Home › Blog › Data ethics

Ethical Data Collection: Seven Practices, a Launch Checklist and the UK Rules in 2026

Ethical data collection means gathering only the personal data you need, for a purpose people would recognise and accept, and being straight with them about it. UK GDPR sets the legal floor, and the Data (Use and Access) Act 2025 moved that floor in February 2026, loosening some rules and toughening fines. This page sets out the current legal baseline, seven practices that go beyond it and a checklist to run before any new form, app or tracking goes live.

Legal is the floor, ethical is the standard

Most organisations treat data collection as a compliance question: do we have a lawful basis, is the privacy notice up to date, is the cookie banner working? Those questions matter, but they set the minimum. Ethical data collection asks something harder: whether the people you collect from would agree with what you are doing if they understood it fully, and whether you would be comfortable explaining it to them face to face.

The gap between the two is where trust is lost. Plenty of practices are arguably lawful and still feel like a betrayal when they come to light: an app collecting precise location to "improve services", a loyalty scheme selling purchase histories to data brokers, a free tool whose real product is its users' contact lists. Our guide to data privacy versus data ethics covers that distinction in more depth; this page is about putting it into practice at the point of collection.

The UK legal baseline in 2026

Ethical collection starts from the law, so it is worth being clear about what it requires.

UK GDPR principles

Article 5 of UK GDPR sets seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Three of them do most of the ethical work. Purpose limitation means you collect for specified purposes and do not quietly reuse data for incompatible ones. Data minimisation means only what is adequate, relevant and necessary. Fairness means not processing data in ways people would not reasonably expect or that have unjustified adverse effects on them.

Lawful bases

Every processing activity needs one of the six lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. The ICO's lawful basis guidance stresses that you choose the basis before you start, record it, and tell people. Consent is not the default and is often the wrong choice: it must be freely given, specific, informed and as easy to withdraw as to give.

What the Data (Use and Access) Act changed

Most of the data protection provisions of the Data (Use and Access) Act 2025 came into force on 5 February 2026, the ICO confirmed. The changes most relevant to collection are:

• Recognised legitimate interests: a new lawful basis for a set list of purposes, such as preventing crime and safeguarding vulnerable people, without a separate legitimate interests balancing test.
• Cookies: some low-risk cookies, such as those used for analytics to improve a website or to remember how a site looks, no longer need consent, though users must still be told and given a way to object.
• Automated decisions: fewer restrictions on automated decision-making, provided safeguards are in place, including the right to human review and to contest the decision.
• Complaints: since 19 June 2026, organisations must have a procedure for handling data protection complaints.
• Enforcement: the ICO can now fine up to £17.5 million or 4% of global turnover under PECR, the rules on cookies and electronic marketing, matching UK GDPR.

Looser rules are not a licence. The fact that analytics cookies can now run without consent does not make every analytics set-up ethical; it moves the judgement from the law to you.

Seven practices for ethical data collection

1. Start with the purpose, then decide the data

Write down what you are trying to achieve before you design the form, the app permission or the tracking plan. Then list the minimum data that achieves it. Teams that start from "what can we capture?" end up with fields nobody uses and risks nobody needs.

2. Apply a no-surprises test

For each item of data, ask whether a typical person would be surprised to learn you hold it, or how you use it. If the answer is yes, either stop, or explain it plainly at the point of collection, not in paragraph 14 of a privacy notice.

3. Make the notice short and specific

Use a layered approach: one or two sentences beside the form field saying what you collect and why, with a link to the full notice. "We use your postcode to show delivery times" beats "We may use your information to improve our services".

4. Make consent real or do not rely on it

If you use consent, do not pre-tick boxes, bundle it into terms and conditions, or make the service conditional on agreeing to unrelated uses. Avoid dark patterns: a bright "Accept all" next to a grey, buried "Manage settings" is designed to get a yes, not an informed choice.

5. Treat sensitive and inferred data with extra care

Health, ethnicity, religion, sexual orientation and similar data are special category data with stricter rules. Inferences can be just as sensitive: a purchase pattern that suggests a pregnancy, or browsing that suggests debt problems. If you would need special care collecting it directly, apply the same care when you infer it.

6. Set retention when you collect, not later

Decide how long each data set is kept and how it is deleted at the design stage. Data kept "just in case" is the data that turns up in breaches.

7. Check your suppliers

Third-party scripts, form tools, CRMs and ad platforms often collect more than you realise. Audit what each one captures, whether it shares data onward, and whether you could explain it to your customers. You remain responsible for what is collected on your site.

A checklist before you launch any new collection

1. Is the purpose written down and specific?
2. Is every field necessary for that purpose?
3. Have you chosen and recorded a lawful basis?
4. Is there a plain-English explanation at the point of collection?
5. If consent is used, is it unbundled, unticked and easy to withdraw?
6. Have you checked for special category or sensitive inferred data?
7. Is a retention period set, with a deletion method?
8. Do you know what every third-party tool on the page collects?
9. Is there a route for people to complain, as the law now requires?
10. Would you be comfortable if this practice was reported in the press?

For larger projects, especially anything involving new technology, profiling or sensitive data, a data protection impact assessment is required when the processing is likely to result in a high risk to individuals, and it is good practice in borderline cases. For the wider framework, see our guide to data ethics for business.

More practical guides on the E-Business Ethics homepage.