GDPR and creator data: a practical guide

Every influencer database and data API sells the same thing underneath: profiles of real people. Creators are often businesses, but they’re also individuals with names, faces, locations and, sometimes, a personal email in their bio. Under GDPR, that makes most of what you export, enrich and save personal data, and it makes you responsible for it.

None of this stops you building a creator programme or a creator search product. It does mean doing a few things most teams skip. This is practical guidance, not legal advice; for anything high-stakes, ask a data protection lawyer.

Why GDPR applies to public creator data

GDPR covers any information about an identifiable person. A handle, a follower count tied to that handle, an engagement rate, a city or a contact email all count. The fact that a creator chose to publish something doesn’t remove it from the law. In 2023, twelve data protection authorities, the UK’s ICO among them, put out a joint statement on scraping that said exactly this: publicly accessible personal data is still covered.

It applies to you if you’re established in the EU or UK, and it can also reach companies elsewhere that monitor the behaviour of people in Europe, which profiling creators can amount to. Getting it wrong can cost up to €20 million or 4% of worldwide turnover, whichever is higher, though the decisions below are a better guide to what regulators actually go after.

Your lawful basis: legitimate interests

You need one of six lawful bases for holding personal data. Consent is impractical for creators you haven’t spoken to yet, and contracts only cover creators you’ve signed. For discovery, that leaves legitimate interests, Article 6(1)(f). It’s flexible, but it isn’t a box you tick. The ICO and the European Data Protection Board set out the same three-part test:

1. Purpose. Name a specific, lawful interest: “finding creators to partner with for our skincare launches”, not “marketing”.
2. Necessity. Show the processing is a proportionate way to get there, and that a less intrusive route wouldn’t do. Holding 40 fields on a million creators fails this if you only ever look at five.
3. Balancing. Weigh your interest against the creator’s. Would a reasonable creator expect a brand to look at their public profile and email them about a partnership? Usually yes. Would they expect you to keep a dossier for years, or to guess their health or religion? No.

Write it down. That record, a legitimate interests assessment, is the first thing a regulator will ask for. Do one per use: discovery, outreach and an internal performance database are three different balances.

Commercial interests can count. The Dutch regulator’s 2024 scraping guidance took a hard line, saying private scraping can only rest on legitimate interests and that a purely commercial aim almost never qualifies. Later that year the EU’s Court of Justice, in the KNLTB case, held that a commercial interest can be legitimate, as long as the necessity and balancing tests are met. So the test is passable, but it’s still the test.

Respect the creator’s own choices. In December 2024 France’s CNIL fined KASPR €240,000, partly for collecting LinkedIn contact details that users had restricted to their connections. If a creator has hidden an email or limited who sees a field, don’t go round them.

Telling creators you have their data

This is the duty teams most often miss. When you get personal data from somewhere other than the person, Article 14 says you must tell them who you are, why you’re processing their data, your legitimate interest, what categories you hold, where you got it, how long you’ll keep it and what their rights are, including the right to object and to complain to a regulator.

The deadline is the earliest of:

• a reasonable period after you get the data, and at the latest one month;
• your first communication with the creator, if you’re using the data to contact them;
• the first time you disclose it to someone else, such as a client.

For outreach, the simple fix is to put a short notice, or a clear link to one, in your first email. For creators you hold but never contact, you need another route.

There’s an exemption where telling people would be impossible or involve “disproportionate effort”, but it’s read narrowly. Poland’s regulator fined Bisnode just over PLN 943,000 for relying on a website notice instead of contacting around six million people whose data it took from public business registers. In 2023 Poland’s Supreme Administrative Court upheld the finding that Bisnode had to tell sole traders directly, though the fine itself was sent back to be reconsidered. KASPR was also faulted for waiting about four years and then sending an English-language email; the CNIL said notices have to be timely and in a language people understand.

Keep less, for less time

Two principles do most of the work: data minimisation (only what you need) and storage limitation (only for as long as you need it). For creator data, that usually means:

• Store the shortlist, not the search. Pull results from the vendor when you need them instead of mirroring its index into your warehouse.
• Drop fields you don’t use. If no decision depends on a creator’s home city or audience age split, don’t save it.
• Set a fixed retention period. GDPR doesn’t give one, so pick and justify yours: for example, delete creators you haven’t contacted within six months of saving them. KASPR kept contacts for five years from every update, so each job change restarted the clock; the CNIL called that disproportionate.
• Keep it accurate. Stale follower counts and old emails are an accuracy problem as well as a product one. Record when each profile was last updated. Influship shows this on every profile, which makes refreshing or deleting old records straightforward.

The inferred-data trap

Article 9 sets aside special categories of data that you mostly can’t process at all: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, and sex life or sexual orientation.

Inference counts. In 2022 the Court of Justice held that data which indirectly reveals someone’s sexual orientation, through deduction or comparison, falls under Article 9. That matters for creator tools, because tagging and models are built to infer things. An “LGBTQ+ creator” label, an “ethnicity” filter or a tag saying a creator has a chronic illness is special category data, even if your model guessed it from captions.

There’s an exception for data the person has manifestly made public, which helps if a creator openly builds their channel around their own diabetes. It’s unlikely to cover your model guessing. Age, gender and location estimates aren’t special category, but they’re still personal data and still need a reason.

This is one place where the shape of the data matters. Most databases model audience age, gender and location from a sample of followers. Influship takes a different approach and looks at who engages with a creator’s kind of content rather than estimating demographics. Whichever you use, make sure nothing in your own tagging builds sensitive labels on top.

When a creator asks to be removed

Sooner or later a creator will email to ask what you hold, or to be deleted. Treat it as a routine process, not a crisis.

1. Log it and start the clock. You must act without undue delay and within one month. You can extend by two further months for complex or numerous requests, but you have to tell the creator within the first month and say why.
2. Work out what they’re asking. “Stop emailing me” is an objection to direct marketing under Article 21(2). That right is absolute: you stop, with no balancing test. “Delete me” is an erasure request under Article 17. Where you rely on legitimate interests and have no overriding reason to keep the data, you erase it.
3. Find every copy. CRM, spreadsheets, campaign tools, exports sitting in someone’s downloads. Tell anyone you shared the data with, such as an agency or client, unless that’s impossible or would take disproportionate effort.
4. Keep a suppression record. Delete the profile, but keep the minimum (a handle or email) on a do-not-contact list so the creator doesn’t reappear in your next export. The ICO’s direct marketing guidance recommends exactly this over plain deletion.
5. Answer access requests fully. If they ask where you got their data, name the source. The CNIL faulted KASPR for replying only “publicly accessible sources” when it knew more.

Emailing creators

GDPR isn’t the only law in play when you send a pitch. Email marketing falls under the ePrivacy rules, which in the UK means PECR. The ICO treats sole traders and some partnerships as individual subscribers, and electronic marketing to individuals needs consent or the narrow soft opt-in. Many creators are sole traders. If your outreach counts as marketing, which a pitch for your brand often will, emailing a creator’s personal address from a bought list is where teams get into trouble.

Lower-risk practice: write to addresses creators publish for business enquiries, send one-to-one messages rather than sequences, identify yourself, include the Article 14 notice and make opting out a one-click reply.

The UK is different, a little

The UK runs its own version, UK GDPR, alongside the Data Protection Act 2018, enforced by the ICO. The rules above apply in much the same way, and the Data (Use and Access) Act 2025 adjusts them. Most of its data protection changes took effect on 5 February 2026. The ones that matter here:

• Direct marketing is named as an example of a legitimate interest. That confirms it can qualify; you still need the three-part test.
• A new “recognised legitimate interests” basis skips the balancing test, but its list covers national security, emergencies, crime and safeguarding, not creator discovery.
• Subject access is clearer. Searches need only be reasonable and proportionate (a change in force since the Act passed in June 2025). The one-month clock doesn’t start until you have proof of who’s asking, and it pauses while you wait for details you need to find their data.
• PECR fines now match UK GDPR levels, which raises the stakes on careless email outreach.
• A complaints process. Since 19 June 2026, organisations need a way for people to complain to them about how their data is used.

What to ask a data vendor

Your vendor’s compliance doesn’t transfer to you, but its answers tell you how much work you’ll inherit. Before you sign, ask:

• What personal data comes back, field by field? Can you switch off fields you don’t need?
• Do you respect platform privacy settings? Will hidden contact details or private accounts ever appear?
• Do you infer anything sensitive? Any tags on ethnicity, religion, health or sexuality, including in free-text summaries?
• How do you handle removals? If a creator asks you to delete them, how do customers find out, and can you tell us which records to purge?
• When was each record last updated? A timestamp on every profile helps you meet the accuracy principle.
• Where is data stored and processed, and what safeguards cover transfers outside the UK or EU? Ask for the data processing terms.
• What do you tell creators? Modash, for example, says plainly that its index holds public data and that creators don’t opt in. That candour is useful; it tells you the Article 14 notice is your job.

Where to start

Every vendor in our influencer database ranking holds profiles of real creators, so the law above applies whichever you choose. Pick on search, data and price, then build the notice, retention and removal steps around it. If you’re building creator search into your own product, our influencer data API ranking covers the developer side.

Questions