Why social media agencies commercial contracts need a clauses checklist

What to take away

The ICO's children's code took effect on 2 September 2021, so contracts aimed at younger audiences should reflect its age assurance and data minimisation expectations.
Look for clause groups covering data protection, advertising compliance, intellectual property, payment and exit.
Check whether the agency acts as controller or processor, because that decides who answers a subject access request.
Platform rules sit alongside UK law, so name who checks creative before it runs.
This list applies to written agreements between an England-based client and an agency, wherever the agency is based.

Data protection clauses

Any agency handling personal data for a client needs a written agreement covering lawful basis, purpose and retention. The Data Protection Act 2018 sets the statutory basis for those principles and for lawful processing. A clause that only promises general compliance is not enough.

Processor or controller?

Does the agency decide why and how data is used?

Yes

controller: answers subject access requests

processor: follows client instructions

If the agency follows the client's instructions it is usually a processor. If it decides why and how data is used it is a controller.

That distinction decides who answers a subject access request and who reports a breach to the ICO. Our guide to the UK rules and compliance framework shows how those roles sit inside a retainer.

Advertising and platform rules

Paid social activity has to follow UK advertising rules and each platform's own policies. Google's help page on campaign settings sets out how content restrictions work on Google properties, and social platforms publish comparable rules. The contract should say who checks creative before it runs and what happens when an ad is rejected.

Who checks creative before it runs

Agency builds audience
Client signs off copy
Named approver each side
Ad runs or is rejected
Free revisions capped, then chargeable

Name an approver on each side. If the agency builds the audience and the client signs off the copy, rejection risk sits in two places. CAP the number of free revisions before extra work becomes chargeable.

Children and younger audiences

The ICO's children's information guidance covers services likely to be accessed by children, including age-appropriate design and data minimisation. Where a campaign targets under-18s, the contract should record how age is checked and which data is collected.

Influencer briefs need the same safeguards as paid ads. Put the age threshold in writing and name who signs off creative.

Intellectual property and usage rights

UK law starts from the position that the creator owns copyright unless the contract says otherwise. An agency producing video, photography or graphics will normally own them unless assignment is agreed in writing.

Decide whether the client needs a licence or full ownership. Licence terms should cover duration, territory, channels and whether paid media is included. If the agency uses freelancers, confirm rights are assigned onward.

Payment, liability and exit

Payment terms should state the fee, invoicing cycle, late payment interest and whether media spend sits outside the management fee. Liability should be capped at a figure both sides accept, with carve-outs for data breaches and IP infringement.

Exit terms matter as much as entry terms. Set a notice period, a handover window and a defined list of assets. For how England rules shape contracting, read our overview of social media agencies UK regulations in England.

Commercial contracts checklist

Named parties and the legal entity for each side.
Scope of services, deliverables and approval route.
Controller or processor role, with a written data agreement.
Lawful basis, retention period and breach notification route.
Age assurance for campaigns aimed at under-18s.
Platform policy checks and who carries rejection risk.
IP ownership or licence, with territory and duration.
Fee, media spend, invoicing cycle and late payment terms.
Liability CAP, exclusions and insurance requirements.
Notice period, handover assets and post-termination restrictions.

This is general guidance only, and individual cases need a qualified adviser.

Common questions

Does a social media agency contract need a data processing agreement?

Yes, when the agency processes personal data on the client's behalf. State the purpose, retention period and security measures.

Who owns content created by an agency?

The creator usually owns it unless copyright is assigned in writing. Agree whether you need a licence or ownership, and cover duration, territory and paid media.

What should happen if a platform rejects an ad?

The contract should name who checks and approves creative, and who bears the cost. A CAP on free revisions prevents disputes.

How much notice should an exit clause give?

There is no single legal minimum. A common commercial approach is 30 to 90 days with a defined handover. For example, a client paying £2,000 a month might negotiate 60 days.