Seven steps to build an employer branding disclosure policy

What to take away

The most common mistake is treating an employer branding disclosure policy as a marketing style guide. It is an evidence and permissions record first.
Written consent specific to recruitment marketing can be appropriate, but it is not a blanket lawful basis. For electronic mail, check PECR separately from the UK GDPR; the ICO's Direct marketing guidance explains the relevant rules.
Advertising codes bite on claims, not tone. The advertising codes that apply to recruitment advertising keep the bar on misleading impressions. The ASA administers the CAP Code (12th edition), which applies to marketing communications within its scope.
Employment law sits underneath everything. Check the Equality Act 2010 and, for employment terms, the Employment Rights Act 1996; use Acas recruitment advice alongside GOV.UK's Employing people guidance.
One named owner, one review date, one evidence log. A policy nobody maintains is decoration.

Why do teams get disclosure wrong?

Most teams write the policy after a candidate or a regulator asks a hard question. By then the screenshots, edited employee quotes and agency briefs are already live.

A disclosure policy fixes the order of operations: what may be said, who approves it, where the proof lives. That keeps a careers site defensible.

These steps are written for England, where recruitment and advertising duties apply. Most of them also apply UK-wide, with some differences in Scotland and Northern Ireland. Individual cases need a qualified adviser.

Step 1: Map every claim you publish

List each factual claim on your careers site, job adverts and social posts. Employee quotes, pay ranges, progression timelines and award badges all count.

Claim evidence record fields

The factual claim as published
Source of the claim
Date recorded
Named approver
Review or expiry date

For each one, record the source, the date and the approver. A claim with no source is a claim you cannot repeat next quarter.

For gender pay gap claims, check the employer's published figures. Where reporting applies, the relevant rules are the Equality Act 2010 (Gender Pay Gap Information) Regulations 2017; check the employer's entry on GOV.UK's Gender pay gap service.

Step 2: Separate facts from impressions

The CAP Code (12th edition), administered by the ASA, covers marketing communications within its scope. Rule 3.1 addresses materially misleading advertising, rule 3.3 misleading omissions and rule 3.7 evidence for objective claims. These rules include impressions created by images or omissions. A quiet office photo needs no caption, but it must not imply a working pattern you do not offer.

Agencies running your adverts are bound by the same codes, so brief them on what your evidence supports.

Step 3: Set consent and data rules

Talent pools, job alerts and speculative candidate emails are direct marketing. You need a lawful basis and clear information at the point of collection. For email, check the additional requirements of the Privacy and Electronic Communications Regulations 2003 (PECR); a UK GDPR lawful basis alone does not meet any applicable PECR consent requirement.

Keep consent records. If you rely on legitimate interests, document the balancing test rather than asserting it.

Apply the UK GDPR and the Data Protection Act 2018 to candidate personal data. The ICO's Direct marketing guidance and Employment practices and data protection: recruitment and selection guidance are relevant starting points. For each purpose, document why the selected UK GDPR lawful basis fits; if relying on legitimate interests, record the purpose, necessity, balancing of your interests against candidates' rights and reasonable expectations, and any safeguards.

Use a record for each claim with its exact wording and channel; evidence, source and date; permissions or consent; owner and approver; data use, lawful basis and privacy information where candidate data is involved; review or expiry date; and correction history.

Example opt-in wording for recruitment updates: “I agree to receive recruitment updates by email from your organisation. I can withdraw my consent at any time.” Keep this as a separate, unticked choice, not a condition of applying for a role, and retain evidence of when and how consent was given.

Step 4: Write the approval route

Name one owner for the policy and one approver for exceptions. Set a review date at most 12 months out.

Approval route for claims

Copywriter drafts claim
Named policy owner checks evidence
Single approver signs off
Exception goes to approver
Review date set within 12 months

A short route beats a committee. For example, a team paying £400 a month for a careers site still needs a single approver for pay claims.

Step 5: Train the people who write the copy

Recruiters, hiring managers and agencies write employer brand copy daily. Give them a one-page rule set: no unverified pay claims, no unnamed awards, no implied guarantees.

Refresh the training when the policy changes, and log who attended.

Step 6: Audit quarterly

Pick ten live claims at random each quarter and trace them to evidence. Fix or remove anything you cannot support.

It also catches drift, such as a regional team rewriting a national message.

Step 7: Record decisions

Keep a decision log: what was approved, by whom, on what evidence and when it expires. If a complaint arrives, the log is your defence.

Store it where the marketing team can find it without asking.

What does good look like in practice?

A mid-sized employer in England runs a careers site with 40 live claims. Its policy names a brand lead as owner and requires evidence for every pay figure.

When a candidate questions a progression claim, the team produces the source within a day. Check the Equality Act 2010 for relevant equality duties, and apply the UK GDPR, Data Protection Act 2018 and PECR where the claim involves candidate data or electronic marketing.

Common questions

Does an employer branding disclosure policy need legal review?

Not always, but a qualified adviser should check it if you publish pay claims, use candidate data or operate in a regulated sector. Review it annually even when nothing changes.

Does the policy apply across the UK?

Most recruitment and advertising duties apply UK-wide. Some employment rules differ in Scotland, Wales and Northern Ireland, so confirm the position for each location you hire into.

What happens if a claim is wrong?

Correct or remove it quickly, log the change and tell anyone who relied on it. A prompt correction usually beats defending the original wording.

Who should own the policy?

One named person, usually in employer brand or recruitment marketing, with a legal or HR reviewer. Shared ownership without a named lead tends to stall.