When to check business awards data protection before you collect entries

What to take away

• The ICO's guidance on lawful basis is the reference point for awards processing, so read it before your entry window opens.
• Entrants need a lawful basis, usually legitimate interests, before passing another person's details to a judging panel.
• Organisers must publish a privacy notice before collecting entries, covering purposes, recipients and retention.
• Special category data needs an Article 9 condition on top of a lawful basis.
• The UK GDPR and the Data Protection Act 2018 apply in England and across the UK. Individual cases need a qualified adviser.

Who is responsible for business awards data protection

The organiser is normally the data controller for personal data gathered through entry forms, judging platforms and event registration. Entrants who submit details about nominees or referees carry their own duties, including a lawful basis and transparency towards those people.

In England, the ICO enforces the UK GDPR and the Data Protection Act 2018. Its lawful basis guidance confirms that legitimate interests can justify processing, provided you balance your interests against the individual's rights.

Asking for a date of birth or home address that judging never uses breaches data minimisation. If you want the wider compliance picture, our guide to business awards UK regulations in England covers advertising and consumer protection alongside data duties.

When to review your privacy notice

Review the notice before every awards cycle, not once. It must be concise, transparent and easy to find, naming your recipients and retention periods. A third-party entry platform is usually a processor, so you need a written contract with it.

Publishing shortlisted names and company details also needs a lawful basis. Consent must be freely given, specific and unambiguous, which is hard to secure from employees in a business context. Legitimate interests often fits better, backed by a balancing test you can evidence.

What to include in a privacy notice

• Controller identity and contact details.
• Purposes of processing and lawful basis.
• Recipients or categories of recipient.
• Retention periods.
• Individual rights, including access, rectification, erasure and objection.

How to handle special category data

Health, race, religion and sexual orientation are special category data. Diversity monitoring on an entry form needs an Article 9 condition, such as explicit consent, alongside your lawful basis. Where processing is likely to be high risk, complete a data protection impact assessment before you launch.

Checklist before you collect entries

• Identify your lawful basis and write it down.
• Update the privacy notice and publish it before the form goes live.
• Strip unnecessary fields from the entry form.
• Sign a written contract with every data processor.
• Set and document a retention period for entry data.
• Brief staff on data subject requests and your one-month response deadline.
• Review security for online forms, uploads and databases.

How data protection fits with wider compliance

Data protection sits alongside advertising standards and intellectual property. The ASA's advice for businesses summarises the compliance duties that apply when you promote an awards scheme, including how you describe entry fees and judging.

Innovation or sustainability claims in an entry need evidence. BSI's innovation labs and sustainability work is a sensible reference for technology and sustainability categories. Ethics extend further still: Trading Standards investigations into counterfeit toys illustrate how IP enforcement shapes business reputation. Our business awards rules and compliance guide sets out the full framework.

Common questions

Do I need consent to publish shortlisted entrant names?

Not always. Consent is one route, but legitimate interests can apply where publication is necessary for the awards and balanced against individual rights. Tell people in advance either way.

How long can I keep entry data?

Only as long as the purpose requires. For many programmes that means until the ceremony plus a short administrative period. Document the schedule and delete on time.

What if an entrant submits someone else's personal data?

The entrant needs a lawful basis for sharing it and must inform the individual. Add a reminder to your entry form so the duty sits with the person supplying the data.

Does data protection law differ in Scotland, Wales or Northern Ireland?

No. The UK GDPR and the Data Protection Act 2018 apply across the UK and the ICO enforces them.

This is general guidance, not legal advice. Individual cases need a qualified adviser.