UK rules and ethics for productivity software sold in England, mapped before policies

Business productivity software rules and ethics depend on what the service does, whose information it uses, how it is sold and whether it shapes decisions about people. No single licence or compliance badge covers the category. A task board holding project names carries different risks from a tool that scores workers, sends marketing messages or handles health information.

This guide assumes a supplier sells or operates software for organisations in England. Data protection and advertising guidance cited here applies UK-wide. Contract discussion uses the law of England and Wales as a planning boundary, not a conclusion on any particular agreement. Sector rules, overseas users and consumer sales can alter the analysis.

A qualified UK lawyer and data-protection practitioner must review the product before publication or launch; sources were checked on 5 September 2026.

What to take away

Build a map before writing policies

Start with activities rather than legislation names. Draw the service from first collection to deletion and identify the organisations involved. The map should show:

Give each line an owner, an evidence record and a review trigger. One feature may appear in several rows. A usage dashboard, for example, can touch contractual permissions, personal data, worker monitoring and an advertising claim if its results are quoted in marketing.

Do not copy another software company's policy and assume the roles match. The Information Commissioner's Office explains that a controller decides the purposes and means of processing, while a processor acts on a controller's behalf. Where a controller uses a processor, the ICO says the relationship needs a contract or another binding legal arrangement.

A supplier can be a processor for customer content and a controller for its own billing or marketing records. The facts decide the role.

Treat data protection as product work

UK data protection duties apply to personal information, whether or not a database carries that label. Names and email addresses are obvious examples. Activity logs, identifiers, location trails and free-text notes may also concern an identifiable person. The product team needs to know what is captured by default, what an administrator adds and what appears in exports or logs.

The ICO's data protection by design guidance tells organisations to consider privacy at the start and throughout the lifecycle. For a software service, that means turning the assessment into requirements: limited default collection, role-based access, usable retention controls, an auditable deletion path and privacy information that matches the interface.

Record a lawful basis for each purpose before processing begins. If special-category information is involved, take advice on the additional condition and safeguards. One basis copied across every row is unlikely to explain why the supplier bills an account, the customer schedules work and a marketing team profiles prospects.

Screen proposed processing for a data protection impact assessment. The ICO says a DPIA is required before processing that is likely to result in high risk. The assessment must examine effects on people, rather than only the probability of a breach.

If high risk cannot be reduced, the organisation may need to consult the ICO before proceeding. The current ICO pages note changes following the Data (Use and Access) Act, so a reviewer should recheck them before deciding.

Do not hide worker monitoring inside analytics

A feature sold as productivity analytics can become worker monitoring when an employer uses it to inspect activity, infer performance or make employment decisions. Labels such as insight or optimisation do not alter the processing.

The ICO's monitoring workers guidance covers productivity tools, screenshots, keystrokes, timekeeping and other observation. It requires employers to identify a purpose and lawful basis, consider necessity and proportionality, limit collection and inform workers.

Consent often fits poorly where workers lack genuine choice, while the page is UK guidance and flags possible revisions after recent legislation.

The supplier should make intrusive settings visible, off by default where appropriate, and capable of being restricted by role. Customers still need their own lawful assessment. A contract clause saying the customer is responsible will not repair a design that gathers more information than the documented purpose requires.

Ethical review should ask a practical question: what might a manager misread from this record? Idle time may indicate a meeting, offline work, assistive technology or a broken integration.

If a score can affect allocation, appraisal or discipline, document its inputs, limitations, contest route and human decision point. These controls do not guarantee legal compliance, but their absence is a clear warning.

Substantiate software advertising before it goes live

Website copy, social posts, paid advertisements, comparison pages and sales material all create claims. The CAP Code for non-broadcast advertising covers recognition of marketing communications and misleading advertising, including substantiation, prices, comparisons and testimonials. The ASA and CAP also state that business-to-business marketing must consider the Business Protection from Misleading Marketing Regulations 2008.

Create a claim file for every objective statement. It should preserve the exact words, intended audience and evidence. Record the test conditions, calculation, owner and expiry date. Faster, reduces admin and saves hours are factual claims when readers are likely to understand them as measurable. A qualification can narrow a claim, but it should not quietly contradict the headline.

For an identifiable competitor comparison, CAP guidance says the features compared must be material, relevant, representative and capable of verification. Its current comparison guidance expects enough information for the audience to understand and check the basis. A dated screenshot without equivalent plans, configurations, geography and test steps rarely supports a broad superiority statement.

Testimonials need their own records. CAP's testimonials and endorsements advice says marketers should hold documentary evidence that a testimonial is genuine and contact details for the source. Claims inside the quotation still need to comply with the advertising rules. Permission to quote a customer does not turn the customer's experience into proof of a general result.

Separate business sales from consumer exposure

Productivity software is often marketed to organisations, but a sole trader or mixed personal and business use can complicate the customer classification. A free individual plan may also create a consumer relationship that differs from the enterprise contract.

The Competition and Markets Authority's unfair commercial practices guidance concerns business-to-consumer conduct under the Digital Markets, Competition and Consumers Act 2024. The regime includes specific rules on fake reviews. Do not apply this consumer guidance mechanically to a negotiated company purchase, but do not assume that calling a plan professional removes every consumer issue.

If terms are offered to consumers, the CMA's updated unfair contract terms guidance addresses fairness and transparency under the Consumer Rights Act 2015. It does not govern ordinary business-to-business agreements. Classify the transaction first, then obtain advice about the correct regime and jurisdiction.

Make the commercial contract describe the service

A useful software agreement matches the operating model. Define the subscribed service, authorised users, customer responsibilities, implementation work and order of precedence between the order form, service terms and data documents. If a feature is described in sales material but absent from the contract or service description, the parties may start with different expectations.

For personal-data processing, the ICO lists minimum Article 28 contract terms. They address documented instructions, confidentiality, security and sub-processors. They also cover help with individual rights, end-of-contract treatment and audits. A data processing schedule should reflect actual suppliers and technical operations rather than reproduce headings with empty promises.

Commercial points need equal care: payment basis, tax treatment, renewal mechanics, service changes and support boundaries. Also cover intellectual property, confidentiality, warranties and suspension. Liability, termination and dispute process matter too.

Under the Unfair Contract Terms Act 1977, some attempts to exclude or restrict liability are subject to statutory controls, including a reasonableness test in relevant circumstances. Its application is technical and fact-specific, so a solicitor should draft or review liability provisions.

Exit belongs in the original bargain. Define export format, timing, assistance and remaining backups. Add administrator access and deletion evidence. If the only extraction is an unreadable system dump, a contractual right to data return may have little operational value.

Distinguish security law from security evidence

Compliance statements such as secure, encrypted or industry standard are too vague for a buyer. Describe the boundary: authentication, permissions, tenant configuration, logging and incident contact. Add backup, recovery and vulnerability handling.

The UK government's Software Security Code of Practice was updated in January 2026. It contains 14 voluntary principles across secure development, build environments, deployment and maintenance, and customer communication. It is not legislation or certification. A supplier can use it to organise evidence, but should not present alignment as government approval.

Customers retain work after choosing a hosted service. The National Cyber Security Centre's SaaS security guidance covers onboarding, offboarding, authentication, administrator protection and data. It also covers incident response and monitoring. Put those duties into implementation documents and name the owner on each side.

Decide what ethical practice adds

Law sets obligations and remedies. Ethical product decisions still arise where the rules allow more than one course. For each new collection, score or automated suggestion, ask whether the purpose can be met with less information or a less intrusive method. Include people affected by the output, as well as the purchaser, in that review.

Provide a route to question data and decisions. Avoid interfaces that make refusal or export technically possible but deliberately confusing. When a customer could mistake an estimate for an observed fact, label the source, method and uncertainty beside the number.

Run a release gate, not a policy recital

Before a feature, campaign or contract goes live, assemble the product owner, security lead, data-protection adviser, commercial owner and qualified legal reviewer. Give them the actual interface, data map, claim file and contractual documents. A policy link alone is not evidence that the implementation matches it.

Record one of four outcomes for each unresolved issue: approve, approve with a named condition, pause, or remove from scope. Keep the decision, evidence and expiry date together. Reopen the gate when the purpose, audience, data or supplier changes, or when the claim or contract changes.

Next, choose one real workflow and mark every place where personal information, a claim or a contractual promise enters it. Assign the missing evidence. No publication or launch should proceed until the required UK specialists have reviewed those specific points.

Before you act

Common questions

When does a supplier act as a controller rather than a processor?

The ICO explains that a controller decides the purposes and means of processing, while a processor acts on a controller's behalf. A supplier can be a processor for customer content and a controller for its own billing or marketing records. The facts determine the role, so do not copy another company's policy.

What does the ICO require for monitoring workers?

The ICO's monitoring workers guidance covers productivity tools, screenshots, keystrokes and timekeeping. It requires employers to identify a purpose and lawful basis, consider necessity and proportionality, limit collection and inform workers. Consent is often a poor fit where workers do not have a genuine choice.

How should a software company substantiate advertising claims?

Create a claim file for every objective statement. It should preserve the exact words, intended audience and evidence, plus the test conditions, calculation, owner and expiry date. For competitor comparisons, CAP guidance says the features compared must be material, relevant, representative and capable of verification.