What employer branding rules and ethics apply in the UK?

What to take away

Who enforces the rules

Employer branding in the UK has no single regulator. Recruitment advertising is covered by the CAP Code, which the Advertising Standards Authority applies, while the ASA rules on complaints. One campaign can face two tests.

The content test asks whether the ad is misleading. The placement test asks whether it reached the right audience lawfully.

The Equality Act 2010 protects people against discrimination in recruitment. Section 4 lists the protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. Section 39 covers discrimination in employment; sections 13 and 19 address direct and indirect discrimination. A campaign that says "recent graduates only" may exclude older candidates and breach the Act.

The same wording is also likely to breach the CAP Code if it implies a requirement that does not exist.

Data protection is the third layer. Employer branding teams now run talent pools, candidate CRMs and remarketing campaigns. Each of these processes personal data. The ICO is the regulator, and it can take enforcement action for unlawful processing. The ICO's Direct marketing guidance is the reference point for consent and electronic communications. Controllers must also pay the ICO data protection fee and appear on its register of fee payers unless exempt.

Recruitment advertising claims

The CAP Code requires ads to be legal, decent, honest and truthful, and for employer branding the practical risk is the EVP claim. Rule 3.1 prohibits marketing communications that materially mislead or are likely to do so. Rule 3.7 requires documentary evidence for objective claims that consumers are likely to regard as objective and that can be substantiated. "We offer flexible working for everyone" is a claim; if the policy only covers head office, it is misleading.

The ASA can require the employer to change or withdraw the ad. It can publish the ruling, which damages the brand it was meant to build.

Recruitment ads also fall under the Equality Act 2010. An advert must not discourage applications from a protected group. That covers the text, the images and the platforms you buy. A campaign aimed only at men aged 18 to 30 may amount to indirect discrimination under section 19. Schedule 9 sets out a narrow occupational requirement exception, which applies only when its conditions are met.

Pay transparency is moving. Some employers now publish salary ranges to meet candidate expectations. There is no general UK requirement for every job advert to include a salary range. For employers in scope, the Equality Act 2010 (Gender Pay Gap Information) Regulations 2017 require publication of specified gender pay gap data; this is separate from salary ranges in individual adverts. If you publish a range, it must be accurate. Offering below it could mislead candidates under CAP Code rule 3.1, depending on the context.

Candidate data and privacy

Candidate data is personal data, and UK GDPR sits alongside the Data Protection Act 2018. UK GDPR Article 5 sets out the principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Article 6 lists the lawful bases for processing: consent, contract, legal obligation, vital interests, public task and legitimate interests. A talent pool needs an appropriate lawful basis, a retention period and a way for candidates to exercise their rights.

Consent is one basis, but not always the best. For a talent pool, you need a clear opt-in and an easy opt-out. Record when and how consent was given.

If you rely on legitimate interests, complete a balancing test and document it. The ICO expects that test to be specific to the processing, not a generic statement.

Retention is where most employers fail. A candidate who applied in 2024 and was not hired should not stay in the database indefinitely. Set a retention period, tell candidates what it is, and delete on schedule. The soft opt-in in PECR regulation 22(3) can allow marketing of similar roles, including to a candidate who applied for a role, where its conditions are met. An opt-out must be offered when details are collected and in every message.

Pay and wellbeing claims

Pay claims are advertising claims. If you say you pay above the market rate, you need evidence. A survey from a recruitment agency is not enough unless you can show the methodology. The ASA can ask for substantiation. If you cannot provide it, the claim is likely to be upheld against you.

Wellbeing claims carry the same risk. "We support mental health" is a claim about your management standards. The HSE's Management Standards for work-related stress set out an approach for assessing and managing work-related stress. If your EVP claims a supportive culture but your absence data shows otherwise, the gap is a reputational and regulatory risk.

Flexibility claims need the same care. A policy that says "hybrid working" but requires five days in the office is misleading. Define what flexible means in the contract and in the advert. If the role has fixed shifts, say so. Candidates who feel misled at offer stage are more likely to leave early, which raises cost per hire.

Direct marketing and talent pools

Talent pools are marketing lists. The Privacy and Electronic Communications Regulations (PECR) apply to electronic marketing. Regulation 22 covers unsolicited marketing by electronic mail, including email and SMS; regulation 23 requires the sender not to conceal their identity and to provide a valid address for opting out. The ICO's Direct marketing guidance explains consent, the soft opt-in and the right to object. Under UK GDPR Article 21, individuals have the right to object to processing for direct marketing.

The soft opt-in is often misunderstood. PECR regulation 22(3) applies where contact details were obtained in the course of a sale or negotiations for a sale, and the marketing is for the sender's similar products or services. In recruitment, that can cover a candidate who applied for a role, provided the regulation's conditions are met.

You can then market similar roles by electronic mail, but only if you offered an opt-out when the details were collected and in every message. It does not cover cold outreach to candidates you have never engaged with. Candidates also have the right to object to direct marketing under UK GDPR Article 21.

Recruiters who buy lists and send cold emails are at risk. The ICO can take enforcement action, and the employer brand can be damaged by association. If you use an agency, put the data rules in the contract. The contract should state the lawful basis, the retention period and the audit rights.

Recruitment and hiring duties

Employer branding sits on top of the recruitment process, not outside it. GOV.UK's "Recruitment and job applications" guidance covers recruitment practice, while employment law sets duties from advert to contract. That includes right to work checks, written statements of particulars and rules on deductions from pay.

A brand campaign that promises a start date or a pay rate must match the contract you issue.

The guidance covers discrimination in recruitment too. Under section 60 of the Equality Act 2010, employers must not ask about health or disability before a job offer except in limited circumstances. This includes questions in a brand survey or application form.

If your employer branding team runs a candidate survey, the questions must be compliant. For general recruitment practice, use GOV.UK's "Recruitment and job applications" guidance. For Civil Service candidate data, see the Civil Service senior talent and resourcing privacy notice.

Right to work checks are another area where brand and law meet. The Home Office's Employer's guide to right to work checks explains the checking process. The Immigration, Asylum and Nationality Act 2006, including section 15, sets out the civil penalty and statutory excuse framework. If your careers site says you sponsor visas for all roles, that is a claim. If you only sponsor for some roles, say so. Candidates who rely on the claim and then fail the check may complain, and the complaint can reach the regulator.

Decision table

Building an ethics policy

An ethics policy is not a legal requirement, but it is a practical control. It sets out what the brand will and will not claim. It also sets out who signs off a claim and what evidence is needed. The policy should cover advertising, data, pay and wellbeing. It should name the owner and the review date.

Useful professional standards include the CIPD Code of Professional Conduct and Ethics, the REC Code of Professional Practice, the APSCo Code of Conduct and the DMA Code. These are professional codes, not substitutes for the law; which apply depends on an organisation's membership and commitments.

The policy should also cover supplier conduct. If you use an agency, the agency's conduct becomes your brand risk. The Employment Agencies Act 1973 and the Conduct of Employment Agencies and Employment Businesses Regulations 2003 govern relevant agency conduct; the Employment Agency Standards Inspectorate (EAS) enforces the rules. Include a clause on data protection, discrimination and advertising standards. Ask for the agency's complaints history and its data processing agreement.

Training is the last piece. Recruiters and marketers need to know what they can and cannot say. A short annual briefing on the CAP Code, the Equality Act and data protection is enough for most teams. Keep a record of who attended. If a complaint arrives, the record shows you took the rules seriously.

Where to get advice

This guide is general information, not legal advice. Individual cases need a qualified adviser. Employment solicitors, data protection consultants and advertising lawyers can review specific claims. For a first check, read the primary sources cited above and keep a record of your reasoning.

For a deeper look at the operational side, see employer branding operations and delivery guide for 2027. It covers how to build the sign-off process that keeps claims compliant. If your team is drafting a disclosure policy for AI tools and candidate data, employer branding disclosure policy in England sets out the structure.

For the data protection detail, employer branding data protection in England covers notices, retention and subject access. Marketers who buy media should also read employer branding advertising rules in England before signing off a campaign. Finally, employer branding UK regulations in England maps the regulators and the laws that apply to each channel.

Common questions

Do UK employer branding campaigns need to follow the CAP Code?

Yes. The CAP Code applies to recruitment advertising and marketing communications in the UK. The ASA can investigate complaints and require changes. It can also publish a ruling, which is a reputational risk.

Can we keep candidate details in a talent pool indefinitely?

No. The Data Protection Act 2018 and UK GDPR require a retention period and a lawful basis. You must tell candidates how long you will keep their data and delete it on schedule. Indefinite retention is hard to justify.

Can we claim a role is flexible if only some teams are?

Only if the advert is specific. A blanket claim that is not true for the role is misleading. Define the arrangement in the advert and the contract, and avoid language that implies a universal policy.

Who is responsible if an agency sends unlawful marketing?

The employer is usually responsible for the campaign it commissioned. Put data protection and advertising clauses in the contract and check the agency's process. The ICO can act against the employer as data controller.