• At Kemp Little, we are known for our ability to serve the very particular needs of a large but diverse technology client base. Our hands-on industry know-how makes us a good fit with many of the world's biggest technology and digital media businesses, yet means we are equally relevant to companies with a technology bias, in sectors such as professional services, financial services, retail, travel and healthcare.
  • Kemp Little specialises in the technology and digital media sectors and provides a range of legal services that are crucial to fast-moving, innovative businesses.Our blend of sector awareness, technical excellence and responsiveness, means we are regularly ranked as a leading firm by directories such as Legal 500, Chambers and PLC Which Lawyer. Our practice areas cover a wide range of legal issues and advice.
  • Our Commercial Technology team has established itself as one of the strongest in the UK. We are ranked in Legal 500, Chambers & Partners and PLC Which Lawyer, with four of our partners recommended.
  • Our team provides practical and commercial advice founded on years of experience and technical know-how to technology and digital media companies that need to be alert to the rules and regulations of competition law.
  • Our Corporate Practice has a reputation for delivering sound legal advice, backed up with extensive industry experience and credentials, to get the best results from technology and digital media transactions.
  • In the fast-changing world of employment law our clients need practical, commercial and cost-effective advice. They get this from our team of employment law professionals.
  • Our team of leading IP advisors deliver cost-effective, strategic and commercial advice to ensure that your IP assets are protected and leveraged to add real value to your business.
  • Our litigation practice advises on all aspects of dispute resolution, with a particular focus on ownership, exploitation and infringement of intellectual property rights and commercial disputes in the technology sector.
  • We have an industry-leading reputation for our outsourcing expertise. Our professionals deliver credible legal advice to providers and acquirers of IT and business process outsourcing (BPO) services.
  • We work alongside companies, many with disruptive technologies, that seek funding, as well as with the venture capital firms, institutional investors and corporate ventures that want to invest in exciting business opportunities.
  • Our regulatory specialists work alongside Kemp Little’s corporate and commercial professionals to help meet their compliance obligations.
  • With a service that is commercial and responsive to our clients’ needs, you will find our tax advice easy to understand, cost-effective and geared towards maximising your tax benefits.
  • At Kemp Little, we advise clients in diverse sectors where technology is fundamental to the ongoing success of their businesses.They include companies that provide technology as a service and businesses where the use of technology is key to their business model, enabling them to bring their product or service to market.
  • We bring our commercial understanding of digital business models, our legal expertise and our reputation for delivering high quality, cost-effective services to this dynamic sector.
  • Acting for market leaders and market changers within the media industry, we combine in-depth knowledge of the structural technology that underpins content delivery and the impact of digitisation on the rights of producers and consumers.
  • We understand the risks facing this sector and work with our clients to conquer those challenges. Testimony to our success is the continued growth in our team of professionals and the clients we serve.
  • We advise at the forefront of the technological intersection between life sciences and healthcare. We advise leading technology and data analytics providers, healthcare institutions as well as manufacturers of medical devices, pharmaceuticals and biotechnological products.
  • For clients operating in the online sector, our teams are structured to meet their commercial, financing, M&A, competition and regulatory, employment and intellectual property legal needs.
  • Our focus on technology makes us especially well positioned to give advice on the legal aspects of digital marketing. We advise on high-profile, multi-channel, cross-border cases and on highly complex campaigns.
  • The mobile and telecoms sector is fast changing and hugely dependent on technology advances. We help mobile and wireless and fixed telecoms clients to tackle the legal challenges that this evolving sector presents.
  • Whether ERP, Linux or Windows; software or infrastructure as a service in the cloud, in a virtualised environment, or as a mobile or service-oriented architecture, we have the experience to resolve legal issues across the spectrum of commercial computer platforms.
  • Our clients trust us to apply our solutions and know-how to help them make the best use of technology in structuring deals, mitigating key risks to their businesses and in achieving their commercial objectives.
  • We have extensive experience of advising customers and suppliers in the retail sector on technology development, licensing and supply projects, and in advising on all aspects of procurement and online operations.
  • Our legal professionals work alongside social media providers and users in relation to the commercial, privacy, data, advertising, intellectual property, employment and corporate issues that arise in this dynamic sector.
  • Our years of working alongside diverse software clients have given us an in-depth understanding of the dynamics of the software marketplace, market practice and alternative negotiating strategies.
  • Working with direct providers of travel services, including aggregators, facilitators and suppliers of transport and technology, our team has developed a unique specialist knowledge of the sector
  • Your life as an entrepreneur is full of daily challenges as you seek to grow your business. One of the key strengths of our firm is that we understand these challenges.
  • Kemp Little is trusted by some of the world’s leading luxury brands and some of the most innovative e-commerce retailers changing the face of the industry.
  • HR Bytes is an exclusive, comprehensive, online service that will provide you with a wide range of practical, insightful and current employment law information. HR Bytes members get priority booking for events, key insight and a range of employment materials for free.
  • FlightDeck is our portal designed especially with start-up and emerging technology businesses in mind to help you get your business up and running in the right way. We provide a free pack of all the things no-one tells you and things they don’t give away to get you started.

GDPR and influencer marketing

To help us all better understand the incoming changes to data protection law, we spoke to One Roof Social about the new General Data Protection Regulation (known as the “GDPR”) and the impact this will have on influencer marketing and the wider digital industry.

The GDPR will take effect from 25 May 2018 and will be supplemented by the Data Protection Bill, which updates data protection laws in the UK. The change in data protection law caused panic for many as the impact on businesses was initially unclear. However, if your business was already processing personal data in compliance with the Data Protection Act 1998 the change in law does not need to cause you unnecessary alarm. The GDPR strengthens the principles we already had under the current law and which you should already be complying with, but for some there will be a significant effort required, and fast, to tidy up any current, less impressive practices and to become GDPR compliant.

In this article we wanted to take a look at the ways in which the GDPR will touch influencer marketing, aiming to give you a digestible overview of the regulation whilst making sure we provide industry specific commentary. The influencer marketplace is built on consumers and influencers willingly sharing data to justify value and forge relationships. Whilst this has the potential to include a lot of personal data, being transparent about this is important to stand out in the market and for GDPR compliance. With the GDPR coming in, we expect businesses may be more encouraged to move away from traditional marketing campaigns and look towards an outreach which doesn’t rely on harvesting potential customers’ data. We believe that influencer marketing rides on cultivated audiences who have willingly signed-up to be engaged with, rather than have been unknowingly absorbed into, content and so this transparent way of working shouldn’t be anything to shy away from.

What is the GDPR?

The GDPR is a law brought in to greater protect the privacy of an individual in the European Union, with the aim to hand greater control over to individuals about how their personal data is used.  The GDPR will replace the Data Protection Act 1998 and those not compliant with the GDPR face much heftier fines than they would have done under the previous law, potentially up to EUR20m or 4% of global turnover, whichever is higher, which is part of the reason this change in law has caused so much panic. The potential for large financial penalties means that data protection has quickly become a management board issue.

What about Brexit? When the UK leaves the EU the GDPR will be incorporated into UK law under the European Union (Withdrawal) Bill, currently before Parliament. You should keep in mind that any business established within the EU or offering goods or services to EU-based individuals or monitoring EU residents’ behavior will also have to abide by the GDPR.

Who does it apply to?

The GDPR applies to anyone who touches personal data. The GDPR applies to personal data. What constitutes personal data is really broad, it includes any information relating to an identified or identifiable individual. It includes the obvious things such as someone’s name but applicable for social media, in particular, it also includes location data and online identifiers.

There are two categories of people who handle personal data under the GDPR: controllers and processors.

  • Controller – “means the natural or legal person… which, alone or jointly with others, determines the purposes and means of the processing of personal data”. In simpler terms, this is the person who says why and how the data is used and could be a blogger, agency or brand.
  • Processor – “means a natural or legal person… which processes personal data on behalf of the controller”. This is the person who does something with data under the instruction of the Controller, such as a hosting company.

If you are either of the two, controllers probably being most relevant to you, you will need to comply with the GDPR. Each data controller will have responsibility for the personal data they collect and they will need to make sure they collect this information in a fair and transparent manner. The GDPR includes a requirement to provide certain information to individuals at the time when personal data is collected.  You will therefore likely see updates to privacy policies and consent notices to take account of this.

What do I need to consider?

There are various themes under the GDPR for you to consider. We’ve picked five to discuss very briefly here but this isn’t an exhaustive list and some of these are not new:

  • Principles relating to processing: Personal data must be processed lawfully, fairly and in a transparent manner. It is important that it is collected for a specified, explicit and legitimate purpose and that the data is adequate, relevant and limited to what is necessary. The data must also be processed in a manner that ensures appropriate security of the personal data. If you’re collecting and processing personal data then you need to keep these principles in mind at all times.
  • Lawful basis for processing: Personal data must only be processed if the processing satisfies one of the five lawful grounds or basis. We expect the following lawful basis will be most relevant for influencer marketing and you will need to consider and document your lawful basis for any data you process: the data subject (the individual the data relates to) has given consent to the processing; the processing is necessary for the performance of a contract with the data subject; or the processing is necessary for the legitimate interests pursued by the controller or by a third party and this does not override the interests or fundamental rights and freedoms of the data subject.
  • Data subject rights: Under the GDPR, data subjects have enhanced rights, such as: the “right to be forgotten”, the right of access, the right to restrict processing and the right to data portability. If you process personal data you will need to make sure you have the right procedures in place internally to deal with requests made by individuals in relation to these rights.
  • International transfers: The GDPR restricts the transfer of personal data outside of the EU without proper safeguards in place. This may be relevant where you are working with an international brand or influencer.
  • Contract requirements: When a processor carries out data processing on behalf of a controller there are specific requirements that must be included in the contract for it to be compliant with the GDPR.


Where influencers use tools, such as Google Analytics, to collect insights on your blog or website you will have needed to notify and collect the necessary cookie consents from your users.

You may have recently received an update from Google letting you know about their new “Data Retention Tool” which has been introduced to ensure compliance with retention policies (you shouldn’t be holding on to data for longer than is necessary and you should have a written policy on how long you will retain data for). We recommend you log in to your Google Analytics Account to check what data retention period has been set and update this, if appropriate.

When brands are deciding which influencer to work with on a campaign, they are likely to look at a variety of statistics, for example: their relevance, authentically grown audiences for individual campaigns, their channel growth and their own USP. All of these help the brand to determine whether an influencer would be suitable for the campaign. Where any of these statistics contain personal data, the influencer will need to have a proper basis for having collected and then sharing this information with a brand.

Email marketing

You will likely have seen lots of businesses going through re-consenting processes for marketing lists. You don’t need to do this and can rely on the consents you’ve already obtained provided that those consents were given in line with the GDPR. This means that when you collected the email addresses for your subscription list, for example, the individual must have opted in and the consent they gave must have been unambiguous and demonstrable (i.e. auditable).

The e-Privacy Regulation is coming into force to change the law around this process but, based on the current draft, broadly keeps the same rules in relation to e-marketing. However, note that in the current draft e-marketing now expands the definition of direct marketing to include communications sent or presented to an individual and not just sent, this would therefore include a targeted ad in a social media website.

In the influencer marketing industry, followers actively sign-up to blogs because they want the updates in the first place and so we don’t think any new consents you might need to collect would cause a huge decline in subscription numbers. Being open and transparent in relation to your use of data will become the norm and you may be able to find a way to do this in a user friendly way which can become your USP.

In advance of the GDPR coming into effect in 6 weeks, we’d advise taking stock of what data you collect and how you use this. Use this as an opportunity to spring clean your data protection practices and make sure you are clued up on the GDPR requirements.

Contact our experts for further advice

View profile for Gemma LockyerGemma Lockyer