Legalities around Data and Marketing Communications

If you’re scaling a UK small business and want to keep customers coming back, you can’t ignore the legalities around data and marketing communications. One misstep could land you in hot water with regulators—or lose customer trust for good. This guide breaks down the real UK rules, from GDPR to PECR, and shows you exactly how to collect, store, and use customer data for marketing without falling foul of the law. Whether you’re emailing, texting, or running loyalty schemes, you’ll learn what’s allowed, what’s risky, and how to put compliance at the heart of your customer retention strategy.

For UK small businesses, building loyal customer relationships is often about smart, targeted communications. But every text, email, or call to a customer is governed by strict UK laws. The General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) set out what’s allowed—and hefty fines await those who get it wrong. In 2023 alone, the ICO issued millions of pounds in penalties for unlawful marketing, and even small firms are not exempt.

Beyond fines, there’s the reputational hit. Customers are savvy: a single breach or unsolicited campaign can undermine years of trust and damage your brand. Worse, negative publicity can go viral, especially if customers take to social media. That’s why compliance isn’t just a box-ticking exercise—it’s a real business risk and opportunity.

Understanding the legal landscape helps you design marketing strategies that are both effective and ethical. It also gives you the confidence to innovate, knowing you’re not putting your business—or your customers—at risk. Let’s unpack exactly what you need to consider.

When dealing with customer data and marketing, three key UK laws come into play. The GDPR (as retained in UK law post-Brexit) sets the gold standard for data protection and consent. The Data Protection Act 2018 tailors GDPR for the UK context. Meanwhile, PECR is the unsung hero—or villain—of marketing communications, with specific rules for emails, texts, calls, and cookies.

GDPR covers any personal data—think names, emails, addresses, purchase history, even IP addresses—that can identify an individual. It demands transparency, lawfulness, and accountability in how you collect, store, and use data. For marketing, this means you must have a lawful basis (often, but not always, consent).

PECR comes into play whenever you send electronic marketing: emails, texts, automated calls, and cookies. It’s stricter than GDPR in some ways, especially for unsolicited messages. Even if you have customer data, you can’t just start emailing—PECR adds extra hoops.

Consent is the cornerstone of lawful marketing under both GDPR and PECR. But not all consent is created equal. UK law requires that consent for marketing must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, silence, or inactivity don’t count. You must give people a real choice, and make it just as easy to withdraw consent as to give it.

For most direct marketing—especially by email, text, or automated call—you need explicit, opt-in consent. There’s one main exception: the 'soft opt-in.' This lets you market similar products or services to existing customers, but only if you collected their details during a sale (or negotiation for a sale), gave them a chance to opt out at the time, and offer an opt-out in every future message.

Recording consent is just as important as obtaining it. You need to keep clear records of who consented, when, how, and to what. If someone challenges you or complains to the ICO, you’ll need this evidence.

• Consent must be given by a clear, affirmative action (ticking a box, clicking 'I agree', etc.).
• No pre-ticked boxes or default opt-ins.
• Separate consent for different marketing channels (email, SMS, post) is best practice.
• Always provide an easy opt-out in every marketing message.

Collecting customer data for marketing isn’t just about a sign-up form. Under GDPR, you must only collect data that is necessary, adequate, and relevant for your stated purpose. You can’t ask for a customer’s date of birth if you don’t need it. Your privacy notice must clearly set out how you’ll use their data, who you’ll share it with, and how long you’ll keep it.

Once you have the data, storage matters. The law expects you to keep data secure, accurate, and up to date. This means using secure servers, limiting access to only those who need it, and having processes for regular data reviews and deletion. If you use cloud services, check where data is stored—transfers outside the UK (especially to the US or elsewhere) need extra safeguards under UK GDPR rules.

Processing includes anything you do with the data—sending emails, profiling for loyalty schemes, or analysing buying habits. Every use must have a lawful basis, and you must be able to justify it if challenged. If you want to use data for new purposes (say, a new marketing campaign), you may need fresh consent.

The rules get stricter when it comes to the channel you use. For email and SMS marketing to individuals (B2C), PECR requires prior consent—unless you’re using the soft opt-in for existing customers, and even then, you must offer a clear opt-out every time. For business contacts (B2B), rules are a bit more relaxed, but you still need to offer an opt-out and comply with data protection principles.

For live sales calls, you don’t always need prior consent, but you must not call anyone who has registered with the Telephone Preference Service (TPS) or who has told you not to call. Automated calls, however, always require explicit opt-in consent. If you use telemarketing agencies, you’re still responsible for compliance—they act as your data processor, but you are the data controller.

Every marketing message—email, text, or call—must identify your business and provide an easy, free way to opt out. For emails, this usually means an unsubscribe link. For texts, a STOP reply. For calls, a verbal option. Never hide your identity or spoof numbers; it’s illegal and a red flag for the ICO.

• Email/SMS to individuals: consent required unless soft opt-in applies.
• B2B marketing: opt-out must be provided, and data protection still applies.
• Live sales calls: do not call numbers on the TPS or anyone who has opted out.
• Automated calls: always require explicit consent.

If your business uses website analytics, tracking pixels, or runs personalised ads, PECR and GDPR both apply. Any non-essential cookies (including those for analytics, advertising, or social media) require prior, informed consent. That means a clear cookie banner—no default opt-ins, no confusing settings. You can’t set these cookies until the user agrees.

Profiling—using data to predict behaviour or segment customers—requires transparency and, in some cases, consent. If your profiling has a significant impact on individuals (like credit checks or eligibility for offers), you must inform them and offer a way to object. Using third-party marketing tools (like Facebook Pixel, Google Analytics, or email automation software) doesn’t absolve you of responsibility: you need Data Processing Agreements and must check their compliance.

The ICO has cracked down on non-compliant cookie banners and unlawful profiling. If you use these tools as part of your retention or remarketing strategy, review your processes regularly and update your privacy notice to reflect all tracking and profiling activities.

• Always obtain consent for non-essential cookies before setting them.
• Explain clearly what each cookie does and who sets it.
• Give users a real choice (accept, reject, or customise cookies).
• Review third-party marketing tools’ data practices for GDPR compliance.

UK customers have powerful rights under GDPR and the Data Protection Act 2018. They can ask you what data you hold (Subject Access Request), demand corrections, request deletion (the 'right to be forgotten'), or object to any direct marketing. You must act promptly, usually within one month, and never charge for these requests in most cases.

If a customer objects to marketing, you must stop immediately—regardless of how or when they gave consent. Keeping records of opt-outs is just as important as keeping records of opt-ins. If you use multiple systems or platforms, ensure opt-outs sync across all of them.

Responding to data requests isn’t optional. If you ignore or delay, customers can complain to the ICO, leading to investigations and possible penalties. Document your processes for handling requests and train your staff to spot and escalate them quickly.

Outsourcing—whether to a marketing agency, CRM provider, or cloud platform—doesn’t remove your legal responsibilities. Under UK GDPR, you are the 'data controller,' and anyone processing data on your behalf is a 'data processor.' You must have a written Data Processing Agreement (DPA) that sets out security, confidentiality, and the processor’s obligations.

If your provider is outside the UK (for example, using US-based marketing software), you must ensure appropriate safeguards are in place. This may mean using Standard Contractual Clauses or checking for an 'adequacy decision' from the UK government. The rules are strict and change often—always check latest ICO guidance.

Never share or sell customer data to third parties for their own marketing unless you have explicit, informed consent. Even sharing data within your own group of companies for marketing purposes can require new consent, depending on how data was originally collected.

• Always have a Data Processing Agreement with any third party handling customer data.
• Check where your data is physically stored—UK, EEA, or elsewhere.
• If using cloud services, ensure encryption and robust access controls.
• Never share data for third-party marketing without explicit consent.

Many UK small businesses fall foul of the law through simple mistakes. One common error is assuming the rules don’t apply to small firms or B2B marketing—both are myths. Another is failing to keep clear records of consent or not syncing opt-outs across all platforms. Using bought-in marketing lists is especially risky: if the list isn’t fully compliant, you’re liable for any breaches.

Outdated privacy notices, poorly configured cookie banners, and sloppy data hygiene (e.g. keeping old customer data for too long) are all red flags for the ICO. Staff training is another weak point; everyone who handles customer data or marketing must know the basics of compliance.

Finally, don’t underestimate the impact of a single complaint. The ICO can investigate on the basis of one unhappy customer, and penalties are often publicised. Prevention—through regular audits, updated policies, and a culture of compliance—is always cheaper than cure.

Getting compliance right isn’t about ticking boxes—it’s about embedding legal and ethical practices into every stage of your customer marketing. Regularly review your processes, update your privacy notices, and make compliance a team responsibility. Here’s a practical step-by-step to get you on track.

The ICO (Information Commissioner’s Office) is the UK’s official regulator for data and marketing law. Their website (ico.org.uk) has practical guides, checklists, model privacy notices, and case studies tailored for small businesses. ACAS offers guidance on data and employment issues. The Federation of Small Businesses (FSB) and local Chambers of Commerce can provide further advice and training.

If you’re unsure about a specific campaign or technology, consider a legal health check with a data protection adviser or solicitor. Many insurers now offer cyber and data protection cover, including legal support in case of a breach or ICO investigation. Don’t wait for a problem—proactive advice is almost always cheaper than cleaning up after the fact.