What should a business awards disclosure policy include in England?

What to take away

Who the policy covers

A business awards disclosure policy sets out how your organisation describes awards it wins, sponsors, judges or runs. It applies to press releases, LinkedIn posts, pitch decks and tender submissions.

It also binds staff, agencies and freelancers posting on your behalf, so name roles rather than people. That way the policy survives staff changes.

Scope matters more than length. A three-page policy that names the award, the claim and the approver beats a twelve-page document nobody reads. Keep the master version centrally, and let regional teams add local notes rather than rewrite the whole thing.

Smaller entrants often borrow the organiser's wording without checking it. That is where undeclared sponsorship and paid-for categories cause problems later. For the wider rule set, see the business awards UK rules and compliance guide for 2027.

Data and consent rules

Award entries collect personal data: entrant names, judge notes, photographs and sometimes special category data. Under the UK GDPR and Data Protection Act 2018, identify and document a lawful basis for each purpose. The six UK GDPR lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests; consent is not the only option.

Health information, including some mental health information, is special category data. Processing it requires an Article 9 condition as well as a lawful basis, and the relevant condition in the Data Protection Act 2018 must also be identified.

The UK GDPR's storage limitation principle requires data to be kept no longer than necessary, but it does not set one universal retention period for award entries. State and justify the actual period for losing entries, winners, judge notes and photographs, and explain when data will be deleted or anonymised.

Most organisations acting as data controllers must pay the ICO data protection fee unless exempt. The requirement is set out in the Data Protection (Charges and Information) Regulations 2018; check the ICO's fee guidance and exemption assessment. The ICO's enforcement action against British Airways over a data breach is a UK example of data-protection enforcement, though not an awards-specific precedent.

Your policy should give a retention period for losing entries as well as winners, and explain the purpose behind each period. There is no universal statutory number of months or years for these award records: set periods that are necessary for your purposes and review them when those purposes change. Explain how a nominee can withdraw permission for future use of a photograph; withdrawal does not undo processing that was lawful before withdrawal.

Where an organiser and a sponsor act as joint controllers, say who answers a subject access request. Put that in the sponsorship contract as well, because entrants will ask the organiser first whatever the paperwork says.

If you buy a mailing list to promote an awards programme, disclose the source and use in your privacy information, and check that the permissions cover your organisation and this marketing. The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) apply to electronic marketing alongside data protection law. For email or text marketing to individual subscribers, obtain consent or meet PECR's soft opt-in conditions: the organiser must have collected the details directly during a sale or negotiations for a sale, market its own similar products or services, and offer an opt-out when collecting the details and in each message. A bought list cannot qualify for the soft opt-in.

Advertising and claim rules

The CAP Code, enforced by the Advertising Standards Authority, requires that marketing communications are obviously identifiable as such. A paid-for award category presented as editorial coverage breaches that principle.

Write down which claims require evidence. "Award-winning" needs a named award and year. "Best in the UK" needs a documented comparison.

Keep a dated copy of every claim you publish. When a category name changes the following year, the old wording still needs to be traceable to the evidence you held at the time.

In England, check with the relevant local council if an awards event includes licensable activities; the council is the licensing authority under the Licensing Act 2003. GOV.UK's housing and local services information can help you find local services.

Promotions and prize draws

If an awards promotion offers a prize, assess whether it is a lottery, free draw or prize competition under the Gambling Act 2005. A lottery may require a licence or registration unless an exception applies; a free draw or prize competition must meet the Act's conditions to fall outside lottery licensing. Check the Gambling Commission's guidance before running a promotion where the distinction is unclear.

Sensitive categories

Well-being, safeguarding and mental health entries may reveal health information, which can be special category data under the UK GDPR. State what information you collect, why, who can access it and which additional legal condition permits its use. The linked quality checklist can support your wider review of entrant safeguards.

State whether case studies are anonymised, who approves them, and how long consent lasts. Judges should see no more personal detail than the scoring criteria require.

Consent for a case study is not consent for a press release. Ask separately, and let the entrant read the final wording before it goes out.

Comparison of disclosure routes

Drafting steps

Give each claim type a short approved template, so press teams stop rewriting the wording from scratch under deadline.

The core data and advertising rules in this guide apply across the UK, so there is no separate England-only disclosure form. In England, the local licensing authority and the Licensing Act 2003 are relevant where an event includes licensable activities. Organisers should describe the claims and data processing they control; entrants should check that any award wording they reuse is accurate. For additional background, see business awards UK regulations in England.

This is general guidance, not legal advice. Individual cases need a qualified adviser, especially where special category data or regulated promotions are involved.

Common questions

Does a disclosure policy need legal review?

Not always, but any policy covering personal data, promotions or regulated sectors should be checked by a qualified adviser.

How often should the policy be updated?

At least annually, and whenever you add a new category, sponsor or data source.

Does the policy apply to social media posts?

Yes. Brief staff and agencies so paid partnerships and sponsored categories are labelled in the post itself.

What happens if a claim is wrong?

Correct it publicly and quickly, and record the correction. Repeat errors can attract regulator attention and damage future entries.