contract, agreement, signing a contract, document, signature, business deal, contract, contract, contract, contract, contract, agreement, signature, signature, signature, signature
Photo by Tumisu on Pixabay

Rules and ethics

Part of B2B demand generation rules and ethics without the guesswork

Check 7 clauses in B2B demand generation commercial contracts

Seven clauses to check in B2B demand generation commercial contracts, plus the ICO, ASA and DMA rule checks to raise before you brief a qualified adviser.

What to take away

  • Treat the contract as the place where compliance promises become enforceable, not as paperwork signed after the pitch.
  • Check seven areasscope and deliverables, data protection roles, advertising claims, subcontractors, IP and lists, liability, and termination with data return.
  • Ask which law applies, because consumer-style rules rarely fit B2B work and the CAP Code still shapes what agencies may promise.
  • Confirm who is controller and who is processor before any lead list changes hands. The ICO explains the Data (Use and Access) Act 2025 and what it changes for data use.
  • This is general guidance for England and the wider UK. Individual cases need a qualified adviser.

Which contracts does this apply to?

Apply these criteria: the agreement covers demand generation services bought or sold between businesses, such as lead generation, ABM programmes, paid media, content, marketing automation or outsourced SDR work. At least one party is established in England, or English law governs the contract. The counterparty is a business, not a consumer.

Does this guide apply?

B2B demand generation services?

Yes

Apply the seven-clause check

No

Different rules apply

If your arrangement is closer to employment or a software licence, different rules apply. The B2B demand generation rules and compliance guide maps the wider framework before you negotiate.

Ranking is not the point. Treat the list as a pre-signature check, not a scorecard.

Does the contract say what you are buying?

Vague scope causes most disputes. Name the channels, target segments, volume assumptions and reporting cadence in a schedule.

Scope schedule essentials

  • Name channels
  • Define target segments
  • State volume assumptions
  • Set reporting cadence
  • Define qualified lead
  • Add review mechanism
  • State data source and basis

Watch outcome language you cannot verify, such as a fixed number of qualified meetings. Pair every target with a definition of a qualified lead and a review mechanism.

If the supplier resells data or intent signals, the contract should say where that data comes from and on what basis it may be used.

Who is the controller and who is the processor?

Demand generation usually makes the client the controller and the agency the processor, but that flips when the agency uses its own lists or pursues its own purposes.

Set out roles, permitted purposes, retention periods and breach notification timelines in a data processing agreement. The DMA's responsible marketing guidance covers ethics and compliance expectations alongside the legal terms.

Where personal data moves outside the UK, name the transfer mechanism. Do not accept a blanket promise that the supplier will handle compliance.

Can you substantiate every advertising claim?

Written claims about performance, market position or results must be evidence-based. The ASA publishes the advertising codes that govern marketing claims, including business-to-business advertising.

Ask who approves copy and who holds the evidence file, and put that in the contract with a timescale for responding to challenges.

If the agency supplies case studies, confirm it has consent to name clients and publish figures.

What happens with subcontractors, IP and lists?

List every subcontractor that touches personal data or client systems, and require notice before new ones are added.

Decide who owns the creative, workflows, automation builds and any data enrichment, so assets stay portable on exit.

On lists, be explicit: opted-in contacts and CRM records should return in a usable format.

How do liability, indemnities and termination work?

Set a liability CAP and carve out items that should not be capped, such as data protection breaches caused by negligence.

Check indemnities. One that looks generous can be worthless if the CAP or notice period defeats it.

On termination, set notice periods, transition support and a deletion or return schedule. A short glossary helps here:

Liability, indemnities and termination

Controller
the party deciding why and how personal data is used.
Processor
the party acting on the controller's instructions.
DPA
data processing agreement.
Indemnity
a promise to cover another party's loss.

For England-specific duties behind these clauses, read the UK regulations in England overview.

Common questions

Do I need a data processing agreement for B2B lead generation?

Yes, in most cases where an agency processes personal data on your behalf. The agreement should set roles, purposes, retention and security measures.

Can an agency guarantee a number of sales meetings?

It can contract to a defined volume of meetings that meet agreed criteria. Guaranteeing revenue outcomes is a different promise.

Which law applies if the agency is based outside England?

The contract usually states the governing law. If it does not, take legal advice before signing, because enforcement and data transfer terms change.

How long should we keep campaign data?

Set a retention period tied to the purpose, and say who deletes what and when.

More in Rules and ethics