How to approach B2B demand generation data protection lawfully

The laws behind each check

Three sources of law sit behind the checks in this guide. UK GDPR and the Data Protection Act 2018 govern how personal data is collected and used, including the lawful basis and the data protection fee. The Privacy and Electronic Communications Regulations 2003 (PECR) govern the channels: electronic marketing, calls and cookies.

By channel, regulation 22 of PECR covers unsolicited marketing email and text, regulation 21 covers marketing calls and the TPS and CTPS registers, and regulation 6 covers cookies and similar technologies. The Information Commissioner's Office (ICO) regulates all of it and publishes guidance on direct marketing.

The mistakes below are mapped to these rules. When a step names a lawful basis, it comes from UK GDPR. When it names consent for email, calls or cookies, it comes from PECR.

Mistake: releasing a purchased list before checking its provenance

Using a purchased list before checking its provenance is the costliest mistake: a supplier's possession of records does not show that people were told about your campaign or that its permission route covers your use. Pause release until the source and intended processing have been checked.

Ask for the collection point, collection date, notice presented to people and the basis that supports the campaign use. Keep those details with the release decision. If the supplier cannot account for the origin or notice, hold the records out of the campaign until that gap has been resolved.

Mistake: using one email rule for every business address

The permission route depends partly on whether the recipient is a corporate or individual subscriber, not simply on the business tone of an email address. Corporate subscribers may receive marketing email without prior consent, but UK GDPR requirements, sender identification and a working opt-out still apply.

Sole traders and some partnerships are individual subscribers. Prior consent is generally needed to email them unless the soft opt-in applies. That exception is limited to details collected through a sale or sale negotiations, messages about your own similar products or services, and an opt-out offered when details are collected and in every message.

Record subscriber type during campaign setup, then apply the relevant permission and suppression checks before sending. Do not postpone that decision until the copy is ready. Include the checks in your UK channel choices, so the team knows which unsolicited communications the campaign will use.

Mistake: letting email approval stand in for channel approval

An email check does not clear calls or tracking. Telephone lists need screening against TPS and CTPS before each campaign. Do not call registered numbers or people who have objected unless they have specifically consented, and make sure handlers can apply the relevant suppression records before calls begin.

Cookies and similar tracking technologies need a separate decision. Obtain consent before storing or accessing information on a device unless the technology is strictly necessary to provide a service requested by the user. That exception does not cover non-essential advertising or analytics trackers, so assess those technologies independently.

Mistake: picking the lawful basis after the campaign is designed

Choose a lawful basis for the actual processing before campaign activity starts. A familiar basis or generic policy wording is not enough: record why the planned use is needed and proportionate, based on what the campaign will do with the data.

Consent may be suitable, while legitimate interests may fit only after considering and recording the purpose, necessity and balancing assessment. Keep that reasoning with clear notices about how the data will be used. Use UK rule checks to test the decision, and treat a disclosure policy as support for consistent notices, not a substitute for a lawful basis.

Enrichment is another use to assess: adding job titles, direct dials or personal email addresses needs a lawful basis, while special category data calls for an additional condition. Treat personal data and intent data as inputs to assess, rather than shortcuts around the campaign decision.

Mistake: assuming an agency or a transfer takes responsibility away

An agency label or a different UK location does not change the legal test by itself. Identify who controls the data and who acts on instructions, then assign the checks accordingly. The UK rules and compliance guide gives wider context, but each campaign still needs clear responsibility.

Name the controller before commissioning activity. An agency sending on a client's instructions is usually a processor, while the client remains responsible for the lawful basis. A controller should complete the ICO fee self-assessment and, unless exempt, pay the data protection fee and appear on the register of fee payers.

Before restricted personal data is transferred outside the UK, check whether adequacy regulations cover the destination. If they do not, use an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and complete a transfer risk assessment.

Do not assume every agency must appoint a data protection officer. That duty applies only in specific cases, including large-scale monitoring or special category data. Naming a data protection lead is sensible, but it is not a universal legal requirement; raise live campaign questions and complaints with a qualified adviser.

Mistake: allowing campaign evidence to drift between systems

Scattered records make it harder to show what was decided and when. Keep a campaign register covering the lawful basis, data categories, source, recipients, retention period, safeguards and review date. Assign a named owner to maintain it and make relevant records available to the people handling the campaign.

Use this release check before outreach:

Set a defensible retention period and delete records on schedule instead of keeping old lists without a reason. Review the register at least annually and when a supplier, platform or targeting approach changes. A delivery quality checklist can make checks repeatable, while a demand plan can connect them to campaign planning.

Complaints and subject access requests should prompt a review. Route requests to a named person because the usual statutory deadline for a subject access request is one month from receipt. Keep request history with the campaign assessment and other evidence so the team can locate it when needed.