What the UK professional services marketing regulations mean for your firm

What to take away

For professional services marketing, the ICO's direct marketing guidance sets consent and legitimate interests tests for email, calls and texts under the UK GDPR and PECR.
The CAP Code governs advertising claims; the ASA administers it and may publish a public ruling.
Bribery Act 2010 guidance covers client hospitality, referral fees and marketing that touches public officials.
Enforcement is realthe ICO can fine firms, and an upheld ASA ruling is public.
General guidance only; individual cases need a qualified adviser.

What changed recently and why it matters

The ICO updated its direct marketing guidance to reflect the Data Protection Act 2018 and the UK GDPR. Consent must be freely given, specific and unambiguous. A partner cannot rely on a client list built from business cards, and soft opt-in applies only to existing customers, for similar services. Live calls and texts are covered too.

Map each channel to a lawful basis

List building: choose lawful basis
Sending: confirm basis still holds
Email: PECR rules apply
Live calls and texts: covered too
Corporate subscribers: treated differently
Sole traders: count as individuals

Each channel needs its own lawful basis, and it must hold from list building through to sending. A breach can bring an ICO fine and a loss of client trust. Map every channel to a lawful basis before the next campaign. For how data protection sits inside the wider ethics picture, see Professional services marketing data protection.

Electronic marketing also has its own regime. PECR adds channel-level rules on top of the UK GDPR, so a lawful basis alone does not clear a campaign. Corporate subscribers are treated differently from sole traders and unincorporated partnerships, which count as individuals under the email rules.

Where the advertising codes bite

The CAP Code requires marketing communications to be legal, decent, honest and truthful. For professional services, that means no unqualified claims, such as calling the firm the best lawyer in its city, and comparative claims need evidence. The ASA can investigate a single complaint and publish a ruling that names the firm.

CAP Code compliance checklist

Communications legal, decent, honest, truthful
No unqualified claims like best lawyer
Comparative claims backed by evidence
Check professional regulator handbook
ASA can investigate single complaint

The Committee of Advertising Practice (CAP) writes the CAP Code, while the Advertising Standards Authority (ASA) administers it and publishes rulings.

Regulated firms answer to a second rulebook. Solicitors, barristers, accountants and CILEX professionals must also follow their regulator's publicity rules, and an ASA-compliant claim can still breach a professional code. Name and check the applicable rules before sign-off: the SRA Standards and Regulations, including the SRA Code of Conduct for Solicitors, RELs and RFLs and the SRA Code of Conduct for Firms; the BSB Handbook; the ICAEW Code of Ethics; the ACCA Code of Ethics and Conduct; or CILEX Regulation's Code of Conduct.

Financial services firms must also follow the FCA Handbook. COBS 4.2.1R requires financial promotions to be fair, clear and not misleading.

Anti-bribery and client relationships

The Bribery Act 2010 creates offences for offering or accepting bribes, including facilitation payments. Marketing can cross the line when it funds hospitality, gifts or referral fees intended to influence a decision. The Bribery Act 2010 guidance sets out six principles for commercial organisations, with a risk-based approach at its centre.

Bribery Act marketing controls

Proportionate procedures
Top-level commitment
Risk assessment
Due diligence
Monitoring
Name who approves hospitality
Document referral fees

The six principles are proportionate procedures, top-level commitment, risk assessment, due diligence, communication (including training), and monitoring and review. Facilitation payments are prohibited whatever their size. The communication principle makes a published policy and training records useful evidence. A marketing policy should name who approves hospitality and how referrals are documented. An individual convicted on indictment can face up to 10 years' imprisonment and/or an unlimited fine; a company can receive an unlimited fine.

Direct marketing and the ICO

The ICO's direct marketing guidance covers consent, legitimate interests and the rules for each channel. Legitimate interests can apply to some business-to-business marketing, but the firm must pass a balancing test and offer an opt-out. It also covers data bought from third parties and the need for source transparency.

Document that balancing test. Note why the contact would expect to hear from you, and what happens if they object. If the honest answer is that they would not, consent is the safer route.

For law firm marketing, purchased lists often fail here, because consent may not transfer. Record how consent was obtained, what it covers and when it expires.

Decision table: common marketing situations

Choose

Email to new business contacts: Soft opt-in for existing customers; otherwise a documented lawful basis
Client hospitality or referral fee: Written policy, approval threshold, and a record of business purpose
Expertise claim in marketing: Evidence-based wording, cited with its source and date
List bought from a third party: Verify the consent source and refresh opt-outs before sending
Testimonial or case study: Written client consent and anonymisation where required

Avoid

Email to new business contacts: Assuming B2B email sits outside PECR
Client hospitality or referral fee: Cash or gifts that look like inducements
Expertise claim in marketing: Unqualified superlatives or guaranteed outcomes
List bought from a third party: Trusting the seller's assurance of compliance
Testimonial or case study: Naming clients without checking confidentiality

The table is a starting point, not legal advice, and firm-specific decisions need a qualified adviser. For the framework that ties these rules together, read Professional services marketing: UK rules and ethics.

Common questions

Do the ICO rules apply to B2B marketing?

Yes. The guidance covers business-to-business communications as well as consumer ones, though legitimate interests can be a lawful basis in some cases. You still need a clear opt-out and a record of your reasoning.

Can we publish client testimonials without written consent?

No. The ASA and the ICO both expect consent for testimonials that identify a client. Check confidentiality obligations before publishing any detail.

What happens if we breach the advertising codes?

The ASA can publish an upheld ruling naming the firm and the campaign. That ruling is public, searchable and used by competitors.

Does the Bribery Act apply to marketing hospitality?

Yes, where hospitality or gifts are intended to influence a decision. Government guidance recommends a risk-based policy with clear approval limits and records.