Online reviews are one of the most important parts of a modern business’s reputation. They influence buying decisions, shape search rankings and, more often than not, they serve as the first impression a potential customer gets. But because reviews involve real people sharing personal opinions – and often personal details – they also sit inside the scope of UK data protection law.
That means UK businesses can’t just collect, publish or respond to reviews however they like. There are rules, and getting them wrong can lead to fines, complaints and unwanted attention from the Information Commissioner’s Office (ICO). The good news is that the rules aren’t actually as complicated as they sound.
Why Does GDPR Apply To Online Reviews In The First Place?
The General Data Protection Regulation (GDPR) applies whenever personal data is processed and reviews almost always involve personal data. A reviewer’s name, email address, IP address, photo and even the content of what they’ve written can all count as personal information under the law.
That means the moment you collect, store, publish or respond to a review, you’re processing personal data and you have obligations that come with it.
Which Key Principles Actually Apply?
You don’t need to memorise the entire UK GDPR to handle reviews properly, but there are a few core principles that matter most in this context.
Lawfulness And Transparency
You need a lawful basis to process someone’s data, and for reviews, the two most common are consent and legitimate interest. If a customer voluntarily submits a review knowing it will be published, you generally have a solid basis to proceed. But that only works if you’ve been transparent, meaning you’ve clearly told them how their information will be used, where it will appear and how long it will be kept.
Accuracy
Reviews should reflect what customers actually said, not edited or paraphrased versions that change the meaning. Editing reviews to remove genuine criticism, for example, isn’t just ethically shaky but it can be a data protection issue if the individual can argue their views have been misrepresented.
Data Minimisation
You should only collect what you actually need. If you’re gathering reviews, ask yourself whether you really need someone’s full name, email address and location. Sometimes, just a first name and initial would do. The less personal data you collect, the less you have to protect and the lower your risk if something goes wrong.
How To Get Consent Properly
Firstly, it has to be freely given. You can’t make leaving a review a condition of receiving a service, discount or a freebie. Bundling consent with something a customer wants makes the consent invalid.
It also has to be specific and informed. A vague tick-box saying “I agree to your terms” doesn’t cover much. Consent needs to be tied to a specific use — for example, “I agree to my review, first name and city being published on the company website.”
And finally, it needs to be able to be withdrawn should it come to that. Customers must be able to withdraw consent as easily as they gave it. If someone asks for their review to be taken down, you generally need to comply.
Responding To Reviews Without Breaching GDPR
A classic mistake is replying to a negative review by mentioning specifics about the customer’s account, purchase or interaction that they didn’t disclose publicly themselves. Stick to general responses. Acknowledge the concern, offer to resolve it privately and take the specifics offline. This is both good customer service and safer compliance-wise.
If you want to share a positive review on social media or your website, get explicit permission first, especially if the review includes the customer’s photo, business name or any other identifying details.
How Do You Handle Right-to-Erasure Requests?
Under UK GDPR, individuals have the right to request the deletion of their personal data in certain circumstances, often called the “right to be forgotten.” For reviews, this comes up more often than you might expect.
If a customer asks you to remove a review they left, you should generally comply, particularly if it was their consent that made publication lawful in the first place.
You cannot delete negative reviews left by others without their consent, obviously. And you can’t reasonably force platforms like Google or Trustpilot to remove reviews on your say-so; you’d need to go through their own processes.
