UK review responses and UK GDPR: a practical guide

What to take away

Why a public reply is a data protection decision

When you reply under a review, you publish information about an identifiable person. That makes the reply a processing activity, not just customer service. The principles in Article 5 of the UK GDPR, including lawfulness, fairness, transparency and data minimisation, apply to a public response.

Under Article 6(1)(f), a retailer may be able to rely on legitimate interests to respond to a review, but this is not automatic: identify the purpose, show the reply is necessary and balance it against the reviewer's rights and reasonable expectations. Record that assessment, and do not use it to justify publishing account details.

The Data Protection Act 2018 sits alongside the UK GDPR. A reviewer can make an access request under Article 15 and request erasure under Article 17; erasure is not automatic where there is a lawful reason to retain information. Under Article 21, a reviewer may object when you rely on legitimate interests; assess the objection and stop unless you can demonstrate compelling legitimate grounds to continue.

A reviewer can make a rights request to the business, which must assess and respond to it. A short written note of what you decided, and why, is the simplest defence.

The Information Commissioner's Office (ICO) is the UK regulator of data protection and other information rights legislation, and a reviewer who is unhappy with how you handled a request can complain to it. The ICO's guidance on the right to object says you must comply with an objection without undue delay and at the latest within one month of receipt, and you can extend the time by a further two months if the request is complex or the reviewer has made a number of requests. Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information need to pay the ICO a data protection fee unless they are exempt.

What you must not publish in a reply

Safe wording for common review scenarios

| Scenario | Avoid | Safer public wording |

|---|---|---| | Order or refund complaint | “We refunded your order yesterday.” | “We’re sorry to hear this. Please contact us privately so we can look into it.” | | Delivery dispute | “Our records show your parcel was delivered.” | “We’re sorry this has not been resolved. Please contact us privately so we can review it with you.” | | Allegation involving a staff member | “We have spoken to the employee involved.” | “We’re sorry to hear about your experience. We’ll review your feedback; please contact us privately so we can understand the concern.” |

A four-step process for the first 24 hours

Aim to reply within one working day, but never before you have checked the facts.

When the reviewer has the facts wrong

You are not obliged to accept a false claim, but a public argument rarely helps. State your position once, in neutral terms, and stop there.

If the record shows a delivery scan or a signed receipt, say that you have checked the details and would like to resolve the matter directly. Do not publish the scan itself.

Reviews that name staff or make allegations

If a review names an employee, do not confirm shifts, rotas or disciplinary action. Reply to the customer's experience and take the staffing point offline.

Some shops try to filter unhappy customers before they reach a public platform. The review gating rules are addressed in the Competition and Markets Authority's (CMA) Online reviews and endorsements: advice for businesses: do not selectively invite customers likely to leave positive reviews while discouraging others. That can mislead shoppers and may also breach platform rules; a written reply policy usually does more for your rating than a filter does.

Training your team on the same wording

A reply written late at night by whoever is on shift will not match one written by the owner. Give staff three approved phrases and one rule: no account details in public.

Review your published replies each quarter. If two of them reveal the same type of detail, the wording, not the person, needs fixing.

When to report a review instead of replying

Report a review when it is fake, posted by a competitor or left in exchange for a reward. Review bombing, where a group floods a page with one-star posts, is a platform issue rather than a data protection one, but your reply still has to be careful. Use each service's own reporting flow: report the review in Google Business Profile, use Trustpilot's report-review function, or use Facebook's report option on the review or recommendation.

The Competition and Markets Authority (CMA) oversees enforcement of consumer-protection rules on misleading commercial practices, including fake reviews. The Digital Markets, Competition and Consumers Act 2024 prohibits certain fake-review practices and requires reasonable and proportionate steps to prevent and remove fake reviews. Keep dated evidence of anything you report.

Common questions

Can I confirm that a reviewer was a customer?

No. Confirming the relationship publicly tells the world something the reviewer has not confirmed themselves, and it is rarely needed to answer the point they raised. An apology plus an offer to continue privately is usually enough.

Does UK GDPR stop me asking a platform to remove a review?

No. You can ask the platform to remove content that breaches its own policy or the law. A harsh but honest review should stay, and pretending otherwise weakens your position.

Do I need permission to quote a review in my marketing?

Not automatically. A published review is not a licence to reuse a name, photograph or video, and you need a separate record of permission before you put either in an advert. Our guide to customer photo permissions UK explains how to keep that record.

How long should I keep complaint records?

A six-year retention period is common because it matches the limitation period for contract claims in England and Wales. Set yours in writing and delete what you no longer need.