UK compliance for marketplace sellers, from the factual trigger to the device map

Marketplace seller software sits inside a trading arrangement; it does not replace it. For this guide, the operating case is one merchant established in England, one authorised seller legal entity, one named marketplace account, one defined software service and a bounded journey from approved product record to stock, order, payment and later customer states.

The seller, marketplace operator, software supplier, managed provider, advertiser, payment or fulfilment party and consumer may have different legal and contractual positions. A marketplace acceptance or successful configuration does not prove that the seller has met a duty, that a claim is supported or that another party has assumed responsibility.

This desk guide was researched on 6 September 2026. It gives operational questions, not advice on a particular case. The named specialists in the frontmatter must check the actual goods, parties, communications, data flows, territory and contracts before publication or use.

Fix the territory and factual trigger

Start with where the seller is established, where the consumer is, where goods are located and supplied, and which marketplace contract governs the account. Record whether a product is offered in England, elsewhere in Great Britain, Northern Ireland or another country. Do not write "UK compliant" as a single status.

Product safety is a clear example. OPSS says its product-safety advice for businesses reflects different treatment in Great Britain and Northern Ireland, including the application of the EU General Product Safety Regulation in Northern Ireland from 13 December 2024. Product-specific rules may also take precedence. A qualified safety reviewer must identify the actor and regime for each product.

Record the event that engages each review: an invitation to purchase, optional charge, consumer order, advertising claim, customer review, product incident, cookie or other device operation, marketing message, return, refund, security incident or supplier exit. A generic tool category does not trigger every rule in the same way.

Map seller identity and the consumer journey

The seller's approved record should identify the contracting trader and contain the information required for the actual offer. GOV.UK's online-selling page covers ordering steps, seller contact information, product description, price, delivery, correction and contract confirmation. Its distance-selling page covers pre-contract information, cancellation and post-order records, with exceptions and separate cross-border considerations.

Turn that material into fields rather than a blanket conclusion. For every product population, record seller identity, description, total-price basis, delivery, payment, order correction, confirmation, cancellation, return, refund and support evidence. The consumer lawyer decides scope and exceptions.

Order and money states remain separate. Placed, authorised, captured, accepted, fulfilled, cancelled, returned, refunded, disputed and settled should never collapse into "sale". The software may report one state while the marketplace, payment provider and accounting ledger report others.

Check price and optional choices independently

The unfair-commercial-practice provisions in Part 4 of the Digital Markets, Competition and Consumers Act 2024 apply to commercial practices from 6 April 2025, according to the CMA's current CMA207 guidance. That guidance replaced and updated the earlier CPUTR framework for those practices and includes invitation-to-purchase, misleading-practice and banned-practice material.

The CMA's price-transparency guidance was published on 18 November 2025 and updated on 7 January 2026. Its stated subjects include mandatory charges and the practices described as drip pricing and partitioned pricing. GOV.UK separately explains that a business must obtain express consent for optional extras, rather than preselecting a charge.

Test the actual invitation, total displayed price, unavoidable charges, optional choice and resulting order evidence. Do not infer a lawful presentation from a correctly calculated back-office amount. Consumer and advertising review are separate non-compensating gates.

Keep advertising apart from the product record

An approved catalogue record may be used in editorial material, a seller's own marketing, paid marketplace promotion, affiliate content or a sponsored endorsement. Label the relationship and communication before applying a rule.

The CAP Code requires non-broadcast marketing communications to be recognisable as such in its recognition rules. CAP's Section 3 misleading-advertising advice says the overall impression and objective claims matter, while the advice itself states that it is not legal advice and does not bind the ASA or CAP panels.

Maintain a claim register with exact wording, product population, evidence owner, source date, permitted channel and expiry. Reviews and endorsements need their own evidence and relationship fields. A platform label may help a user recognise an ad, but it does not substantiate the product claim.

Preserve safety and traceability

Product identity, batch or model evidence, manufacturer or importer details, instructions, warnings and applicable conformity material belong with the approved product record. The software may transport those fields; a product-safety specialist decides whether they are accurate and sufficient.

OPSS updated its general business guidance on 21 July 2026. It says businesses must not sell consumer products they know, or should have known, are unsafe, and describes supplier traceability and corrective action. Current business notification guidance was updated on 13 February 2026 and distinguishes Great Britain and Northern Ireland markets.

Build an urgent route to identify affected listings, stop further publication, preserve the decision, notify the authorised owner and verify correction or withdrawal. Absence from an alert list is not evidence that a product is safe. A marketplace's willingness to host the listing is not regulatory approval.

Draw the personal-data and device map

List every personal-data flow by purpose, source, field, recipient, location, retention and deletion route. Orders, customer messages, return reasons, fraud flags, account-user logs and support records may involve different people and purposes. Record who decides why and how processing occurs; do not assign controller or processor labels from the contract heading alone.

The ICO's DUAA summary for organisations says all data-protection provisions of the 2025 Act were in force by 19 June 2026. Some linked detailed guidance remains under review. The ICO's controller-processor contract guidance is explicitly marked as under review after DUAA changes.

Treat device storage and access separately. On 29 April 2026, the ICO issued the final version of its storage and access technologies guidance. It addresses PECR and, where relevant, UK GDPR. A privacy and PECR adviser must classify each cookie, pixel, local-storage use or similar operation and its purpose before activation.

Control access, suppliers and incidents

Map human and service accounts, authentication, permissions, logs, support access and revocation. A managed provider's account needs its own authority. Do not share a marketplace owner credential because a supplier needs to investigate an error.

NCSC guidance for using SaaS securely covers privileged access, monitoring, protected copies and recovery exercises. It is security guidance, not law or certification. Test the exact configuration with synthetic or specifically authorised records.

Define the response to a data, account, product or payment incident. Preserve logs, restrict further harm, identify the decision owners and follow the applicable reporting route. ICO personal-data breach guidance is marked under review following the DUAA and therefore needs a live qualified check.

Test accessibility as a separate service question

The Equality Act 2010 applies across Great Britain, while Northern Ireland has different equality legislation. The government's service-provider quick-start guide describes anticipatory reasonable-adjustment duties under the Act. Exact application requires accessibility and legal review.

Test the seller's staff task and the consumer journey, including product information, price, optional choices, error correction, checkout, cancellation and support. Record technology, browser, assistive setup, task, result and barrier. A conformance statement or automated scan cannot prove that the whole journey works.

Reconcile VAT and contractual records

HMRC's VAT record guidance identifies supplies, time and value of supply, adjustments, invoices and credit or debit notes. Treatment depends on the seller, goods, location and transaction. An accountant and VAT adviser must map marketplace, payment and ledger events without treating the software state as a tax conclusion.

The commercial contract should name the entity and service, authority, scope, marketplace or interface dependencies, data roles, security, support, change, evidence, audit, correction, suspension, fees, VAT basis, liability review, insurance evidence, export, transition and deletion. These are due-diligence questions, not model clauses. Privacy, product, consumer and tax responsibilities cannot be assigned accurately without the factual activity and qualified review.

Keep a correction and disclosure record

For each public or consumer-facing statement, record whether it is seller-supplied product fact, verified independent evidence, advertising, a paid or sponsored relationship, platform-provided information or unresolved uncertainty. State material limits beside the claim. Keep price and charge evidence with the exact product and time.

Define who can correct a listing, withdraw a claim, pause an advert, suppress a product and notify operational teams. Preserve the old version, reason, approval and completion evidence. A disclaimer cannot repair a hidden charge, unsupported claim, missing safety evidence or unlawful data use.

Publication and release gate

Before publication, re-open the legislation and regulator records, check commencement and territorial scope, and assign named reviewers for every field in the frontmatter. Before production, verify the actual marketplace terms, interface permission, supplier edition and signed contracts.

The permitted outcomes are pass for a narrowly evidenced state, hold pending evidence or stop. This cluster remains on editorial hold. It does not certify software, a seller, a listing or a marketplace journey.