Rules and ethics
Part of UK marketplace seller software rules and ethics: controls
Marketplace seller software UK regulations: trigger map
Marketplace seller software UK regulations: map UK triggers to named rules, territories, owners and evidence for seller operations.
Marketplace seller software UK regulations are best mapped by trigger, territory and responsible owner. This UK-wide framework links common seller operations to applicable rule areas, owners and evidence to review. It covers England, Wales, Scotland and Northern Ireland; where rules differ by territory, it identifies the distinction, including product safety and disability-discrimination law. It is a scoped map, not an exhaustive catalogue or advice on a particular product or contract.
What to take away
- Marketplace acceptance does not transfer every responsibility to the platform or tool.
- The factual trigger decides which gate opens, not a category label or badge.
- Great Britain and Northern Ireland product safety rules differ, and product-specific rules may apply.
- The Data (Use and Access) Act provisions on data protection and PECR are now in force.
- For every gate, save actor, territory, trigger, source version, reviewer, evidence and recheck date.
Start with current rules, not category labels
Map software features by the event they handle, not by category: a listing claim or invitation to purchase opens an unfair-commercial-practices review under the Digital Markets, Competition and Consumers Act 2024; an order or checkout brings distance-selling information and cancellation duties under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013; making, importing, distributing or selling goods opens product-safety and traceability checks; a sale or marketplace-facilitated transaction needs a VAT-treatment and records check; processing personal data or accessing device storage brings UK GDPR and PECR review; and a public-facing service needs an accessibility review. Assign an owner for each trigger and territory. The UK rules and compliance guide maps these triggers to owners.
| Area | Territory and status | Trigger and owner |
|---|---|---|
| Unfair commercial practices | UK regime under the Digital Markets, Competition and Consumers Act 2024 | A trader's practice affecting a consumer; consumer lawyer |
| Online and distance selling | UK guidance for goods sold at a distance | Consumer sale and order journey; seller and consumer counsel |
| Product safety | Great Britain and Northern Ireland rules differ | Making, importing, distributing or selling a product; safety counsel |
| Data protection and PECR | UK; Data (Use and Access) Act provisions in force | Personal-data processing or device storage and access; privacy adviser |
| Equality Act services | Equality Act 2010 | Service offered to the public; accessibility lawyer |
Marketplace acceptance does not transfer every responsibility to the platform or tool. The seller still owns its own conduct, so each row needs a named owner before the software goes live.
Unfair commercial practices and consumer sales
The CMA publishes unfair commercial practices guidance on business conduct that the law on unfair business-to-consumer trading prohibits under the Digital Markets, Competition and Consumers Act 2024. It covers trader conduct rather than certifying a software configuration. A consumer lawyer must assess the actual seller, communication and transactional decision.
Distance sales have their own information duties. For goods, tell the customer about the right to cancel and provide the required cancellation information and model cancellation form; the usual period ends 14 days after the customer, or their nominated recipient, takes physical possession. If the trader omits the required information, the period can extend until 12 months after the end of the original cancellation period; if the information is supplied within that extension, it ends 14 days after the customer receives it. Software generating order confirmations should support the required information and preserve it on a durable medium where the Regulations require.
The source is the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. Under regulation 29 the consumer may cancel a distance contract in the cancellation period without giving any reason. Under regulation 30, for a sales contract the period ends 14 days after the goods come into the consumer's physical possession.
Keep placed, authorised, captured, fulfilled, cancelled, returned, refunded, disputed and settled states separate. Store evidence for the exact offer and product. For marketing communications within the ASA's remit, the CAP Code (UK Code of Non-broadcast Advertising and Direct & Promotional Marketing) is a relevant code; use the marketplace seller software advertising rules checklist to check claims in listings.
Returns and quality of goods
The Consumer Rights Act 2015 treats every contract to supply goods as including a term that the quality of the goods is satisfactory.
A returns workflow must separate a change-of-mind cancellation under the 2013 Regulations from a quality complaint under the 2015 Act. Each has its own trigger and evidence.
| Journey stage | Rule to map | Evidence to save |
|---|---|---|
| Listing | Unfair commercial practices guidance | Approved copy and claim source |
| Order | Consumer Contracts Regulations 2013 | Cancellation wording shown |
| Fulfilment | General Product Safety Regulations 2005 | Supplier and batch record |
| Returns | Consumer Rights Act 2015 and the 2013 Regulations | Reason code and date |
| Data | UK GDPR and PECR | Lawful basis and consent record |
Product safety across Great Britain and Northern Ireland
If you make, import, distribute or sell consumer products in the UK, you are responsible for making sure they are safe for consumers to use and for following the legal requirements on labelling. OPSS product safety advice sets out the duty. A hosted listing is not safety approval.
The General Product Safety Regulations 2005 require all products to be safe in their normal or reasonably foreseeable usage.
From 13 December 2024, Regulation (EU) 2023/988 on general product safety applies in Northern Ireland, while Great Britain keeps its own regime. Where there is crossover, the product-specific legislation usually takes precedence. A seller who ships to both territories must keep the two rule sets apart.
Sellers need to keep records identifying the suppliers of the products they sell, so that origins can be traced. Software that stores supplier and batch data should make that export simple.
Data protection, PECR and device storage
All the provisions affecting data protection law and the Privacy and Electronic Communications Regulations under the Data (Use and Access) Act 2025 are now in force.
The guidance on storage and access technologies was finalised on 29 April 2026. Some other ICO pages remain under review, so record both facts and do not call an under-review page repealed.
Under the UK GDPR you must have a valid lawful basis to handle personal information. Seller software often sets cookies or scripts and processes customer data. The exact technology, purpose and exception or consent analysis need privacy and PECR review. Use the data protection checklist to map each data flow to a lawful basis.
Accessibility and VAT
In Great Britain, the Equality Act 2010 prohibits discrimination in services (section 29) and applies a reasonable-adjustment duty (section 20). The Equality and Human Rights Commission's Services, public functions and associations: statutory code of practice gives guidance on those duties. Northern Ireland has a separate framework under the Disability Discrimination Act 1995; consult the Equality Commission for Northern Ireland's guidance. For seller software, test customer-facing checkout and messaging for barriers and assign an accessibility owner; assess the actual service and circumstances rather than assuming one technical standard answers every case.
UK VAT records and treatment sit within the Value Added Tax Act 1994 and the Value Added Tax Regulations 1995. HMRC's VAT Notice 700/21, Keeping VAT records, explains the records VAT-registered businesses must keep, including a VAT account and supporting records for VAT returns. The transaction gate should distinguish the seller's own supply from cases where an online marketplace is treated as the supplier under the marketplace VAT rules; assess the seller, goods and transaction, and have an accountant confirm the treatment. HMRC's VAT and overseas goods sold to customers in the UK using online marketplaces guidance addresses those marketplace cases. The guide for VAT-registered UK sellers shows how to test software against HMRC record rules. Add a VAT owner to every gate that handles invoices.
End with a scoped decision
For every gate, save actor, territory, trigger, source version, reviewer, evidence and recheck date. Hold if any field is missing. Re-open legislation and guidance before publication, because commencement, regulator wording, marketplace terms and product facts can change.
Pass the finished map to your operations and delivery owner, and ask suppliers the same questions in vendor due diligence.
Before you act
- Identify the factual trigger before opening any gate.
- Store evidence for the exact offer and product.
- Keep order states separate from placed to settled.
- Record both in-force and under-review guidance facts.
- Hold if any required field is missing.
- Re-open legislation and guidance before publication.
Common questions
Does marketplace acceptance transfer responsibility to the platform?
No. Marketplace acceptance does not transfer every responsibility to the platform or tool. The factual trigger decides which gate opens, and an invitation to purchase, an optional charge, an advertisement or a consumer order are different triggers with different owners.
What must the product-safety owner identify?
Whether the seller makes, imports, distributes or sells the product, plus traceability and corrective-action evidence. Great Britain and Northern Ireland differ, and product-specific legislation usually takes precedence over the general regime. A hosted listing is not safety approval.
What should be saved for every gate?
Actor, territory, trigger, source version, reviewer, evidence and recheck date. Hold if any field is missing. Re-open legislation and guidance before publication, because commencement, regulator wording, marketplace terms and product facts can change.
