tax rules apply across the UK. Scotland, Wales and Northern Ireland follow the same framework, so a policy written for England works elsewhere.

Does a disclosure policy replace tax advice?

No. It is an internal control. Individual cases need a qualified adviser who can see your contracts and income.

Do small creators need a written policy?

Yes, even at low income. A one-page checklist is enough, and it becomes the evidence that you took the rules seriously.