Rules and ethics
Part of UK sales content personalisation: a practical guide
UK sales content personalisation: a practical guide
A practical guide to UK sales content personalisation: lawful bases, PECR, CRM and sales-enablement tools, plus a four-step build and review process.
What to take away
- Personalisation in the UK starts with a lawful basis for the data you use, not with a template library.
- The UK GDPR and the Data Protection Act 2018 cover prospect data, while PECR adds consent rules for electronic marketing.
- Dynamic content works best on facts the buyer expects you to know: sector, role, deal stage and past conversations.
- Build in four stepsaudit, define triggers, draft variants, review with sales and compliance.
- Plain British English and evidence-backed claims persuade UK buyers more than a first-name token.
Why personalisation is a data question first
Any content you tailor to a named buyer relies on personal data, so start with the Data Protection Act 2018 and the UK GDPR. The ICO regulates both across the UK.
That does not make personalisation hard. It makes it deliberate. Most business-to-business tailoring uses company and role data, not sensitive details about a person.
The practical test is purpose limitation. If a buyer gave you their job title when booking a demo, using it to tailor the follow-up is close to that purpose. Dropping it into a cold sequence is not.
Match the tactic to a lawful basis
Different tactics lean on different lawful bases. Use the table below as the agenda for a review with whoever owns data protection.
Tactic vs lawful basis
Tactic
- Segment by sector or size
- Legitimate interests
- Tailored email to named buyer
- Legitimate interests or consent
- Reusing CRM call notes
- Contract or legitimate interests
- Third-party intent scoring
- Legitimate interests
- Personalised renewal content
- Contract or legitimate interests
Usual lawful basis
- Segment by sector or size
- Company-level data only
- Tailored email to named buyer
- PECR rules apply
- Reusing CRM call notes
- Purpose limitation
- Third-party intent scoring
- Document transparency
- Personalised renewal content
- Keep suppression current
Watch out for
- Segment by sector or size
- Tailored email to named buyer
- Reusing CRM call notes
- Third-party intent scoring
- Personalised renewal content
| Tactic | Usual lawful basis | Watch out for |
|---|---|---|
| Segmenting by sector or company size | Legitimate interests | Company-level data only, no individual profiling without notice |
| Tailored email to a named buyer | Legitimate interests or consent | PECR rules for electronic mail marketing |
| Reusing CRM notes from a call | Contract or legitimate interests | Purpose limitation, do not reuse for unrelated campaigns |
| Third-party intent data for scoring | Legitimate interests with a balancing test | Document the provider's transparency and your own |
| Personalised renewal content | Contract or legitimate interests | Keep suppression and unsubscribe handling current |
For email marketing, PECR rules depend on the subscriber type. Marketing to individual subscribers, including sole traders and some partnerships, generally needs consent or a valid soft opt-in; corporate subscribers can generally be emailed without consent, but the sender must be identified and an opt-out provided. UK GDPR still applies to personal data, and the ICO's direct marketing guidance explains the tests.
For the wider UK GDPR position, including the balancing test for legitimate interests, the ICO's guide to the UK GDPR is the reference most UK teams cite.
Where you rely on legitimate interests, document a legitimate interests assessment (LIA): identify the purpose, show the processing is necessary, and balance your interests against the buyer's rights and reasonable expectations. Use the ICO's legitimate interests guidance to record that assessment before using personal data.
Controllers must pay the ICO data protection fee unless an exemption applies. Check the ICO's data protection fee guidance to establish whether your organisation must pay and register.
A four-step build sequence
Before rewriting anything, run a sales content audit to see which assets are worth tailoring at all.
- Audit:Use the audit findings to select assets worth tailoring, identify their audience and owner, and remove stale claims before creating variants.
- Define triggers:Choose observable, expected fields—such as sector, role, deal stage, renewal date or a recorded conversation—and note each field’s source and permitted purpose.
- Draft variants:Keep a shared core message, then change only the detail relevant to the trigger. For example: “Following our conversation, you said [business goal] is a priority. Would a short overview of [relevant solution] help?”
- Review with sales and compliance:Check the data source and lawful basis, PECR subscriber rules, opt-out wording, claims and any quoted figure; approve and version the copy before reps use it in Highspot.
Four-step personalisation build
- Audit what you hold
- Define message triggers
- Draft master asset plus variants
- Review with sales and data owner
- Publish and read first twenty
Where dynamic content earns its keep
Dynamic content pays off where the data is accurate and the buyer expects you to use it. Renewal dates and open support tickets are strong triggers.
Keep trigger fields in a named source of truth: a CRM such as Salesforce or HubSpot can hold sector, role, deal stage and recorded renewal or conversation details, while approved copy and variants can be organised for reps in Highspot. Limit fields to information the rep needs and record where each trigger came from.
Third-party intent data is the weaker end. It can be noisy, and a buyer may ask how you knew. If you use it, record the provider, signal and date, and be ready to explain: “We use [provider] data indicating interest in [topic].” Use this wording only when accurate; keep bought data out of first-contact copy if you cannot explain its source.
Where a buyer has actually shared a goal with you, a grounded opening is: “Following our conversation, you said [goal] is a priority. Would a short overview of [solution] be useful?” Avoid an unsupported opener such as: “We know your organisation is struggling with [problem].”
Account-based sales content works when one asset serves a buying group. Write for the commercial problem, then add a short line for each stakeholder's role.
Keep the token count low. A message with six inserted fields reads like a database export, and each field is another piece of data you must justify holding.
Pair those variants with sales battle cards so reps can handle the objections the copy raises.
Keeping the tone British and the claims safe
Use British English—for example, “organisation”, “programme” and “licence”—and quote approved prices in pounds (for example, “£[approved amount]”). Label factual figures with their source and date; never turn an estimate into a confirmed quote.
Content that makes advertising claims falls under the CAP Code, enforced by the Advertising Standards Authority, so keep comparative statements checkable.
Give the copy one owner. When personalisation is split across marketing, sales and a platform's token library, tone drifts and unverified statistics creep in.
Common questions
Does personalisation need consent?
Not always. Legitimate interests can cover business-to-business tailoring a buyer would expect, but PECR requires consent or a soft opt-in for electronic marketing to individuals.
Can we use third-party data for the opening line?
Only with a lawful basis, a documented balancing test and a clear explanation of the source. Many UK teams keep bought data out of first-contact copy.
How many variants should we maintain?
Two or three per stage is enough to test. More variants multiply review time and make it harder to see which message worked.
How do we measure personalised content?
Compare reply and meeting rates by variant, and record which trigger produced the message. Without that link, personalisation becomes an anecdote.
