Lawful Basis for Processing
Competition websites collect personal data including names, email addresses, postal addresses, and payment information. Under UK GDPR, you must have a lawful basis for processing this data. For competition entry, the lawful basis is typically contractual necessity (processing the entry) and legitimate interest (administering the draw). Marketing communications require separate, explicit consent.
Consent and Double Opt-In
Marketing consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not constitute valid consent. Best practice for competition website email marketing is double opt-in, where the entrant confirms their subscription via a confirmation email after initially opting in. Separate consent checkboxes must be used for competition entry and marketing communications.
Data Retention and Subject Rights
You must have a clear data retention policy specifying how long entrant data is held and when it is deleted. Under UK GDPR, individuals have the right to access their data, request correction, request deletion, and object to processing. Your competition website must have mechanisms to handle these requests, either through automated account management or a documented manual process.
ICO Registration
If you are processing personal data as a business in the UK, you are required to register with the Information Commissioner’s Office (ICO) and pay the annual data protection fee. This is a legal requirement, not optional. The fee depends on your organisation’s size and turnover.