01 / Understand the source
Review how information was collected and what people were told about its intended use.
RESPONSIBLE MARKETING
Trust starts
before contact.
A clear view of the source, the intended use and the customer’s expectations is part of a well-planned campaign.
Ask for the evidence.
Agree the process.
Build responsible data use into every stage, from profiling and enrichment to sourcing and activation. Agree the evidence and responsibilities for the proposed activity before the campaign begins.
02 / Assess the proposed contact
Consider the channel, lawful basis and any consent requirements under UK GDPR and PECR.
03 / Respect preferences
Agree applicable suppression and screening checks, and how objections and opt-outs will be honoured.
04 / Keep responsibilities clear
Document the handover, permitted use, retention and responsibilities of each party.
Different activities.
Specific responsibilities.
Use the campaign brief to make the intended processing and contact plan explicit.
Profiling and enrichment
Make the purpose clear, establish a lawful basis and explain how additional information or inferred characteristics will be used. Assess fairness, accuracy and privacy risks, including whether a data protection impact assessment is required.
B2B and B2C contact
A business audience is not a single permission category. UK GDPR applies where business contact details are personal data. PECR requirements depend on the channel and subscriber type; sole traders and some partnerships are treated as individual subscribers.
Permissions and preferences
Agree channel-specific consent requirements and evidence, relevant TPS or CTPS checks for calls, and how suppression lists, withdrawals and objections will flow between the parties. Legitimate interests does not replace consent where PECR requires it.
Delivery and ongoing use
Set out permitted uses, access, transfer arrangements, retention and deletion responsibilities. A score, enrichment match or supplied record does not authorise a new contact channel. Review changes to the campaign before extending its use.
Compliance is campaign-specific.
Buying data does not automatically make its proposed use compliant. Your organisation must assess its own marketing activity and responsibilities.
This page describes an approach, not a certification or legal advice. For current requirements, see the ICO’s direct marketing guidance.
Prototype review note: confirm current processes and company disclosures before public launch. No unverified accreditation or regulatory status is claimed here.
LET’S FIND YOUR NEXT CUSTOMER