Rules and ethics
How ICO data retention rules shape SEO tool contracts for UK buyers
SEO tools contracts in the UK must meet ICO data retention rules, UK GDPR duties and Data (Use and Access) Act 2025 changes. Here is how to check them.
What to take away
- SEO tools used by UK teams usually process personal data, so retention and deletion terms sit inside UK GDPR and Data Protection Act 2018 duties, not outside them.
- The ICO expects a defined retention period, a lawful reason for keeping data, and a route to erasure when the purpose ends.
- The Data (Use and Access) Act 2025 changes parts of the UK regime, so contracts signed before it need a review of retention, analytics and international transfer clauses.
- Buyers should demand named clauses on retention, deletion, sub-processors, location and subject access support, not rely on a privacy policy.
- Vendor answers on where data is stored and for how long should be written into the data processing agreement before signature.
How the ICO and UK GDPR frame retention in SEO tool contracts
An SEO tool rarely looks like a data processor until you list what it stores. Rank tracking pulls search queries. Backlink tools keep referring domains and contact emails. Content tools hold drafts, briefs and sometimes author accounts. Analytics connectors pull visitor identifiers.
What SEO tools store as personal data
Tool type
- Rank tracking
- Search queries
- Backlink tools
- Domains, contact emails
- Content tools
- Drafts, briefs, author accounts
- Analytics connectors
- Visitor identifiers
Data held
- Rank tracking
- Tied to person
- Backlink tools
- Identifiable person
- Content tools
- Author is identifiable
- Analytics connectors
- IP or ID
Retention trigger
- Rank tracking
- Backlink tools
- Content tools
- Analytics connectors
Most of that is personal data under the ICO definition of personal information, which covers any information relating to an identified or identifiable person.
That definition matters because it sets the scope of the contract.
If a tool stores an email address, a user ID, an IP address or a query that can be tied to a person, the retention clause applies. Personal information - what is it? | ICO explains the test the ICO uses, and it is broader than many procurement teams assume.
Under UK GDPR, storage limitation is a principle, not a suggestion. Personal data must not be kept longer than needed for the purpose it was collected for. A vendor that keeps keyword histories indefinitely because storage is cheap is not compliant by default. It needs a stated period and a reason.
The ICO does not publish a single retention number for SEO tools. It expects controllers and processors to set their own periods, document them, and delete or anonymise when the period ends. That is why the contract, not the privacy page, is where a UK buyer gets room to negotiate.
There is also the lawful basis question. A tool that processes personal data on your behalf needs a data processing agreement under Article 28 of UK GDPR. That agreement is where retention, deletion and audit rights belong. If a vendor offers only a click-through privacy policy, the buyer carries more risk than the price suggests.
For a wider look at how the Act sits behind these duties, see our guide on means for SEO tool buyers.
What the Data Protection Act 2018 and Data (Use and Access) Act 2025 change
The Data Protection Act 2018 is the primary UK law governing personal data processed by SEO tools. It sits alongside UK GDPR and sets out how the regime is enforced, including the ICO's powers, exemptions and the rules for law enforcement processing.
UK data law that shapes retention
- 2018Data Protection Act 2018 sets enforcement and ICO powers
- 2025Data (Use and Access) Act 2025 amends retention and analytics rules
- NowRetention duties and subject access rights remain
Data Protection Act 2018 is the text to cite when a vendor claims UK GDPR does not apply to its search data.
The Data (Use and Access) Act 2025 is the current UK data reform affecting retention and analytics. It amends parts of the 2018 Act and UK GDPR, including provisions on automated decision-making, research purposes and the ICO's structure.
Data (Use and Access) Act 2025 is the source to check when a vendor says its retention model is now out of date.
For SEO buyers, the practical changes are narrower than the headlines. Retention duties remain. Subject access rights remain. What changes is how some purposes are assessed and how certain analytics uses are treated. A tool that stores query logs for product improvement still needs a defined period and a lawful basis.
The reform also affects how vendors describe international transfers and legitimate interests. If your contract was signed before the 2025 Act, the retention schedule and the transfer annexe may need a refresh. Ask for the current version, not the one in the sales deck.
Scotland, Wales and Northern Ireland operate under the same UK-wide regime for this purpose, so a single contract review covers all four nations. Local differences appear in public sector procurement and in some sector guidance, not in the core retention rules.
Retention periods, deletion duties and the storage and access technologies rules
Cookie banners and consent tools are part of the retention picture. If an SEO platform sets cookies or reads device storage on your site, the ICO's Guidance on the use of storage and access technologies | ICO sets out what counts as consent and what information must be given.
Four parts of a valid retention schedule
- Data type named
- Purpose stated
- Retention period set
- Deletion method defined
Retention claims in a contract should match what the tag actually does.
A useful retention schedule names four things: the data type, the purpose, the period and the deletion method. Without all four, the clause is decoration. The table below shows how that looks for common SEO tool data.
Retention periods, deletion duties
| Data type | Typical purpose | Suggested retention position | Deletion method |
|---|---|---|---|
| Account and login data | Access control | Life of contract plus a short wind-down | Account deletion with confirmation |
| Search query logs | Rank tracking and reporting | Rolling window tied to reporting need | Automated purge or anonymisation |
| Backlink and contact data | Link analysis | Period set by customer, not vendor default | On request or at contract end |
| Analytics connector data | Traffic and conversion reporting | Shortest period that supports the report | Disconnection plus purge |
| Support tickets | Service delivery | Fixed period after ticket closure | Scheduled deletion |
Deletion duties need a defined trigger. Good triggers include contract termination, a written erasure request, expiry of the retention period, or withdrawal of consent where consent is the basis. The clause should say who deletes, how quickly, and what proof is provided.
Backups are the common gap. A vendor may delete live data within days but keep backups for months. That is acceptable if the contract says so and the backup is not used for other purposes. Silence is not acceptable.
Subject access requests are the other test. If a data subject asks what an SEO tool holds about them, the controller needs the processor's help. The ICO's Subject access requests (also known as SARs or right of access) | ICO sets out the duties.
The contract should require the vendor to assist within a stated time. A vendor that cannot search its own logs will fail this test.
Contract clauses UK buyers should demand on data retention and erasure
Ask for these clauses by name. A vendor that recognises them is easier to work with than one that treats retention as a privacy page update.
Clauses to demand by name
- Retention schedule, reviewed annually
- Deletion on termination with written confirmation
- Deletion on request including sub-processors
- Sub-processor list with locations
- Data location and replication regions
- Subject access assistance window
- Audit and deletion evidence right
Contract clauses UK buyers
- Retention schedulea table of data types, purposes and periods, reviewed at least annually.
- Deletion on terminationa fixed window, with written confirmation when complete.
- Deletion on requesta route for erasure requests, including data held by sub-processors.
- Sub-processor listnamed entities, locations and change notification.
- Data locationprimary storage region and any replication regions.
- Subject access assistancea response window and a named contact.
- Audit and evidencethe right to request deletion logs or a summary report.
Two further clauses are worth pushing for. The first limits the vendor's own use of your data, so it cannot train models or build benchmarks from your query logs without a separate basis. The second sets a breach notification window that is short enough for you to meet your own 72-hour duty to the ICO.
Where the order form and the licence conflict, the licence usually wins in practice. Our note on why licence terms matter more than the order form explains the pattern to watch for.
Price is not a compliance signal. A cheap tool with a clear retention schedule is safer than an expensive one with an open-ended storage clause. Procurement teams should score retention terms alongside features and cost.
Vendor questions that expose where SEO tool data is held and for how long
Send these before the demo. Written answers create a record and shorten the legal review.
Vendor questions to send before the demo
- Where is data stored and replicated?
- Retention period for logs and tickets?
- What happens within 30 days of termination?
- Can you delete for one data subject?
- Which sub-processors touch our data?
- Do you train models on customer data?
- What deletion evidence can you provide?
- Where is our data stored, and in which countries is it replicated?
- What is the retention period for query logs, backlink records and support tickets?
- What happens to our data within 30 days of contract termination?
- Can you delete data on request for a single data subject, and within what time?
- Which sub-processors touch our data, and where are they based?
- Do you use customer data to train models or build benchmarks?
- What deletion evidence can you provide on request?
Add two follow-ups. Ask for the current data processing agreement, not a summary. Ask who signs it and whether changes need notice. If the vendor cannot answer the data location question in writing, treat that as a finding, not a delay.
Run these alongside your normal vendor checks before signing so compliance sits with commercial and security review rather than after it.
For vendors with a UK entity, verify the company record at Companies House. For VAT on digital services and software licences, HMRC guidance sets the treatment. Neither step replaces the retention questions, but both support the file.
A clause checklist for SEO software procurement in the United Kingdom
Use this as the sign-off list for any new SEO tool, renewal or tier upgrade. It takes about an hour with the data processing agreement in front of you.
Procurement sign-off checklist
- Signed, dated data processing agreement
- Retention schedule per data type
- Deletion on termination and request
- Current sub-processor list with locations
- Storage regions including backups
- Subject access assistance clause
- No model training without separate basis
- Breach notice supporting 72-hour duty
- Data processing agreement in place, signed and dated.
- Retention schedule attached, with periods per data type.
- Deletion on termination and on request, with timescales.
- Sub-processor list current, with locations.
- Storage regions stated, including backups.
- Subject access assistance clause with a response window.
- No model training or benchmarking on customer data without a separate basis.
- Breach notification window that supports your 72-hour duty.
- Audit or evidence right for deletion and access requests.
- Review date set for the next annual check.
A worked example shows how this lands. A UK agency buys a rank tracker with EU storage and a US backup region. The contract states a 24-month query log retention, deletion within 30 days of termination, and a sub-processor list.
The agency adds a subject access assistance clause and a no-training clause. Sign-off takes one review cycle instead of three.
The same checklist works for renewals. Vendors change sub-processors and storage regions quietly, so an annual check catches drift. Keep the signed agreement and the retention schedule in the same folder as the invoice.
Two internal habits make this stick. First, log every erasure request and the vendor's response time. Second, note the date of each contract change. Both give you evidence if the ICO or a data subject asks questions later.
For teams comparing options, a structured vendor data audit turns these answers into a score you can defend. It also makes supplier licence terms easier to compare across shortlisted tools, because retention and deletion sit on the same page as price and features.
