Rules and ethics
Part of How to apply sales enablement rules and ethics across UK content
Choosing consent or legitimate interest for sales enablement data protection
Rules for sales enablement data protection: choosing consent or legitimate interest, vetting bought lists and documenting your lawful basis under UK GDPR.
What to take away
Default rule: consent for individuals; legitimate interest for corporate contacts only, with a written assessment.
- UK GDPR needs a lawful basis and a record of it before you process personal data.
- PECR adds a consent rule for electronic marketing to individual subscribers, which includes sole traders.
- Corporate subscribers fall outside PECR's email consent rule, but UK GDPR still governs the processing.
- Bought or shared lists rest on consent, and verifying the broker's evidence is your job.
- Legitimate interest needs a three-part test you can show, not a claimed business need.
How to pick between consent and legitimate interest
Three questions settle most cases: who receives the message, which channel carries it and where the data came from.
Under the UK GDPR each purpose needs its own lawful basis. A campaign send and a stored transcript are separate purposes with separate records.
The ICO's guide to the UK GDPR explains how to choose a basis and how to record it.
The UK rules and compliance guide for 2027 connects data protection to disclosure, contracts and vendor management.
Consent or legitimate interest?
Is it email, SMS or automated calls to an individual?
Consent, unless narrow soft opt-in applies
Legitimate interest may carry the weight
Consent: when it is the only workable basis
Consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Withdrawal must be as easy.
PECR requires consent for email, SMS and automated calls to individual subscribers. The soft opt-in covers existing customers and similar products only.
For a bought list, consent is the only defensible basis. The ICO's guidance on the marketing services of data brokers confirms you stay responsible for verifying what a broker supplies.
Legitimate interest: what has to be true
Contact with a named person in a corporate role can rest on legitimate interest where the message fits that job, but the assessment must be written down.
PECR's email consent rule covers individual subscribers, including sole traders. Corporate subscribers sit outside it, and the ICO direct marketing guidance sets out where the line falls.
Example: a legitimate interest balancing test
A UK software firm wants to email the named head of finance at a limited company about a budgeting tool. Her work address sits on the company's own website.
Legitimate interest balancing test
- Interestthe firm sells finance software and she owns that budget, so the interest is real and current.
- Necessityless data would not achieve the same result. Name, employer, role and work email are enough, with no profiling and no bought enrichment.
- Balancethe message relates to her role, arrives once and carries a one-click opt-out. Intrusion stays low.
Record the outcome, the date and the reviewer, then revisit it if the audience shifts.
Documenting the basis: six steps
- Map every source that feeds enablement, including partner exports and event scans.
- Assign one lawful basis to each purpose and record it before launch.
- Check the consent evidence behind any bought or shared list.
- File a legitimate interest assessment wherever you rely on one.
- Set retention periods, then delete or anonymise when they end.
- Align the wording prospects see with your privacy notice.
A policy nobody reads adds nothing, so the disclosure policy in England article works through wording that shows people how their details reached you.
Brokers, contracts and retention
Brokers, intent-data providers and marketing platforms are processors or joint controllers, depending on the relationship. Each needs a written contract.
Acceptable broker consent evidence contains four things:
Consent evidence to verify
- the verbatim opt-in wording the person saw;
- a timestamp for the consent event;
- the source URL where the opt-in appeared;
- the scope of consent, meaning which brands and which channels.
Ask for the collecting entity's name and the privacy notice shown. If an item is missing, treat the list as unusable.
No single retention period is set in law. The table below is an illustrative working example for a UK team, not a legal minimum.
| Contact type | Illustrative retention | Reasoning |
|---|---|---|
| Event contact, never engaged | 12 months from the event | covers one annual buying cycle |
| Engaged prospect | 24 months from last reply | matches the account review cycle |
| Customer contact | 24 months after contract end | matches contractual records |
Delete or anonymise when the period ends. Where a broker supplies the data, the contract should name the deletion duty and the audit right, so read what to check in sales enablement commercial contracts before signing.
Common questions
Which basis should we use for cold email to business contacts in the UK?
For a named person at a corporate subscriber, legitimate interest can work under PECR, but it still needs a documented assessment.
Can we rely on a bought list if the broker says consent was collected?
Only if you can verify that the consent meets UK standards. Check the opt-in wording, the timestamp, the source URL and the scope, and keep the evidence.
How long may we keep sales enablement contact data?
No single period is set in law. Choose one that fits the purpose, write down the reasoning, then delete or anonymise when it ends.
Do we need a data protection officer?
Only in specific situations, such as large-scale monitoring. Most enablement teams do not, but someone must own the records.
