Reputation management UK rules: ethics and software checks

An unfavourable online review arrives at a fictional boiler-repair marketplace. It says an appointment was missed, gives the engineer's first name and alleges that the company falsified its records. The England operations lead wants the review removed. Marketing wants to quote favourable comments alongside its reply. Customer care wants to email the reviewer with an offer.

Those requests share one case file, but they are not one legal task. Removal, evidence checking, advertising, direct contact, use of worker information and the choice of monitoring software each carry a separate authority and a named specialist owner. No single approval covers them all.

Here, reputation management rules and ethics means applying fairness, accuracy, transparency, proportionality and privacy to each decision. Keep evidence visible, separate fact from opinion, give affected people a route to challenge errors and record why the business acted. The conduct side is not invented; named professional standards appear below.

This guide concerns an England dispute and the UK consumer, advertising, data-protection and electronic-marketing rules that apply. Defamation law applies in England and Wales. Treat platform policies, regulator guidance and software marketing claims as distinct from legislation, and assign every decision to a suitably qualified owner.

What to take away

Case desk: preserve the disputed item

Start by saving the review exactly as encountered. Keep its URL, timestamp, account status, platform label, full wording and any visible incentive marker. Record who retrieved it and when. Create separate fields for the customer's allegation, the booking record, the engineer's account and the company's preliminary view. Do not rewrite uncertainty into a single "verified facts" narrative.

The service team may acknowledge receipt through an approved complaints route while investigation continues. It should not bargain for deletion, promise a public correction or treat criticism as abuse merely because it is damaging. A case manager can stop republication without erasing the source record. That preserves evidence for the reviewers who come next.

One point of consumer law now touches the settlement letter itself. The CMA has expanded its fake reviews guidance to cover making an offer of dispute resolution contingent on a consumer not leaving a negative review. Draft any offer of that kind with the consumer-law owner before it leaves the building.

Desk one: consumer-review integrity

The consumer-law question is not simply whether a review is false. It also matters who submitted, commissioned, procured or published it; whether an incentive was concealed; and how the publisher presented review information to readers who had no other way to judge it.

Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 is primary UK legislation. The CMA's unfair commercial practices guidance records that the relevant provisions apply to commercial practices from 6 April 2025. Schedule 20 covers fake reviews, concealed incentivised reviews and misleading publication among the practices prohibited in all circumstances.

The CMA issued fake reviews guidance in April 2025. That document is official guidance on the statutory provisions, not legislation and not a ruling on this fictional marketplace. Its review-supply-chain approach makes a useful evidence list: invitation, incentive, moderation rule, authenticity check, removal decision and treatment of derived ratings.

If the marketplace publishes reviews itself, the CMA's separate guidance for online review sites is also relevant. It tells publishers to explain collection and checking, distinguish a review from a complaint, avoid suppressing genuine negative material and reveal commercial relationships. Counsel must still confirm that the business and the feature fall within scope.

Outcome at this desk: a dated review-integrity record. It does not authorise an advert, a marketing message, the use of personal information, or the purchase of a review tool that automates any of those steps.

Desk two: advertising and endorsements

Marketing proposes a panel headed "What customers really think" using two positive quotations and omitting the disputed review. The final panel, page and link destination must be assessed together. Source accuracy alone does not answer what the audience is likely to understand.

Section 3 of the CAP Code addresses misleading overall impressions, substantiation, consumer reviews, incentives and testimonials in non-broadcast marketing communications. The Committee of Advertising Practice writes the Code; the Advertising Standards Authority administers it and investigates complaints. The Code is self-regulation, not an Act of Parliament or a legal clearance service.

The advertising reviewer needs the original quotations, permissions, incentive history, product identity, date and every objective implication. They must see the final crop, caption and placement. If the evidence supports only "this customer gave this opinion", marketing cannot silently turn it into a typical-results claim. Keep the evidence and apply the Code's testimonial and substantiation rules.

Outcome at this desk: release, rejection or an unresolved advertising issue. A disclosure label cannot compensate for inadequate proof, and a badge confirming the customer is real does not substantiate the typical-results claim built on their words.

The ethics standard you name

Ethics needs a citation. Two named standards govern UK public-relations and reputation practice: the CIPR Code of Conduct, published by the Chartered Institute of Public Relations, and the PRCA Professional Charter and Code of Conduct, published by the Public Relations and Communications Association. Ask which one binds your adviser, agency or in-house team.

Both are professional-body codes rather than legislation. They address honesty, accuracy, conflicts of interest and confidential information. Quote the clause you rely on in the case file, with the version and date checked, so a later reviewer can see how the standard was applied rather than being told the decision was ethical.

The operating framework here has five parts: fairness, accuracy, transparency, proportionality and privacy. Each maps to a record. Fairness asks whether the person had a chance to correct an error. Accuracy asks which field holds fact and which holds allegation. Transparency asks who is speaking, and on what basis.

Proportionality asks whether a legal notice is really needed when a correction would do. Privacy asks which lawful basis covers each purpose and who can see the file. The framework is a checklist for decisions, not a legal test, and it should never be presented as one that determines the outcome.

Desk three: the personal-information route

The reviewer's handle, service address, engineer's name, booking notes, sentiment labels and internal allegations may relate to identifiable people. Draw their route through the platform, case tool, mailbox, agency and public reply. For each field, identify the source, purpose, access, recipient, retention period and rights contact.

The UK GDPR, as amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025, governs personal-data processing here. The ICO's DUAA summary was updated in June 2026 to confirm that all the Act's data protection provisions are now in force. For each purpose, record one Article 6 lawful basis.

The bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. The correct one depends on the actual purpose and circumstances. The case file should not treat monitoring, responding or buying a monitoring tool as automatically authorised by any single basis.

The engineer says the appointment date is wrong. The ICO's rectification guidance connects correction requests to the accuracy principle and notes a requester need not cite Article 16. A person may also make a data subject access request under Article 15 or seek erasure under Article 17.

Erasure is not an automatic right to delete every record. Assess the request against the applicable conditions and exemptions, document the decision, and restrict use where appropriate while a dispute is checked. A person who considers their rights infringed can complain to the ICO under Article 77. The disputed-review workflow sets out the fields.

A company that scans complaints to score engineers creates an employment-data question as well. The ICO's worker-monitoring guidance warns that analytics can produce incorrect inferences and that workers should be able to challenge results. Customer-care evidence must not become an employment finding by default.

Outcome at this desk: an authorised, reviewable data path, not a general permission to collect more information. The path should name the fields covered, the systems that hold them and the person accountable for each purpose.

Desk four: devices and direct contact

Suppose the complaint page loads a tracking pixel, or the company sends a follow-up offering a discount on future work. These are not resolved by the privacy record alone. The ICO has confirmed in its storage and access guidance that using a tracking pixel engages PECR regulation 6.

Under regulation 6, storing information on, or accessing information stored in, a user's device generally requires consent unless an exception applies. Regulation 22 governs unsolicited direct-marketing emails to individual subscribers, subject to its requirements and exceptions. A pixel may raise the regulation 6 question; a discount email may raise regulation 22 as well as UK GDPR questions.

Moving a tag server-side, or calling it first-party, does not determine whether storage or access is permitted. The ICO's direct-marketing guidance addresses promotional communications under UK GDPR and PECR. The contact owner should classify the proposed email from its actual content and context, not from the folder it was drafted in.

A requested complaint update, a service notice and a sales offer need separate records. An objection or suppression state must travel to every controlled sending system, including any review-request tool bought for the marketing team. Outcome at this desk: approval for the exact technology or message, never inherited from another channel.

Desk five: allegation, correction and platform process

Counsel, not the communications team, must assess a threatened defamation claim. The Defamation Act 2013 is primary legislation applying to England and Wales. Its defences include truth (section 2), honest opinion (section 3) and publication on a matter of public interest (section 4); section 1 requires serious harm to reputation.

The Act came into force on 1 January 2014, as the commencement instrument recorded. Section 5 and the Defamation (Operators of Websites) Regulations 2013 create a website-operator defence and a notice procedure with hard clocks.

Ministry of Justice guidance on that procedure supplies the deadlines. If the poster does not respond by midnight at the end of the fifth day after the operator writes to them, the operator must remove the statement within 48 hours to keep the defence. It must confirm removal in writing within the same 48 hours.

Those hours exclude time falling on a non-business day in England and Wales. The Limitation Act 1980 sets a one-year limitation period for defamation claims, subject to the law's provisions on extension. Neither the section 5 process nor a platform report declares every damaging statement unlawful.

For a platform report, identify a policy breach rather than reporting a review simply because it is critical. On Google Business Profile, use Google's Reviews Management Tool to report a review and, where eligible, appeal a rejected report. On Trustpilot, flag through the business platform, name the guideline and supply evidence.

On Facebook, report a recommendation through the in-product route and check the status or appeal option in Meta's Support Inbox. On Yelp, use Yelp for Business and follow the response route offered. Platform appeal windows appear in the decision notice, so record the stated deadline and the person watching it.

Record the platform, report reason, evidence submitted, decision and any appeal. These processes assess platform-policy compliance, not whether a statement is legally defamatory. The marketplace controls its own reply even if it cannot control the customer's post, and a reply that misstates the booking needs a visible correction route.

Outcome at this desk: a documented choice between a platform-policy report, a legal notice, a correction or no action. Do not present platform removal as proof that the review was false. What matters is the words, the test applied and the decision-maker.

Desk six: material, access and supplier control

Republishing a photograph, press extract or review database raises intellectual-property questions. The UK Intellectual Property Office provides general copyright information; public visibility is not a licence conclusion. Refer evidence-heavy disputes to a legal adviser, and keep the licence terms beside the material they cover.

Complaint and correction routes also need to work for disabled people. The Equality Act 2010 applies in England, Scotland and Wales. The legal requirement depends on the service and circumstances, so an accessibility specialist should examine the actual route rather than rely on a generic badge.

For hosted monitoring or case software, the buyer retains a security decision. Birdeye, Yext and Reputation are examples of review- and reputation-management software vendors; naming a vendor does not endorse its suitability or decide the business's legal duties. The NCSC's supplier assurance questions cover governance, incident recovery, data protection and independent assurance.

Test account control, least privilege, logs, access withdrawal, export and recovery before signing. Marketing convenience cannot override a security failure, and a vendor's security page is a claim rather than a test result.

Desk seven: what review software must prove

Software is where this file is usually lost. A review tool that cannot show the original wording, its URL, the retrieval time and the person who saved it cannot support the case desk. Ask for a live demonstration on a fictional review carrying an allegation, not a slide.

Selection criteria follow from the desks above: separate allegation, booking and preliminary-view fields; a rights-request workflow with the one-month response clock; suppression that travels to every sending domain; per-property tag and consent status; and an audit log recording every edit to a public reply.

Add the exit case. Can you export the case record, audit log and deletion evidence in a readable format on termination? Retention settings must attach to purpose and dispute status, and a legal hold must be authorised, dated and reversible. Ask who inside the tool can extend a retention period.

Vendor comparison should start with the overlapping job, not the brand list. Monitoring, moderation, response drafting, analytics, complaint handling and platform reporting are separate deliverables, often bought separately. Our pages on software selection and vendor due diligence set out the evidence room.

No price is quoted here because none is verified for this case. Ask for charges by deliverable, location, seat, language, message volume and exit, plus any charge for appeal handling or data export. A per-location list price that excludes onboarding and export fees is not a comparison.

Contract and retention desk

The supplier agreement should identify the legal parties and the service actually bought. Collection, monitoring, moderation, response drafting, analytics and complaint handling are different deliverables. The contract needs evidence about instructions, data roles, subprocessors, transfers, security, incidents, content permissions, service changes, charges, liability, termination, export and deletion.

The ICO's controller-processor contracts guidance distinguishes statutory data terms from the parties' commercial arrangements, and has been updated following the DUAA. Actual decisions and behaviour matter more than a role label typed into a schedule, so keep the evidence of who decided what and when.

Retention should be attached to purpose and dispute status. The business may need an auditable case record, but "reputation history" is not a self-executing retention rule. Specify what is retained, why, for how long, who can extend the period, how a legal hold is authorised, and how deletion is evidenced across suppliers.

Escalation board

Close the case only through separate decisions. The review-integrity owner reports on invitation, incentives and moderation. Advertising signs off the final impression and its evidence. Privacy and PECR owners cover the data path, rights, devices and contact. Defamation counsel chooses any legal notice. Employment, IP, accessibility, security, software and commercial owners decide their own parts.

Each decision has an evidence reference, status, reviewer, date, expiry and trigger for reopening. Status is pass, fail or unresolved. There is no combined compliance score, and no vendor dashboard percentage substitutes for those six fields.

If one necessary approval is missing, only that proposed act stops. The complaint can still be investigated through an authorised accessible route. The original review stays preserved, without being treated as proven or disposable. Reopening is normal when a platform decision, an appeal deadline or a correction changes the facts.

Before you act

Common questions

What should the case desk do with the disputed review first?

Save it exactly as encountered, keeping the URL, timestamp, account status, platform label, full wording and any visible incentive marker. Record who retrieved it and when, and keep separate fields for the allegation, booking record, engineer account and preliminary view rather than rewriting uncertainty into verified facts.

Why does the advertising desk need the final panel, caption and placement?

The CAP Code addresses the overall impression a marketing communication gives, so source accuracy alone does not settle what the audience is likely to understand. The reviewer needs the original quotations, permissions, incentive history, product identity, date and every objective implication, plus the final crop, caption and link destination.

Which ethical standard should a reputation team name?

Name the code that binds the person or agency doing the work. For UK public-relations and reputation practice those are the CIPR Code of Conduct and the PRCA Professional Charter and Code of Conduct. Record the version, the date checked and the clause relied on, then apply the five-part fairness framework to the decision.

What employment-data question does complaint scanning raise?

Scanning complaints to score engineers creates an employment-data question. The ICO's worker-monitoring guidance warns that analytics can produce incorrect inferences and that workers should be able to challenge results. Customer-care evidence must not become an employment finding by default, and the scoring needs its own lawful basis.

What deadlines apply to a platform report or a section 5 notice?

Under the Defamation (Operators of Websites) Regulations 2013, the operator must act by midnight at the end of the fifth day after writing to the poster, then remove within 48 hours and confirm in writing in the same window, excluding non-business days. Platform appeal windows are set out in the decision notice, so log the stated date.

What software evidence should a buyer demand before signing?

Ask for the source record fields, the rights-request clock, suppression coverage across every sending domain, per-property consent status, audit-log edits to public replies, and a full export of case record and deletion evidence on exit. Then ask for pricing by deliverable, location, seat, language and exit.