The UK General Data Protection Regulation governs how businesses collect, store, and use personal data. For marketers, it determines what you can do with customer information — and the penalties for getting it wrong.
UK GDPR vs EU GDPR
Following Brexit, the UK adopted its own version — the UK GDPR — alongside the Data Protection Act 2018. The rules are substantively similar but enforced by the ICO. UK businesses processing EU residents data must comply with both.
The Six Lawful Bases
To process personal data you need a lawful basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. For marketing, consent and legitimate interests are most relevant.
Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not count.
Legitimate interests requires a Legitimate Interests Assessment documenting your interest, the necessity, and the balance against individual rights.
Consent vs Legitimate Interest for Marketing
Cold outreach to people with no prior relationship generally requires consent. Marketing to existing customers about similar services may use legitimate interests — but only with an opt-out at collection and in every communication.
Email and SMS Rules (PECR)
PECR adds rules on top of GDPR for electronic marketing. It requires consent for unsolicited emails with a “soft opt-in” exception for existing customers. See our guide to PECR and cookie consent.
Data Subject Rights
Individuals can access, rectify, erase, restrict, port, and object to processing of their data. Respond within one calendar month. CM Beyer provides a DSAR form for this.
Penalties
Maximum fines: 17.5 million pounds or 4% of global turnover. The ICO has issued significant fines for marketing breaches, particularly unsolicited communications and inadequate consent.
Frequently Asked Questions
Can I email someone who gave me their business card?
Not automatically for marketing. A business card is not marketing consent.
Do I need a privacy policy?
Yes. See CM Beyer Privacy Policy for an example.
