Rules and ethics
Part of Technical SEO rules and ethics explained for UK audits
Technical SEO: checking UK rules and standards
A practical technical SEO source-checking method for UK audits, covering data protection, consumer law and accessibility duties.
What to take away
- Most teams reach for a blog post or a US rule page first. Fix that habit before anything else.
- Start with the law and regulator guidance that applies, then use relevant technical standards; no single source covers every audit issue.
- Every audit claim needs the page it came from, the date you checked it and the rule it supports.
- A checklist cannot settle a live case. Where the facts are contested, a qualified adviser decides.
Where UK rules that touch SEO actually sit
Technical SEO UK regulations rarely arrive as a single statute. They sit in data protection law, competition and consumer law, and accessibility standards that buyers and regulators treat as a baseline. Relevant instruments include the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (PECR), Competition Act 1998, Digital Markets, Competition and Consumers Act 2024, Equality Act 2010 and public-sector accessibility regulations. Sourcing discipline therefore matters more than a long checklist.
Source types and what they settle
Primary law
- What it settles
- Legal duty
- Example
- UK GDPR
- Can define law?
- Yes
- Rank when citing
- Highest
Regulator guidance
- What it settles
- How to comply
- Example
- ICO rights page
- Can define law?
- Yes
- Rank when citing
- High
Platform docs
- What it settles
- Feature behaviour
- Example
- Search Console help
- Can define law?
- No
- Rank when citing
- Lowest
The practical test is blunt. Can a second person open the page you cited and find the sentence you relied on? If not, the citation is decoration.
Classify each source before you cite it. Primary law and regulator guidance outrank an agency blog. Platform documentation explains how a feature behaves, but it cannot tell you what the law requires.
Data subject rights shape what you may collect through analytics and how long you hold it. The ICO sets out access, erasure, rectification and objection in its guidance on individual rights (page title: 'Individual rights | ICO'), explaining rights under the UK GDPR alongside the Data Protection Act 2018. For cookies and similar tracking technologies, check PECR as well as the UK GDPR.
A typical starting point is a 30 day retention window for raw logs, though the ICO does not set a fixed period; what determines it is the purpose and the risk.
Online competition and consumer protection fall to a separate body. The Competition and Markets Authority covers online competition and consumer protection in its published remit. The Competition Act 1998 is a key competition law, while the Digital Markets, Competition and Consumers Act 2024 includes consumer-protection provisions relevant to online practices. A misleading site claim can become a regulatory question rather than a marketing one.
The Web Content Accessibility Guidelines (WCAG) 2.2 are a technical standard, not UK legislation. For public-sector websites and apps, the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 refer to the technical standard EN 301 549, which incorporates WCAG 2.1 AA. The Equality Act 2010 also sets accessibility-related duties in Great Britain; Government Digital Service monitors public-sector compliance, while the Equality and Human Rights Commission is an enforcement body in Great Britain.
For each audit claim, identify the statute or regulation that applies to the site and organisation, then use relevant regulator guidance and technical standards as supporting material. Do not cite WCAG 2.2 as though it were legislation.
Five steps to record a source you can defend
Five steps to record a source
- State the rule in one sentence, using the words the source itself uses.
- Copy the full URL, including path segments and capital letters, so the link resolves later.
- Log the date you checked the page, because guidance and standards are revised.
- Name the limit of the source. Say what it does not cover.
- Flag any point that needs sign-off from a qualified adviser before publication.
A worked example of a recorded citation:
- RuleIndividuals have the right to obtain a copy of their personal data (ICO, Individual rights).
- URLhttps://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/.
- Checked1 March 2025.
- Limitthis citation describes subject access; check any applicable exemptions under the Data Protection Act 2018 before responding.
- Sign-offnone required.
Keep that record in the audit file. Two people should be able to repeat the check without asking you where the link came from. When a client asks later why a redirect rule exists, the answer takes seconds rather than a day.
Retention and rights in crawl data
Crawl logs, server logs and exported Search Console data can contain personal data. A URL with an email address in a query string is the obvious case. Retention periods and erasure requests then apply to files most SEO teams treat as technical artefacts.
For crawl files containing personal data, apply the UK GDPR and Data Protection Act 2018, including their requirements around lawful processing, data minimisation, retention and rights. For cookies and similar tracking technologies, check PECR alongside the UK GDPR and the ICO's guidance.
A short record of who asked, what was removed and when is stronger evidence than a policy PDF nobody reads.
None of this decides a live case.
Common questions
Which regulator covers a technical SEO complaint?
There is no single SEO regulator. The ICO handles data protection complaints, and the CMA can act on online competition and consumer protection issues, including under the Competition Act 1998 and the Digital Markets, Competition and Consumers Act 2024. For public-sector accessibility, Government Digital Service monitors compliance with the accessibility regulations; the Equality and Human Rights Commission has an enforcement role in Great Britain.
Does every audit finding need a source?
Findings that state a legal or standards duty do. For speed or rendering observations, the source is your own measurement, and you should record when it was taken.
Is WCAG 2.2 a legal duty in the UK?
No. WCAG 2.2 is a technical standard, not a legal duty. Public-sector accessibility duties are set out in the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018, which refer to EN 301 549 and WCAG 2.1 AA; the Equality Act 2010 also applies to accessibility duties in Great Britain.
How often should I recheck a cited page?
A yearly recheck suits stable regulator pages, and sooner if you know a review is under way. Log the date each time so the file shows a current source.
