Political Campaigning and GDPR: Lawful Bases, Voter Data and Political Ads

Update: October 2026

Political campaigns run on personal data: names and addresses from the electoral register, phone numbers, email lists, supporter records and online audiences. The same data protection rules apply to every candidate and every party.

This guide covers the UK rules in the ICO’s political campaigning guidance, including lawful bases, political opinions as special category data, the electoral register and direct marketing, and then the EU rules on targeting political advertising that apply from October 2025.

Key Takeaways

• Political opinions are special category data. The ICO says most campaigners should not use special category data, inferred or otherwise, to target people with political messaging without their explicit consent. Registered political parties have a narrow condition for processing political opinions and need an appropriate policy document to use it.

• Most political messaging sent to named individuals is direct marketing. People have an absolute right to object, and PECR requires specific consent for electronic messages. The soft opt-in does not apply to political campaigning.

• Regulation (EU) 2024/900 has applied since 10 October 2025. Targeting online political ads with personal data is allowed only if the controller collected the data from the person with separate, explicit consent and without profiling that uses special categories of data.

Campaigning Covers Parties, Candidates and Referendum Groups

The ICO defines political campaigning purposes as activity supporting or opposing a political party, a referendum campaign, a candidate standing for election, or the success or failure of a recall petition. The guidance covers registered parties, candidates, referendum campaigners, non-party campaigners and recall petition campaigners, and applies regardless of a campaigner’s status under electoral law. It is not limited to regulated election periods.

It applies to organisations with a UK establishment. It can also apply to overseas organisations that offer services to users in the UK or monitor their behaviour. Our guide to GDPR for companies outside the EU explains the same territorial tests under the EU GDPR.

The ICO notes that its political campaigning guidance is under review because of the Data (Use and Access) Act, so check the ICO’s plans for updated guidance before relying on any page.

Three Lawful Bases Cover Most Campaigning

The ICO’s lawful bases guidance says most processing for political campaigning falls under public task for democratic engagement, consent, or legitimate interests, and that campaigners must record which basis they use and why.

Public task relies on section 8 of the Data Protection Act 2018, which covers processing necessary for an activity that supports or promotes democratic engagement, and on Article 6(3), which requires a task laid down by law. The ICO says this basis is often misunderstood as an overarching exemption. For electoral register data, most campaigners rely on electoral law. Some elected officials may rely on other laws for additional data.

Campaigners without a supporting law can most likely rely on legitimate interests to process data that supports democratic engagement, using the usual three steps: identify the interest, show the processing is necessary, and balance it against people’s interests and rights. Necessary means more than useful or standard practice. The processing must be targeted and proportionate, and the basis does not apply if a less intrusive way would achieve the purpose.

Consent suits cases where people have real choice. It must be specific, recorded and easy to withdraw, and the ICO warns that a campaigner who relied on consent cannot switch to legitimate interests when the person withdraws it. See our guide to valid consent under GDPR for the full standard.

Political Opinions Need an Article 9 Condition

Political opinions are special category data under Article 9. The ICO also treats inferred data as special category data. If you intend to infer details such as ethnic origin or political opinions, you are processing special category data regardless of how confident you are in the inference. For example, a party that uses software to screen constituents’ names for likely religion and ethnic origin before sending festival cards is processing special category data. That is special category processing, and the ICO says the party should not do it without explicit consent.

Three conditions matter. Registered political parties can use the conditions in Article 9(2)(g) and Schedule 1 of the Data Protection Act only for personal data that reveals political opinions. It applies where the processing is necessary for the party’s political activities, is not likely to cause substantial damage or distress, and the person has not given written notice requiring the party to stop. The party must show that it cannot achieve the same purpose without political opinion data and must have an appropriate policy document.

Not-for-profit bodies with a political aim can use Article 9(2)(d) for data about members, former members and people in regular contact, with safeguards and without disclosing the data outside the body without consent. It does not cover prospective supporters with no contact. Explicit consent under Article 9(2)(a) is the fallback for everyone else, and it must be confirmed in words that refer to the type of data involved. Our guide to special category data explains how inference works in other settings.

The Electoral Register Comes With Conditions

Under the ICO’s electoral register guidance, registered parties, candidates and registered campaigners are entitled to the full electoral register and, where they meet the criteria, the marked register, which shows who voted without showing how. The ICO is clear that this entitlement does not exempt campaigners from data protection law.

They must use the register only in ways compatible with electoral law, keep it accurate by requesting updated versions, not share it with other controllers, and share it with processors only where electoral law allows. They must still provide privacy information, although the ICO does not expect campaigners to write to every voter and says they should take regular, active steps alongside other privacy information. Checking a donor against the register to confirm a permitted source is allowed, subject to the data protection principles.

Most Political Messaging to Named People Is Direct Marketing

Section 122 of the Data Protection Act defines direct marketing as communication of advertising or marketing material directed to particular individuals. The ICO says this includes promoting political campaign aims, appeals for funds, and asking people to vote for a party, and that most political messaging aimed at individuals counts. Its guidance on opinion research and direct marketing sets out the rules for each channel.

The right to object to direct marketing is absolute. When someone objects, you must stop. The ICO advises suppressing their details rather than deleting them, especially for register data, so a new copy of the register doesn’t lead to the same person being contacted again. Objections can be verbal, which matters at the door. The ICO’s example of a canvasser who is unsure which of two brothers objected recommends adding both to the suppression list.

PECR adds channel rules. For electronic mail, including emails, texts, voicemails, and direct messages, you need the individual’s specific consent, must not hide your identity, and must provide an opt-out. The soft opt-in does not apply to political campaigning. “Tell a friend” campaigns are likely to breach PECR because you cannot collect valid consent from the recipient. Live calls require screening against the Telephone Preference Service unless the person has consented, and automated calls need specific consent. The ICO says it has issued enforcement notices to political parties over automated calls without appropriate consent. Our guide to buying email lists covers the same PECR consent rules.

Post works differently. PECR does not cover it, and addressed mail is still direct marketing under data protection law. Unaddressed leaflet drops fall outside it, although addressing mail to “the occupier” when you know the person’s name does not exempt you from the rules. A Freepost election address is subject to data protection law and is not direct marketing, so the right to object does not apply to it.

Opinion Research Cannot Be a Cover for Campaigning

Genuine opinion research is outside the direct marketing rules. The ICO lists tactics that pose as research: lobbying under the guise of research, fundraising under the guise of research, selling merchandise and online surveys used to target political messages. Recording answers in a way that links them to an individual so you can follow up and market to them makes it direct marketing.

EU Rules Now Restrict Targeting of Political Ads

Regulation (EU) 2024/900 on the transparency and targeting of political advertising has applied since 10 October 2025, according to the European Commission and the Polish data protection authority. It requires disclosure of who finances an ad, labelling, registers and a European repository.

For data protection, Article 18 allows targeting or ad delivery techniques that process personal data in online political advertising only if the controller collected the data from the person, the person gave explicit consent separately for political advertising, and the technique does not involve profiling that uses special categories of data. Targeting that involves a person the controller knows with reasonable certainty to be at least one year under the voting age is prohibited. People who refuse consent must be offered an equivalent alternative way to use the service without political ads. The article does not apply to communications from political parties and other non-profit bodies to members, former members or subscribers, if they rely only on data those people provided and involve no further targeting.

Under Article 19, controllers must publish a plain language policy on the techniques they use and keep it for seven years after last use, keep records, give people additional information about the logic and parameters of the targeting, publish an annual risk assessment of its effect on fundamental rights, and point to ways of exercising data rights. Under Article 22, data protection authorities supervise Articles 18 and 19, and the European Data Protection Board prepares guidelines to help them assess compliance. The regulation applies in addition to the GDPR. Check the Commission’s October 2025 guidelines and your national authority’s guidance before building a campaign.

A Campaign Checklist Keeps the Basics in Place

Record the lawful basis for each purpose and the Article 9 condition for any political opinion data. Put an appropriate policy document in place if you are a registered party relying on the party condition. Keep register data separate, current and unshared. Build a suppression list that survives new copies of the register. Check consent records before sending electronic messages and screen call lists against the TPS. For EU audiences, check that any online political ad meets the direct-collection and explicit-consent conditions.

Train staff and volunteers to recognise objections and requests, since many arrive verbally. GDPRLocal helps campaigns and organisations review lawful bases, policy documents and consent flows. See our GDPR consultant services.

Conclusion

Political campaigners have more legal routes to use voter data than most marketers, including public task and the register, and each route has conditions. Political opinions get the strongest protection, direct marketing rules reach most messages to named people, and the right to object has no exceptions.

In the EU, the political advertising regulation adds a second layer of online targeting rules. Campaigns that operate across borders should plan for the stricter rule: collect data from the person with separate, explicit consent, and do not profile special categories.

Frequently Asked Questions

Are Political Opinions Special Category Data?

Yes. Article 9 lists political opinions, and the ICO says inferred political opinions count too. Registered political parties have a narrow condition for processing political opinion data, and everyone else generally needs explicit consent.

Can Campaigners Use the Electoral Register for Direct Mail?

Registered campaigners can use the full electoral register in ways compatible with electoral law. They must still comply with data protection law, keep the data accurate, avoid sharing it with other controllers and provide privacy information. Addressed political mail is direct marketing so that people can object.

Can We Target Political Ads at EU Voters Using Their Personal Data?

Only under strict conditions. Regulation (EU) 2024/900 allows personal data targeting of online political ads if the controller collected the data from the person, they gave separate explicit consent, and the technique does not involve profiling that uses special categories of data.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.