Why an SEO tools disclosure policy needs a single source register

What to take away

Scope of a disclosure policy

A disclosure policy states where tool data comes from, how vendor claims are presented, and what clients are told about the limits of both. Write it as a working document, not marketing copy.

This drafting guidance is for teams operating in England. Data protection law applies across the UK, so register requirements are the same in Scotland, Wales and Northern Ireland.

It is not a privacy notice and not a contract. Those documents do different jobs, and merging them usually weakens both. Where a clause needs legal force, put it in the contract and cross-reference it from the policy. Say plainly which tool categories the policy covers, including AI assistants and third-party data feeds.

Decide the boundary early. Client confidentiality, supplier contracts and published reports interact, so name the team that owns each part. A policy that names no owner is not auditable. If you are still mapping the wider rulebook, the guide to UK rules and compliance for 2027 shows how disclosure sits alongside contracts, tax and data duties.

Building the source register

The register is the evidence base. Keep one row per source, completed when the data is collected rather than in a rush before renewal. If sources are scattered across exports and policy drafts, a reviewer may be unable to trace a published figure to the dataset and licence actually used; one register gives the team a single auditable record.

A row should be checkable by someone who did not collect the data. Record the date you last verified each source, because licence tiers and feature names change mid-contract.

Worked example (illustrative): Vendor: Google; tool: Google Search Console; dataset: Performance report (Search results); access/licence tier: free service; date checked: record the day you verify it. Confirm that the account terms permit the use you record.

Record the plan name exactly as contracted. For example, if an Ahrefs subscription changes from Lite to Standard mid-contract, update the tier and effective date in the same row, and retain the contract or supplier notice as evidence.

Where the register holds personal data, the Data Protection Act 2018 and UK GDPR govern its processing, including lawful basis and recorded purposes. The Information Commissioner's Office (ICO) is the UK's data protection regulator. If SEO analytics uses cookies or similar technologies, the Privacy and Electronic Communications Regulations (PECR) may also apply. Treat this article as general guidance: an individual case needs a qualified adviser.

Writing the policy clauses

Seven clauses carry most of the weight: purpose, scope, roles, source register, review cycle, sign-off and escalation. Keep each one short, name an owner, and delete anything you cannot audit. Write the review trigger as an event rather than a date.

AI keyword tools sharpen the sourcing question. Semrush's prompt research feature builds keyword ideas from prompts, so the policy should state which outputs reach client reports and how the underlying data is credited.

Sign-off matters more than length. A two-page policy signed by a named director beats a twenty-page document nobody has read, and it is easier to update when a supplier changes its terms.

Publishing the policy

Publish a short public version: the data you use, how client data is handled, and a contact route for questions. Keep it on a stable URL so older emails do not point at a broken page. Use a version date in day-month-year format and name an owner at the foot of the page.

Publish it as a web page rather than a PDF, and test it against accessibility expectations. The W3C's WCAG 2 at a Glance summary sets out the principles those checks rest on.

Where the policy touches paid placement or affiliate content, name the applicable rule: the CAP Code, administered by the Advertising Standards Authority (ASA). Record the labels used and evidence supporting the claims, then check the current Code for the content in question.

Common questions

Who should sign off the policy?

A named director, with the person who keeps the source register reporting to them.

How often should it be reviewed?

At every renewal and whenever a vendor notifies you that a dataset, feature or licence tier has changed. Record the trigger and update the row; an annual check is a floor, not a target.

Do free tools need disclosing?

Yes, if their output reaches a client report. Free access does not remove the need to name the source or explain the limits.

What belongs in the public version?

The data you collect, how client data is handled, where results can mislead, and how to raise a question.