Why professional services marketing data protection shapes every campaign

What to take away

The ICO's 2023/24 annual report recorded 15,600 data protection complaints, a historical figure that shows how visible poor practice becomes.
Consent for electronic marketing sits with PECR, enforced by the ICO, and soft opt-in only covers existing customers.
B2B marketing is not exemptCAP rules apply to business-facing advertising, and professional services are judged on accuracy as well as consent.
A written lawful basis for each list, channel and campaign is the minimum defence if a complaint arrives.

Why PECR and UK GDPR make data protection a marketing issue

Data protection is often treated as an IT problem. In professional services it is a marketing problem: every bought list, scraped address and recycled enquiry is a decision a regulator can examine.

The ICO publishes PECR training videos for teams that handle marketing compliance. Solicitors and accountants sell trust. A complaint about nuisance emails undermines the same trust the firm charges for.

Which bodies oversee which claims is set out in our guide to professional services marketing UK rules and ethics.

PECR and UK GDPR rules that catch professional firms

PECR governs electronic marketing in England, Scotland, Wales and Northern Ireland. It requires consent for emails and texts to individuals, with a limited soft opt-in for people who already bought from you. Consent must be specific, informed and recorded.

PECR: Individual vs Corporate Subscriber

Individual

Consent needed: Yes, specific
Soft opt-in: Existing buyers
Sole traders: Count as individuals
Partnerships: Some count as individuals

Corporate subscriber

Consent needed: Different treatment
Soft opt-in: Not applicable
Sole traders: Not corporate
Partnerships: Not always corporate

Corporate subscribers are treated differently, but sole traders and some partnerships count as individuals. That distinction catches firms that assume a business address is always fair game.

CAP rules on advertising apply to business-to-business campaigns. The Advertising Standards Authority's advice for businesses explains the standards that apply, and professional firms should read it before signing off any claim about success rates or expertise.

Paid search adds another layer. Google's guide to Google Ads sets out how the platform works, including requirements that can restrict advertising in regulated sectors.

Consent records that survive scrutiny

A consent record should show who opted in, when, through which form, and what wording they saw. If your CRM cannot store that, fix it before the next campaign.

What to do when a complaint arrives

Stop the campaign, preserve the records, and answer the regulator honestly. Deleting a list mid-investigation makes a bad position worse.

What the UK GDPR adds for lead data

UK GDPR requires a lawful basis for processing enquiry data. Legitimate interests can cover some follow-up, but it needs a documented balancing test. You cannot rely on it to justify cold email where PECR requires consent.

Data must be kept only as long as needed. A firm holding dormant enquiry data for a decade without review is exposed.

Individuals have rights of access, erasure and objection. Marketing teams need a route to honour those requests quickly, as the statutory clock keeps running.

Our companion piece on professional services marketing advertising rules covers the claims side in more detail.

A data protection checklist for campaigns

Confirm the lawful basis for every list before it is used.
Record consent wording, for example 'We would like to email you about [service] and related updates. You can unsubscribe at any time.', plus source and timestamp for each contact.
Check whether each recipient is an individual or a corporate subscriber.
Include an unsubscribe route in every electronic message.
Keep a suppression list and apply it across all channels.
Set a retention period for each list, for example 24 months from the last engagement, and delete on schedule.
Brief anyone writing copy on CAP accuracy requirements.
Log complaints and the action taken in response.

Common questions

Does PECR apply to B2B marketing?

It applies to some business contacts. Sole traders and non-limited partnerships are treated as individuals, so consent rules apply to them. Limited companies and limited liability partnerships are corporate subscribers, where the rules are less strict.

Can we email past clients without fresh consent?

The soft opt-in can cover similar services for people who bought from you, provided you offered an opt-out when collecting details and in every message. Keep the original collection records to show that.

Who enforces marketing data protection in the UK?

The Information Commissioner's Office enforces PECR and UK GDPR. The Advertising Standards Authority handles advertising claims separately. Both can act on a single complaint.

What happens if a firm gets it wrong?

The ICO can issue reprimands, enforcement notices and monetary penalties. The commercial damage from a complaint often exceeds the fine. Individual cases need a qualified adviser.

Under UK GDPR, the ICO can fine up to £17.5 million or 4 per cent of annual global turnover, whichever is higher. For PECR breaches, the maximum fine is £500,000.

This article is general guidance on the law in England and does not replace advice on your own circumstances.