How to write a professional services marketing claims, consent and retention policy

What to take away

A disclosure policy is a short rulebookprinciples first, then appendices for website, email, social media, events and paid search.
Name the rules you rely on, including CAP Code rule 3.1 on misleading claims and rule 3.7 on substantiation.
Fix a lawful basis, consent wording and retention period for each channel; PECR's soft opt-in covers existing clients.
The Digital Markets, Competition and Consumers Act 2024 is commenced in stages, so confirm which consumer duties are live.
Give the policy one owner, record sign-off for every claim, and diarise an annual review.

Policy skeleton: model clauses to copy

A workable policy runs to four or five pages. Put five clauses at the front.

Policy skeleton: model clauses

Scope. "This policy covers every marketing communication issued by the firm or on its behalf, including fee earners' personal LinkedIn posts and seminar slides."
Claims. "No claim goes live until the evidence in Appendix A is on file and the marketing lead has signed it off."
Consent. "We rely on legitimate interests for business email and on consent for consumer email. Records sit in the CRM."
Retention. "Marketing contact data is deleted 24 months after the last engagement, unless the contact becomes a client."
Review. "This policy is reviewed each January and before any new channel or consumer product launches."

CAP Code rules your policy must name

The Committee of Advertising Practice writes the UK advertising codes that the Advertising Standards Authority enforces. Since the 2011 remit extension they cover a firm's own website and social media, not only paid space.

Three provisions matter. Rule 3.1 bars communications that materially mislead. Rule 3.7 requires documentary evidence before publication for any objective claim. Rules 3.33 to 3.35 cover comparisons with identifiable competitors, which must be verifiable.

CAP code duties for marketing

Marketing must be legal, decent, honest, truthful
Substantiate all claims before publication
Comparisons with named competitors fair and verifiable
No unqualified best in the city claims
Record award name, giver and date
Keep evidence on file

For a routine that tests claims before publication, read professional services marketing advertising rules.

Retention periods and consent wording

Every channel needs a lawful basis. Business email usually rests on legitimate interests. Consumer email needs consent or PECR's soft opt-in, which covers existing customers and similar services when an opt-out appears at collection and in every message. The ICO's direct marketing guidance sets out the detail.

Wording a firm can adapt:

"We would like to send you our monthly employment law update. You can unsubscribe at any time. We keep your details for 24 months after our last contact. Our privacy notice explains your rights."

Keep a dated consent record for each contact, showing where and when it was captured.

Illustrative retention periods:

Retention periods

Enquiries that do not convert: delete after 12 months.
Marketing contacts: delete 24 months after last engagement.
Client and matter files: keep six years after closure.

Set these against your own limitation and regulatory duties, not against what the CRM defaults to. Review the list quarterly so deletions happen. Our guide to professional services marketing data protection explains the record-keeping that supports the schedule.

The 2024 consumer law position

The Digital Markets, Competition and Consumers Act 2024 gives the Competition and Markets Authority direct enforcement powers over consumer law breaches, with penalties up to 10% of global turnover or £300,000, whichever is higher.

The consumer provisions ban fake reviews, drip pricing and misleading urgency claims. They replace much of the Consumer Protection from Unfair Trading Regulations 2008 and keep the banned practices list.

Commencement is staged by statutory instrument. The government's plan put the unfair commercial practices rules from April 2025 and the subscription contract rules from April 2026. Check the Digital Markets, Competition and Consumers Act 2024 commencement regulations before each review.

If the firm sells a paid newsletter, a legal helpline or a fixed-fee consumer product, add clauses on renewal reminders, cooling-off and the total price shown before commitment, and bind any outsourced agency to them.

Our overview of professional services marketing rules and ethics lists the regulators behind these duties, including the SRA and the CMA.

Example: making an award claim compliant

Firms often write "award-winning solicitors" and stop there. That fails rule 3.7, which asks for evidence.

A compliant line reads: "Winner, Residential Property Team of the Year, 2024, awarded by [organiser] in [month] 2024. Evidence held in Appendix A." State what the award was, who gave it, the year, and where the proof sits.

What each source requires of the firm

What each source requires

Source	What it requires your firm to do	Who enforces it
CAP Code, rules 3.1, 3.7 and 3.33 to 3.35	Hold evidence before publishing objective claims; make competitor comparisons verifiable	Advertising Standards Authority
UK GDPR and PECR	Record a lawful basis, publish consent wording, honour opt-outs, delete on schedule	Information Commissioner's Office
DMCC Act 2024, consumer provisions	Show the total price, avoid drip pricing and fake reviews, follow subscription rules	Competition and Markets Authority

Common questions

Who should own and review the policy?

Usually the marketing lead, with sign-off from the compliance officer or managing partner. In a small firm one person can hold both roles if each review is dated and logged.

Does it cover fee earners' personal social media?

Yes. A LinkedIn post or seminar slide that promotes the firm counts as marketing, so the policy should say what fee earners may claim and who checks it.

Do we need consent for business email?

Not for corporate subscribers, where legitimate interests usually provides the basis. Sole traders and partnerships count as individual subscribers, so treat them as consumers.

How often should it be reviewed?

At least yearly, and before any new channel or consumer offer launches. Confirm the DMCC Act commencement position at each review.