Professional services marketing: data and consent checks

What to take away

A solicitor in Leeds posting a client win on LinkedIn without consent risks breaching both the SRA Code and UK GDPR, even though the post is not a formal advertisement.
The CAP Code covers most online ads seen in England, including B2B LinkedIn campaigns, and the ASA's published rulings set precedents on claims about competence and results.
Subject access requests from clients or prospects must be answered within one month, and marketing data often sits inside the response.
A single complaint can reach more than one regulator, because the SRA, ICO and ASA each enforce their own rules.
A claim that passes the CAP Code can still breach your sector regulator, so check both layers before publishing.
This is general guidance only. Individual cases need a qualified adviser.

Where the rules come from

Advertising rules and data-protection duties can apply to the same campaign. Identify the type of communication, the people it reaches and the personal data involved before deciding which checks to make.

The CAP Code and the ASA

The CAP Code applies across the UK to non-broadcast marketing communications within its scope and is administered by the Advertising Standards Authority (ASA). It covers many LinkedIn ads, Google search ads, sponsored newsletters and marketing claims on firms' own websites; the audience or channel does not by itself take an ad outside the Code.

CAP Code vs sector regulators

CAP Code / ASA

Who enforces: ASA
Covers: Ads and website copy
Key test: Not misleading
Check before: Publishing

Sector regulator

Who enforces: SRA, FCA, ICAEW
Covers: Publicity and promotions
Key test: Accurate, not misleading
Check before: Publishing

The ASA publishes rulings on advertising complaints on claims about professional competence, pricing and comparative statements. Read several before writing a campaign: precedents matter more than the Code's wording alone.

Sector regulators sit on top

For law firms, the SRA Standards and Regulations require publicity to be accurate and not misleading. Accountants face FCA and ICAEW rules on financial promotions.

If unsure which regime covers a channel, the professional services marketing rules and ethics guide maps five main regulators to the channels they cover.

Data and consent in campaigns

Data-protection duties sit alongside advertising rules. For each campaign, decide what personal data is used, why it is needed, how it will be held and who will respond to rights requests.

Subject access requests

Under UK GDPR Article 15, an individual can request access to their personal data. Article 12(3) sets a one-month response period from receipt; the request may cover CRM notes, email opens, event attendance and any scoring applied to the record.

Subject access request clock

Day 0
Prospect submits subject access request
Day 0-30
Compile CRM notes, email opens, event attendance, scoring
Day 30
Deadline to answer the request

The ICO's Guide to Data Protection, under 'Right of access', explains the general right. Its guidance on subject access requests also covers exemptions and the response clock. Marketing teams should involve the people who handle CRM data, not leave the request solely to the legal team.

Model SAR reply: 'We confirm we hold your personal data. We enclose the CRM notes, email open records and event attendance linked to your address. Tell us if anything is wrong.'

Consent and lawful basis

For email marketing to individuals, the Privacy and Electronic Communications Regulations 2003 (PECR) generally require consent unless the existing-customer soft opt-in applies. That exception is limited to similar services where the contact details were collected during a sale or negotiations for a sale, and an opt-out was offered both when the details were collected and in each message. Sole traders and some partnerships are treated as individual subscribers; where B2B contact details are personal data, legitimate interests may be a UK GDPR basis, but document the assessment and respect objections.

LinkedIn's advertising tools do not determine your lawful basis. Keep evidence of consent or the legitimate-interests assessment, and record opt-outs and objections so the campaign list can be updated.

Model consent record: contact name, lawful basis, source, date captured and the evidence used, such as the opt-in wording or balancing test.

A worked checklist and example

Identify every regulator that touches the campaign: ASA, SRA, FCA or ICO.
Check the claim against CAP Code rule 3.1 (Misleading advertising) and at least three ASA rulings in your sector.
Confirm a lawful basis for every contact on the list.
Record the basis, date and source for each record.
Draft the subject access request process before you need it.
Brief the fee earners who post from their own accounts.
Diarise a quarterly review of the campaign.

A five-partner Manchester law firm spends £2,400 a month on LinkedIn ads targeting in-house counsel. One ad claims a 95% success rate in employment tribunals; before publication, the firm should hold evidence that supports the claim and explains what cases and period it covers.

If the firm cannot substantiate the rate, it should remove it rather than present an unverified result as fact. It can instead describe the types of cases handled, taking care that the description remains accurate.

Separately, a prospect submits a subject access request. The CRM export takes two days to compile within the one-month response period, so the firm needs a documented process to avoid missing the deadline and risking an ICO complaint.

Keeping records

Store the claim, evidence and approval together. UK GDPR Article 5(1)(e) requires personal data to be kept no longer than necessary for the purposes for which it is processed; set and review a retention schedule accordingly. Professional services marketing data protection covers records worth keeping; review the file when the campaign ends, not when a complaint arrives.

Common questions

Does the CAP Code apply to B2B LinkedIn ads?

Yes, in most cases. The CAP Code covers marketing communications addressed to businesses as well as consumers, and a B2B audience or LinkedIn placement does not by itself exempt an ad.

How long do we have to answer a subject access request?

One month from receipt under UK GDPR. You can extend by two further months for complex requests, but you must tell the requester within the first month.

Can we publish a client win without written consent?

Not safely. A client's identity and matter details can be confidential and identifiable personal data. Get the client's permission before using an identifiable case study, or anonymise it, and make sure any description remains accurate and not misleading.

Who enforces the rules for law firms?

The SRA oversees professional standards for solicitors in England and Wales, the ASA administers the CAP Code and the ICO oversees data protection. A campaign can engage all three.