Why England's commerce reviews data protection rules catch retailers

What to take away

What does data protection law require when you collect reviews?

Asking a customer for a review is a data processing activity, and UK GDPR applies from the first email. You need a lawful basis before you send anything.

Transparency matters more than most teams assume. If you plan to publish the review or quote it in paid social, say so when you collect it.

Data minimisation is the easiest rule to break. Collect the review text and the display name; do not hoover up order history or phone numbers because they are there.

Retention should be a decision, not a default. Choose a period that matches your purpose, record it, and delete on schedule.

Our commerce reviews UK rules and compliance guide for 2027 shows how these duties sit alongside consumer law if you are writing the policy from scratch.

How does the CMA treat fake and incentivised reviews?

The Digital Markets, Competition and Consumers Act 2024 added fake and misleading reviews to the list of banned commercial practices. The CMA can now act directly against a business that breaks the rules.

The banned list covers writing or commissioning fake reviews, and presenting genuine ones in a misleading way. Showing only five-star feedback risks falling into the same category.

Incentives are not banned, but undisclosed ones are. An incentive such as a discount or prize draw entry must be visible to readers.

Suppressing negative reviews is the other common failure. Delaying a poor review until it is out of date distorts what a shopper sees.

These duties sit in primary legislation, and the official statute book on legislation.gov.UK publishes the full text of Acts and their commencement dates for England.

What does the ICO expect from review request emails?

Emails and texts asking for a review count as direct marketing under PECR, so they normally need consent. The ICO's direct marketing guidance sets out the test, including the soft opt-in.

The soft opt-in is narrower than many retailers assume. It applies only where the address came from a sale, the products are similar, and an opt-out was offered.

A bought list is not a shortcut. Consent must be given to you, for your messages, and you have to be able to prove it later.

A customer who opts out of marketing should not receive a review request by email unless a separate lawful basis exists, and usually none will.

How do you audit review data before a complaint arrives?

An audit costs less than a complaint. Take twenty reviews at random and try to reconstruct where each came from and when it should be deleted. Gaps in that trail are the exposure.

Individual cases need a qualified adviser, because the outcome turns on facts a checklist cannot capture.

The commerce reviews UK regulations in England page is worth reading next if your team also sells into Scotland or Northern Ireland.

Common questions

Do we need consent to publish a customer's review?

Publishing is a separate purpose from asking, so it needs its own lawful basis and clear notice about what will be shown.

How long can we keep review data?

Only as long as your stated purpose requires. Set a period and delete on schedule, for example 24 months after publication.

Who enforces review rules in England?

The CMA enforces consumer protection law, and has been able to act directly since 6 April 2025. The ICO enforces data protection and PECR.

Does the ICO regulate review platforms?

It regulates how personal data is handled on review platforms, but not reviews as a commercial practice. That falls to the CMA.