What a B2B demand generation disclosure policy means for lead data

What to take away

A disclosure policy is the written record of what you tell people about how you collect, enrich and use their data, and it has to match what you actually do.
The UK GDPR and Data Protection Act 2018 apply across the UK, so identify and document a lawful basis for each processing purpose.
PECR rules for marketing emails, texts and calls depend in part on whether the recipient is an individual or a corporate subscriber.
Agree data-sharing terms before data moves, and check the ICO’s Data sharing code of practice.
The CAP Code applies to B2B advertising, so substantiate claims and make disclosures accurately.
Write the policy before you buy intent data, not after a client asks for it.

Start with the lawful basis

A disclosure policy is not a privacy notice with a new title. It is the internal rule that says which lawful basis covers each demand generation activity and what privacy information people receive when their details are collected or obtained from another source.

Pick one lawful basis per activity

Which basis covers this demand generation activity?

Yes

Legitimate interests -> document it and notice the person

Consent -> record it and honour withdrawal

For processing personal data, determine a lawful basis for each purpose. Legitimate interests or consent may be relevant, but they are not the only available bases. Record your reasoning before a campaign starts; if the purpose changes, reassess the basis and update the information given to people. If relying on legitimate interests, complete and keep a legitimate interests assessment.

Check PECR before contacting a lead

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) govern direct marketing by electronic mail, text and telephone. For email and text, unsolicited marketing to corporate subscribers can generally be sent without prior consent, but the sender must not hide its identity and must provide a valid way to opt out. Individual subscribers, including sole traders and some partnerships, generally need consent unless the soft opt-in applies.

The soft opt-in is limited: the contact details must have been collected directly during a sale or negotiations for a sale, the marketing must concern the sender’s own similar products or services, and the person must have had a chance to refuse at collection and in each message. For live marketing calls, check the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS), as well as your own objections; automated marketing calls require consent. Use the ICO’s Direct Marketing guidance when setting these rules.

The UK GDPR applies across the UK, and the Data Protection Act 2018 supplements it with UK-specific provisions. Under UK GDPR Article 6(1), the lawful bases are consent; performance of a contract or steps requested before entering one; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest or exercise of official authority; and legitimate interests. Your policy should state which basis applies to each purpose and record the reasoning behind it.

Cover data sharing and enrichment

Third-party intent data, list rentals and enrichment tools can involve sharing personal data. The ICO’s Data sharing code of practice helps organisations assess what is shared, who is responsible and what individuals were told. Record those answers before using a source.

What the policy must name

Each supplier category
The data fields involved
The retention period
Who signs off a new source

A workable policy names each supplier category, the data fields involved and the retention approach. It also states who signs off a new source. Without that, sales teams add tools faster than legal can review them.

If a supplier processes personal data on your behalf, set out the required controller-and-processor terms in a written data processing agreement under UK GDPR Article 28. Record the parties’ roles and responsibilities for other sharing arrangements too, so the policy accurately describes who decides how the data is used.

If you want the wider picture before drafting clauses, the B2B demand generation: UK rules and compliance guide maps the regulators and the areas they cover.

Check the advertising side

Disclosure is not only about personal data. The CAP Code covers B2B advertising, and the ASA administers and enforces it. The ASA can require ads that breach the Code to be amended or withdrawn, so claims and disclosures need to be accurate.

That matters for demand generation because performance claims are common. If your policy says you only publish verified results, the ad copy has to follow the same rule. A disclosure policy that only covers data leaves half the risk unmanaged.

Use a decision table

Choose

Buying a contact list: Documented legitimate interests assessment and a notice sent before first contact
Running intent data through a CRM: Written sharing terms with the provider and a named controller
Publishing a client result: Figures the client has approved in writing
Retargeting known contacts: Consent or legitimate interests recorded at source
Using a new AI enrichment tool: Adding it to the policy and reviewing the supplier

Avoid

Buying a contact list: Assuming a purchased list is automatically compliant
Running intent data through a CRM: Letting each sales rep sign up separately
Publishing a client result: Rounded numbers presented as typical
Retargeting known contacts: Retargeting people who opted out of marketing
Using a new AI enrichment tool: Pasting data in before the review finishes

Keep records and review dates

A policy only holds up if you can show it was followed. Keep the assessment, the notice version and the supplier terms for each source. The UK GDPR does not set one standard retention period for marketing leads, so define and justify a period that fits the purpose. For example, retain active prospect records while a documented business purpose remains, review inactive records against a defined trigger, and then erase or anonymise them; keep only the information needed to respect objections.

Check whether your organisation must register with the ICO and pay the data protection fee; some organisations are exempt. Record the outcome of that check and review it if your circumstances change.

Give one person ownership. In smaller teams that is often the ops lead, with legal or an external adviser signing off changes. UK-wide data protection rules apply across England, Scotland, Wales and Northern Ireland, so do not treat them as England-only.

The B2B demand generation UK regulations guide covers how the regulators divide responsibilities, which helps when you assign ownership across sales and marketing.

This is general guidance, not legal advice. Individual campaigns and contracts need a qualified adviser.

Common questions

Does a B2B disclosure policy need consent for every contact?

No. Consent is one lawful basis among several, and legitimate interests can apply to some B2B outreach. What matters is that you record the basis you relied on and tell the person what you will do with their data.

How often should the policy be reviewed?

At least annually, plus whenever you add a data source, tool or advertising channel. A short review log showing the date and the person responsible is enough for most teams.

Does the CAP Code apply to B2B advertising?

Yes. The CAP Code covers business-to-business ads as well as consumer ones, and the ASA can apply sanctions where a claim cannot be substantiated.

What happens if a supplier will not sign sharing terms?

Treat it as a stop signal. If the roles and responsibilities are unclear, you cannot describe the arrangement accurately in your policy, and the risk sits with your business.