Reputation management data protection: a disputed-review workflow

A company receives an online complaint on its Google Business Profile or Trustpilot listing, naming both the reviewer and an engineer. Under reputation management data protection, the job is to control how that information moves, not to decide who is right.

This workflow covers a fictional organisation in England. The relevant law is the UK GDPR and the Data Protection Act 2018, with PECR covering cookies and electronic marketing. A named UK privacy and PECR specialist must decide the real purposes, roles, lawful basis and any response to rights requests.

What to take away

1. Freeze the source, then separate assertions

Store the original URL, wording, time and platform status. Keep the reviewer's allegation, the booking-system entry, the worker's account and the investigator's conclusion in different fields. Mark each field as source text, observed record, disputed statement, inference or unknown.

Reporting is a second track, not the privacy route. Google Business Profile takes review reports and removal requests, Trustpilot flags a review for its content-integrity team, and Facebook and TripAdvisor run their own report tools. Each leaves a decision trail, so log the platform case reference next to the privacy record — and remember that review-management software such as Yext, Birdeye or Podium usually holds its own synced copy of the review text and the reply.

The ICO's accuracy guidance explains that personal information should not be incorrect or misleading as a matter of fact and that organisations should consider challenges carefully. It does not require the organisation to label every opinion true or false.

2. Write the processing record before enrichment

For every field, add the person concerned, origin, collection date, proposed purpose, recipient, access group, retention rule and deletion destination. Record whether monitoring software will infer sentiment, severity, identity matches or worker performance, and name the tool doing it — platform analytics, a review-management suite or a case system. Public visibility does not answer whether copying, matching or republishing is justified.

The ICO's DUAA page for organisations states that all data-protection provisions in the Data (Use and Access) Act 2025 are in force. That is a commencement statement about amendments to the UK framework, not permission for this workflow.

3. Route challenges without destroying provenance

A correction request can arrive in ordinary language. The ICO's current right to rectification material says a valid request need not mention Article 16. Give the request an ID, link it to every controlled copy and identify recipients who may hold the disputed information.

If continued use should be limited while a challenge is examined, escalate the decision. The ICO's right to restrict processing page says restriction under Article 18 is not absolute and currently displays a DUAA under-review notice. Its status must be checked again when counsel assesses the facts. Objection under Article 21, erasure under Article 17 and suppression also need their own decisions; none is an automatic substitute for another.

4. Isolate worker analysis

Do not feed a customer's allegation straight into appraisal or discipline. Record why staff information is examined, who can see it, how adverse inferences are challenged, and whether a less intrusive route exists.

The ICO's worker-monitoring guidance notes analytics may make incorrect inferences and workers should be able to explain or challenge findings. It also carries a DUAA review warning.

5. Inspect page technology and contact channels

List cookies, pixels, scripts, plug-ins and device identifiers on the complaint and review pages, including the dashboard you use to read and answer reviews. The ICO's record on storage and access technologies covers PECR and, when personal information is processed, UK GDPR. The team must examine purpose and operation rather than rely on "first-party" or "server-side" labels.

Keep a requested case update apart from a promotional email or direct message. Propagate objection and suppression states to every approved sending route.

6. Close with deletion evidence

Before the case ends, test correction, restricted use, access withdrawal, export and deletion in the case system, mailbox, agency workspace and public response. Save the test result and every unresolved exception with dated screenshots, the export or deletion log, the platform confirmation and the supplier's written deletion confirmation. Where a copy is retained rather than deleted, record a hash or checksum of the file. Privacy, PECR, employment, security, accessibility and publication remain separate release conditions. No average score can turn a failed rights route into an acceptable data journey.

Before you act

Common questions

What should be recorded for every field before enrichment?

Add the person concerned, origin, collection date, proposed purpose, recipient, access group, retention rule and deletion destination. Also record whether monitoring software will infer sentiment, severity, identity matches or worker performance, since public visibility alone does not justify copying, matching or republishing.

How should a correction request be handled?

A valid request need not mention Article 16, so accept ordinary language. Give it an ID, link it to every controlled copy and identify recipients who may hold the disputed information. If continued use should be limited while the challenge is examined, escalate that decision rather than assuming restriction is automatic.

What must happen before the case closes?

Test correction, restricted use, access withdrawal, export and deletion in the case system, mailbox, agency workspace, review-management suite and public response. Save the test result and any unresolved exception, with dated screenshots, the export or deletion log, the platform confirmation and a hash of any retained copy. Privacy, PECR, employment, security, accessibility and publication remain separate release conditions, and no average score excuses a failed rights route.