A competition website collects names, emails, addresses and payment details, so UK GDPR applies from day one. You usually need to pay the ICO data protection fee, choose a lawful basis for each use of data, and get consent before you send marketing.
The ICO data protection fee
The Information Commissioner's Office (ICO) says organisations that use personal information need to pay a data protection fee unless they are exempt. The rules come from the Data Protection (Charges and Information) Regulations 2018. A competition business holding customer data will normally need to pay.
The fee has three tiers based on turnover and staff numbers. At the time of writing, the ICO lists £52 for tier 1 (turnover up to £632,000 or no more than 10 staff), £78 for tier 2 (turnover up to £36 million or no more than 250 staff) and £3,763 for tier 3. Paying by direct debit takes £5 off. Most new competition operators will be in tier 1. Fees can change, so check the ICO's fee guide before you pay.
Pay before you collect data. The ICO can issue fixed penalties to organisations that should have paid and did not.
Pick a lawful basis for each use of data
UK GDPR requires a lawful basis for every purpose you process personal data. For a competition site, these are the usual ones.
- Contract. Taking payment, recording tickets, running the draw and delivering the prize. The customer has bought something from you, so you need their data to perform that contract.
- Legal obligation. Keeping accounting and tax records.
- Legitimate interests. Fraud prevention and age and identity checks. You need to weigh these against the person's rights and be able to show your reasoning.
- Consent. Marketing, where it applies. Consent must be a clear, specific choice, not a pre-ticked box.
Write the basis for each purpose into your privacy policy. Do not use consent as the basis for the whole thing. If someone withdraws consent to marketing, you must still be able to run their order.
Marketing consent and PECR
Marketing emails and texts are covered by the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. In general you must not send marketing emails or texts to individuals without their specific consent.
There is one exception, called the soft opt-in. It covers your own customers, and all of the following must be true:
- You got their details when they bought, or asked about buying, something from you.
- You only market similar products or services to them.
- You gave them a clear chance to opt out when you collected their details, and you offer it again in every message.
Every marketing message needs an easy way to unsubscribe, and you must not hide who you are. Act on opt-outs promptly, and keep a suppression list so people who opted out do not get added back.
Do not make marketing consent a condition of entering the competition. Use a separate, unticked box. Niche's consent log records what each person agreed to and when, which is the evidence you will need if anyone asks. It works with the email, SMS and push marketing tools, so you only message people who have opted in. For ideas on what to send, read how to market a competition website.
Data you should and should not keep
UK GDPR asks you to collect only what you need and keep it no longer than you need it. Set retention periods and stick to them.
- Keep order and payment records for the period your accountant advises.
- Keep winner records for as long as you might need to answer a complaint or dispute.
- Delete identity documents once the check is complete and any dispute window has passed. See KYC and age checks.
- Delete data from people who asked to be erased, unless you have a legal reason to hold it.
People's rights, including erasure
People can ask to see their data, correct it, object to marketing and, in some cases, have it erased. You normally have one month to respond. Set up a simple route, such as an email address or a form, and log each request and your answer.
Erasure is not absolute. You may need to keep some records, such as invoices or draw results, even if the customer asks you to delete everything. Explain this in your reply. Niche includes erasure request tools so you can track and process these requests in one place.
What to put on the site
- A privacy policy that names you, lists what you collect, why, the lawful basis, how long you keep it, who you share it with (for example your payment provider and any identity check provider) and how to exercise rights.
- A cookie banner and policy, if you use analytics or advertising cookies. PECR requires consent for non-essential cookies.
- Clear wording next to the marketing checkbox.
- Data processing agreements with the suppliers that handle data for you.
If you run ads, remember that data shared with ad platforms is still personal data, so check what you pass on. Done-for-you customers can ask us how the ad tooling handles this.
GDPR for competition websites is one piece of the launch checklist. For the rest, see how to start a competition website and Niche pricing. Every plan includes the GDPR tools.
This is general information, not legal advice. Take advice from a solicitor before you launch.
Frequently asked questions
Do I need to register with the ICO for a competition website?
Most organisations that process personal data must pay the ICO data protection fee unless exempt. The ICO has a short self-assessment on its website. A competition business collecting customer data will usually need to pay.
How much is the ICO data protection fee?
At the time of writing, the ICO lists £52 for tier 1 (micro organisations), £78 for tier 2 (small and medium) and £3,763 for tier 3 (large), with £5 off for direct debit. Check ico.org.uk for the current figure.
Can I email past entrants about new competitions?
Only if they consented, or the soft opt-in applies: they bought from you, you are marketing similar products, you offered an opt-out when you collected their details and you offer it in every message. Past entrants who did not buy are not covered by the soft opt-in.
Can I make marketing consent compulsory to enter?
No. Consent has to be a free choice. Use a separate, unticked box and let people enter without ticking it.
This is general information, not legal advice. Rules can change: check the Gambling Act 2005 and guidance from the Gambling Commission, or speak to a solicitor, before you launch.