What subscription commerce data protection means for recurring billing operators

What to take away

The Data (Use and Access) Act 2025 amends the UK GDPR and PECR, so consent records and soft opt-in wording need reviewing now.
Health, biometric or precise location data from app-based plans is special category data, and it changes the lawful basis you can rely on.
The ICO's AI guidance applies to churn scoring, because a decision about an individual needs a lawful basis and safeguards.
A named owner, a data map and a records-of-processing entry are the artefacts an auditor or the ICO asks for first.

Does the Data (Use and Access) Act 2025 change subscription consent?

Yes, in ways that touch recurring billing. The Act amends the UK GDPR and PECR, including rules on automated decision-making and the soft opt-in for electronic marketing. Consent records must now show what a subscriber agreed to, when, and through which interface. A checkbox buried in a checkout is weaker evidence than a dated record of the wording shown.

The subscription commerce UK rules and compliance guide covers the surrounding duties on renewals, cooling-off periods and disclosures.

Which lawful basis fits a subscription business?

Most recurring billing rests on contract, not consent. You need a customer's name, address and payment details to deliver the service, so Article 6(1)(b) UK GDPR covers that processing. Consent suits optional extras: marketing emails, app notifications, sharing data with a partner brand.

Lawful basis by purpose

Purpose

Name, address, payment: Contract
Marketing emails: Consent
Fraud screening: Legitimate interests
Health or biometrics: Explicit consent

Lawful basis

Name, address, payment: Retention schedule
Marketing emails: Opt-out
Fraud screening: Balancing test
Health or biometrics: Article 9 condition

Extra duty

Name, address, payment
Marketing emails
Fraud screening
Health or biometrics

Legitimate interests can cover fraud screening and basic analytics, with a documented balancing test. Where a plan includes health tracking or biometrics, Article 9 applies and a separate condition, such as explicit consent, is needed. Record the basis per purpose, not per customer.

How does ICO guidance on AI affect personalisation?

The ICO's guidance on artificial intelligence and data protection sets out expectations for profiling and automated decision-making. If a churn model flags an individual for a retention offer, that is a decision about a person. You need transparency, a lawful basis, and a route to human review where the effect is significant.

Aggregate cohort analysis carries less risk. Segment reporting on renewal rates does not identify anyone, so it usually falls outside the automated decision rules. Keep the two activities separate in your documentation.

What do advertising rules have to do with subscriber data?

More than operators expect. Claims in acquisition ads and on landing pages are enforced separately from data protection, and the ASA rulings database shows the pattern: free trial terms, price claims and cancellation wording attract complaints.

If an ad promises a price that applies only to a data-sharing tier, the problem is both marketing and transparency. Consent passed by partners is also a contractual question, and the subscription commerce commercial contracts article explains the clauses that allocate that risk.

Comparison: common data types and their treatment

Common data types and their treatment

Typical lawful basis

Name, address, payment details: Contract
Marketing email consent: Consent
Existing customer marketing: Soft opt-in
Churn or propensity scoring: Legitimate interests or consent
Health or biometric plan data: Explicit consent

Extra duty

Name, address, payment details: Retention schedule, PCI scope
Marketing email consent: Opt-out in every message
Existing customer marketing: Similar goods, opt-out at collection
Churn or propensity scoring: Transparency, human review
Health or biometric plan data: Article 9 condition, DPIA

What should a subscription operator do next?

Start with a data map. List every system that touches subscriber records, from checkout to dunning emails, and note the basis and retention period for each. Then check consent capture: can you produce the exact wording a subscriber saw eighteen months ago? If not, close that gap first.

Subscription data protection checklist

Map every system touching subscriber records
Note basis and retention per system
Prove consent wording from 18 months ago
Review privacy notice against product reality
Name one accountable data owner

Review your privacy notice against what the product actually does. Personalisation, app tracking and third-party sharing are commonly missing. The GOV.UK business regulation guidance and tools page links to templates that help smaller teams build the paperwork.

Name an owner. A subject access request arrives with a two-week clock, and one accountable person makes the difference. This article is general guidance only; individual cases need a qualified adviser.

Common questions

Do we need consent to email existing subscribers about upgrades?

Usually not, if the soft opt-in applies. The message must concern similar goods or services, you must have collected the address in a sale, and an opt-out must have been offered at collection and in every message since.

Is a churn prediction model an automated decision?

Only if it produces a decision with legal or similarly significant effects on an individual. A score that routes someone to a retention offer is low risk; one that cancels a plan automatically is not.

How long can we keep lapsed subscriber records?

There is no single statutory period. Set a retention schedule tied to purpose: tax and accounting records follow separate rules, while marketing suppression lists are often kept longer to honour opt-outs.

Who enforces this in England?

The Information Commissioner's Office enforces the UK GDPR and PECR in England and the rest of the UK. The Advertising Standards Authority separately polices ad claims, and both publish outcomes.