ICO enforcement and UK GDPR rules for sales enablement content

What to take away

Why ICO enforcement now shapes sales enablement sequences in the UK

The Information Commissioner's Office (ICO) is the UK regulator for data protection and electronic marketing. It enforces UK GDPR and PECR. When it fines a company for nuisance calls or unlawful emails, the details become a template for what not to do. Sales enablement leads should read those decisions as content risk signals.

ICO enforcement actions are not abstract. They name the sector, the number of messages, and the failure in consent or suppression. A single enforcement notice can force a company to change how it buys data, writes copy and records consent. That affects the sequences your team builds in sales enablement software.

The ICO also publishes guidance and checklists that sales teams can use directly. The Business-to-business marketing | ICO page sets out the rules for B2B direct marketing that sales sequences must follow. It explains when B2B messages are covered by PECR and when they are not.

UK GDPR sits alongside PECR. UK GDPR governs how you process personal data, including buyer names, job titles and email addresses. PECR governs the act of sending electronic marketing. Both apply to most B2B outreach. A lawful basis under UK GDPR does not excuse you from PECR rules on consent for certain messages.

Enforcement also reaches the content itself. If a sequence implies consent that was never given, or hides the opt-out, the ICO can treat that as a breach. Sales enablement software often stores the consent wording and the opt-out link. That makes the software part of the compliance evidence.

The Financial Conduct Authority (FCA) adds another layer for regulated sectors. If your sales content promotes a financial product, FCA financial promotion rules apply on top of UK GDPR and PECR. The Advertising Standards Authority (ASA) also polices B2B advertising claims under the CAP Code. Sales enablement content must not promise outcomes it cannot support.

Lawful basis for B2B outreach: legitimate interest versus consent under UK GDPR

Every processing activity needs a lawful basis. For B2B outreach, the two most common are legitimate interest and consent. The ICO's Sending direct marketing: Choosing your lawful basis | ICO page explains how to choose. It also explains that consent must be freely given, specific and informed.

Legitimate interest is often used for B2B email to corporate subscribers. It requires a three-part test: identify the interest, show the processing is necessary, and balance it against the individual's rights. You must document that test. Sales enablement software should store the assessment alongside the sequence.

Consent is stricter. It must be a positive action, not a pre-ticked box. If you rely on consent, you must be able to show who consented, when, and to what. You must also make it as easy to withdraw as to give. That affects how you design forms, landing pages and preference centres.

For sole traders and some partnerships, PECR treats the contact like an individual subscriber. That means you generally need consent for email marketing, even if the address looks like a business address. Sales teams often get this wrong when they buy lists of small firms. Check the legal status of the contact before you send.

Limited companies and limited liability partnerships are corporate subscribers. For those, you can often rely on legitimate interest for B2B email, provided you include an opt-out and identify yourself. But you still need a lawful basis under UK GDPR for holding and using the data. The two regimes work together.

Consent wording must be clear and separate from other terms. Do not bundle consent into a contract or a privacy notice. If you use a checkbox, it must be unticked. If you use a button, the label must say what the person is agreeing to. Sales enablement software should capture the exact wording shown at the point of consent.

Legitimate interest is not a free pass. The ICO expects you to consider the reasonable expectations of the buyer. If someone has opted out before, or if the data was scraped from a source with no marketing permission, legitimate interest is unlikely to stand.

A useful rule is to match the basis to the channel and the audience. Corporate email to a relevant business contact may fit legitimate interest. SMS to a mobile number, or email to a sole trader, usually needs consent. Calls to corporate numbers have their own PECR rules, which the next section covers.

For a deeper comparison of how these choices play out in practice, see consent or legitimate interest. That article walks through the trade-offs for sales enablement data protection.

PECR rules for email, calls and LinkedIn outreach that sales teams get wrong

PECR governs electronic marketing in the UK. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO sets out the rules. It covers email, calls, SMS and other electronic messages. Sales teams often assume B2B is exempt. That is only partly true.

Email marketing to corporate subscribers is allowed under the soft opt-in or legitimate interest in some cases, but you must include an opt-out in every message. The opt-out must be easy to use. If someone opts out, you must stop sending to that address for marketing purposes.

Sales enablement software should have a single suppression list that applies across all channels and sequences.

Calls to corporate numbers are not covered by the same consent rule as calls to individuals, but you must still check the Telephone Preference Service (TPS) for individuals and sole traders. If a number is registered, you must not call it for marketing unless you have consent. The Corporate TPS covers corporate numbers, and you should screen against it.

LinkedIn outreach sits in a grey area. PECR covers electronic mail, which includes messages sent via a public electronic communications network. Direct messages on LinkedIn may fall outside PECR if they are not email, but UK GDPR still applies to the personal data you process. You still need a lawful basis and a way for people to object.

Sales teams get LinkedIn wrong when they scrape profiles or use automation to send bulk messages. That can breach LinkedIn's terms and UK GDPR. If you use sales enablement software to enrich profiles, check that the data source has a lawful basis for sharing the data with you. The ICO expects you to do due diligence on list providers.

You must also identify yourself in every marketing message. The message should make clear who is sending it and how to opt out. Hidden opt-outs, or opt-outs that require a login, are not acceptable. The ICO has acted against organisations that made opting out difficult.

For more on how UK rules shape what you may record and send, see UK regulations shape. That article covers the practical limits on data capture and outreach.

Reading ICO enforcement actions and fines as content risk signals

ICO enforcement actions are public. They include fines, reprimands, enforcement notices and audits. Each one describes the facts and the law. Sales enablement leads can read them as case studies. They show which content and data practices attract regulatory attention.

The ICO fined Honda Motor Europe Ltd £13,000 under PECR for sending marketing emails to customers who had not consented to receive them. It fined Flybe Ltd £70,000 under PECR for emailing customers who had opted out of marketing. We Buy Any Car Ltd was fined £200,000 under PECR for sending unsolicited text messages without consent.

A recurring theme is consent that was not valid. The ICO has fined companies for sending marketing emails without consent to individuals who had not opted in. In B2B, the same risk applies to sole traders and partnerships. If your sequence treats every contact as a corporate subscriber, you may be sending unlawfully.

Another theme is the failure to honour opt-outs. Some organisations continued to contact people after they had objected. That is a breach of PECR and UK GDPR.

A third theme is the use of purchased or scraped data. The ICO has acted against organisations that bought lists without checking consent. If you cannot show where the data came from and what permission was given, you cannot rely on it. That is a direct risk for sales content that uses personalisation based on third-party data.

Enforcement also covers the content of the message. If the message disguises its marketing purpose, or if the opt-out is buried, the ICO may treat it as a breach. The wording of the subject line, the sender name and the footer all matter. Sales enablement software often templates these elements, so the template becomes the compliance control.

Fines are not the only outcome. A reprimand, being a formal warning, may be issued by the ICO. It can also require an organisation to change its practices. For sales teams, a reprimand is a signal that the regulator is watching a sector or a practice. It is worth reading even when no fine is issued.

The ICO also publishes audits and guidance that follow enforcement. These often include checklists. The Direct marketing checklist | ICO is one example. It is a practical tool you can use to audit your outreach content and processes.

When you read an enforcement action, look for the specific failure. Was it consent, suppression, identification, or data sourcing? Then check your own sequences for the same weakness. That is how enforcement shapes sales enablement content: it turns regulatory decisions into design requirements.

Consent wording, opt-outs and suppression lists inside sales enablement software

Consent wording must be specific to the marketing you will send. A generic statement such as "we may contact you about our products" is weak. Better wording names the channels and the type of content. For example: "We would like to send you our monthly B2B software newsletter by email. You can unsubscribe at any time."

A second example for events: "I agree to receive invitations to our quarterly sales enablement webinars and related updates by email. I can withdraw this consent at any time."

For calls, an example is: "I agree that [Company] may call me about relevant sales enablement services. I can withdraw this consent at any time."

The wording should be separate from other terms. Do not hide it in a privacy notice or a contract. If you use a checkbox, it must be unticked by default. If you use a consent button, the label should describe the action. Sales enablement software should store the exact wording, the date and the source.

Opt-outs must be easy to use. Every marketing email should include a clear unsubscribe link. The link should work without a login.

Suppression lists must be checked before every send. That sounds obvious, but enforcement actions show it is often missed. The check should cover email, phone and any other channel you use. If you use multiple tools, you need a process to sync suppressions. A daily sync is safer than a manual export.

Store these fields in your sales enablement software:

You should also record objections that come in other ways. If a buyer says stop on a call, or replies to an email asking to be removed, that is an objection. It should go into the same suppression list. Sales enablement software should allow sales reps to log objections without needing a data team.

Consent records should include what the person was told and what they agreed to. The ICO expects you to be able to show your reasoning if challenged.

For guidance on documenting these choices, see rules and ethics. It covers how to apply sales enablement rules and ethics across UK content.

Data (Use and Access) Act 2025 changes for sales data and personalisation

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. The ICO's Data (Use and Access) Act 2025 | ICO page explains what the Act does. It affects how organisations handle data for research, innovation and some marketing activities. Sales teams should review their notices and processes.

The Act raises the maximum fine for unsolicited marketing calls under PECR to the UK GDPR level. That is £17.5 million or 4 per cent of annual global turnover, whichever is higher. The previous PECR maximum was £500,000.

The Act also introduces a list of recognised legitimate interests. These are purposes where the balancing test is not required. Marketing is not on that list. So you still need to document your balancing test for sales outreach.

The Act changes the rules on automated decision-making, including profiling for personalisation. It allows more automated decisions with safeguards such as human review and the right to contest. Sales enablement software that scores leads or personalises content should check those safeguards.

The Act replaces the ICO with a new Information Commission. It also updates rules on cookies and similar technologies, which affect tracking for personalisation. The ICO will publish guidance as provisions commence.

For sales data, the Act reinforces data minimisation and retention rules. Sales enablement software should have retention rules that delete or anonymise data when it is no longer needed.

The Act also encourages privacy-enhancing technologies. If you use third-party data for personalisation, check that the source complies with the Act and UK GDPR. The ICO expects due diligence.

For more on how to set out your data practices, see disclosure policy. It explains what to include before you publish a sales enablement disclosure policy.

Building a sales content compliance checklist for UK revenue teams

A checklist turns legal requirements into daily habits. Use this one to audit your sales enablement software and content. It is based on ICO guidance and the direct marketing checklist. Review it quarterly.

To use the checklist, follow these steps:

The ICO's direct marketing checklist is a useful companion. It covers many of the same points and is updated by the regulator. Use it alongside your internal checklist. If you operate in a regulated sector, add FCA or ASA checks for financial promotions and advertising claims.

Finally, keep evidence. Enforcement actions often turn on what you can show. If you can show your lawful basis assessment, your consent records and your suppression logs, you are in a stronger position. Sales enablement software should make that evidence easy to export.

Common questions