SEO tools data protection: what the DPA 2018 means

What to take away

SEO tools data protection starts with the Data Protection Act 2018, which received Royal Assent on 23 May 2018 and still governs how SEO tools handle personal data.
The Information Commissioner's Office (ICO) is the UK supervisory authority; check its register and guidance before you rely on a vendor's terms.
Most rank tracking output is aggregate, so the risk sits in the identifiers you attach to it.
Ask vendors what personal data they collect, where they process it, and whether they are controller or processor under the UK GDPR.
Record each data source and retrieval date so any client metric can be traced.
Work through the checklist before you renew a licence or add seats.

Where SEO tool data comes from

Rank tracking platforms blend two streams. One is public search output, collected by the vendor at scale and sold as a position or visibility score. The other is your own input: project names, client domains, keywords, user accounts and notes.

Two streams of SEO tool data

Public search output: vendor collects at scale
Sold as position or visibility score
Your own input: project names, domains
Keywords, user accounts and notes
Personal data appears in the second stream
Client emails, user IDs, server log IPs

The second stream is where personal data usually appears. A client email address is personal data. So is a user ID that ties a seat licence to a named consultant, and so are server logs holding IP addresses.

Vendors document part of this. The Semrush tools for freelancers and consultants page sets out which visibility features are packaged for solo operators, which helps you judge whether a vendor separates account data from aggregated search data.

Contracts, retention and regulator expectations sit in the wider picture, covered in SEO tools: UK rules and compliance guide for 2027.

What SEO tools data protection rules require in practice

The Data Protection Act 2018 sits alongside the UK GDPR and sets how personal data must be handled. The Information Commissioner's Office (ICO) is the UK supervisory authority; it maintains the register of fee payers and enforces the UK GDPR and the DPA 2018. If your stack holds client names, emails or IP addresses, the Act applies to that processing in England, Scotland, Wales and Northern Ireland. The main general-processing provisions sit in Part 2 of the DPA 2018, with the UK GDPR articles supplying the detailed duties.

Controller or processor?

Do you choose keywords and decide what is uploaded?

Yes

You are controller, tool is processor

Vendor may be controller for that part

Lawful basis and transparency

You need a lawful basis under Article 6 UK GDPR before client contact details go into a third-party tool. Consent is one route. Legitimate interests is another, and it needs a documented balancing test rather than a line in a policy. Your privacy notice should meet the transparency duties in Articles 13 and 14 UK GDPR and name categories of tool, not use "analytics providers" as a catch-all.

Controller or processor

If you choose the keywords and decide what is uploaded, you are normally the controller and the tool is your processor. Article 28 UK GDPR requires a written contract with the processor, covering subject matter, duration, security, sub-processors, breach assistance, deletion and audit. You also have duties around access requests and deletion. Where a vendor also uses your data for its own product work, it may be a controller for that part, so read the terms.

If you publish benchmark claims drawn from that data, advertising rules apply too; SEO tools advertising rules: data and sources explains what has to be evidenced.

International transfers, DPIAs and records

If data leaves the UK, you need a transfer mechanism under Chapter V UK GDPR. The options include the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU standard contractual clauses, and the EU standard contractual clauses (SCCs) where the Addendum applies. Check which one the vendor relies on and whether a transfer risk assessment is needed.

A data protection impact assessment (DPIA) is required under Article 35 UK GDPR for high-risk processing; a new tool that profiles clients or combines datasets can trigger one. Article 30 UK GDPR also requires records of processing activities, including the tool's role, categories of data and transfers. Article 33 UK GDPR requires breach notification to the ICO without undue delay, and Article 34 requires communication to affected people where the risk is high. Keep those records with the vendor's DPA.

Checklist for reviewing SEO tool data sources

List every field of personal data the tool requests from your team.
Confirm where processing happens and whether data leaves the UK; if it does, name the transfer mechanism (IDTA, Addendum or SCCs) and check the transfer risk assessment.
Obtain a data processing agreement that meets Article 28 UK GDPR and note the retention period.
Check the DPA clauses on sub-processors, security, breach notification, deletion or return of data, audit rights and DPIA assistance.
Record the source and retrieval date for every metric you report.
Keep Article 30 UK GDPR records of processing activities for each tool.
Ask how erasure works when a client withdraws consent.
Identify the sub-processors involved in collecting search data.
Ask the same questions of every vendor you use, such as Semrush, Ahrefs or Moz.
Revisit the terms when you add seats or connect an integration.
Take advice from a qualified adviser on client-specific questions; this guide is general.

Common questions

Does rank tracking data count as personal data?

Usually not. Position and visibility scores are aggregate outputs. It becomes personal data once a record can be linked to a named person, for example through an account email or a client reference.

Do I need consent to put client details into an SEO tool?

Not always. Consent is one lawful basis among several. Agencies often rely on contract or legitimate interests, but the basis must be recorded and reflected in the privacy notice.

Who answers to the client if a vendor mishandles the data?

Your business is normally the controller for client data it uploads, so it stays accountable to the client. The vendor contract and its security terms set out what you can recover from the vendor.