Lead generation software does not change UK B2B rules

What to take away

Why ICO and PECR sit at the centre of UK B2B prospecting lists

The Information Commissioner's Office regulates data protection and electronic marketing across the UK. PECR sits alongside UK GDPR and sets specific rules for electronic mail, live calls and automated calls. Your CRM, sequencer or data provider is only a tool. The duty to comply stays with the organisation that sends the message or dials the number.

PECR governs the channel. UK GDPR governs the data you hold and process. A campaign can satisfy one and fail the other, which is why a single checklist rarely covers a whole prospecting programme. You need a rule for the channel and a basis for the record.

Prospecting tools sell access, enrichment and sending capacity. None of them transfers the compliance duty, and none can certify that a list is lawful for cold outreach. Buying lead generation software can feel like buying a licence to contact. It is not one.

PECR applies to business marketing, with a narrower set of rules for corporate subscribers. The ICO's position is not that B2B is exempt. It is regulated differently. That distinction drives almost every decision about which addresses and numbers you may use.

Channel decides the detail. Email, live calls and automated calls each carry different consent and screening requirements. Before a campaign, it pays to check prospecting software UK regulations against the specific channel, audience and data source you plan to use.

A lawful basis is needed for the personal data you process, whatever the channel. The ICO explains how to choose a lawful basis for direct marketing, and that choice belongs in your records before the first send.

Fines are not hypothetical. The ICO publishes fines, reprimands and enforcement notices, and nuisance marketing stays high on its list of priorities. One weak list can turn a single complaint into a formal investigation.

The ICO is not the only body with an interest. The Chartered Institute of Marketing and the Institute of Sales Professionals publish professional standards that assume lawful data handling. Enterprise buyers increasingly ask about both.

The three questions an ICO query starts with

What was your lawful basis? How did you obtain the data? Did you screen against the relevant preference service? Those three questions open most enquiries. If your lead generation software cannot answer them from stored records, the substance of the complaint rarely matters.

How PECR treats corporate subscribers differently from sole traders and partnerships

PECR separates individual subscribers from corporate subscribers. A corporate subscriber is a company or similar body corporate. A sole trader and most partnerships count as individual subscribers, which brings stricter rules. That single line decides whether unsolicited email needs prior consent.

For individual subscribers, unsolicited marketing by electronic mail requires consent. That covers sole traders, unincorporated partnerships and many of the small business contacts UK sales teams hold. A trading name ending in "and Sons" proves nothing about legal form.

The ICO's Direct marketing guidance sets out the corporate subscriber position and its limits in the section titled “Business-to-business marketing”. Read it before you decide a list is entirely business and therefore safe.

Companies House helps with classification. A registered company number and an active company record support a corporate subscriber classification. A directory listing or a website footer does not. The burden of checking falls on you, not on the broker who sold you the file.

A generic address such as info@ or sales@ says nothing about who stands behind it. Some teams treat a company domain as proof of corporate status. The domain shows where mail is hosted, not who the subscriber is, and a sole trader can use a business domain freely.

Public sector bodies, charities and unincorporated associations need individual treatment. So do some limited liability partnerships. Classify each record by legal form rather than by how commercial it looks, and keep that field populated.

Subscriber type also changes your risk. A misclassified sole trader is an individual whose consent you never obtained, and that is the mistake most likely to generate a complaint from a small business owner.

Where classification breaks down

Data providers label almost every record as a business contact. That label says nothing about legal status. If your lead generation software cannot store subscriber type, you cannot evidence the classification you relied on when you pressed send.

Choosing a lawful basis for cold email under UK GDPR

To process personal data, a lawful basis is required under the UK GDPR. For cold email to corporate subscribers, legitimate interests is the basis most UK organisations rely on. It is not a free pass. You must balance your commercial interest against the prospect's rights and reasonable expectations.

Consent is the alternative. It is harder to obtain at scale and harder to maintain. Consent must be specific, informed, unambiguous and as easy to withdraw as to give. A pre-ticked box or a clause buried in a privacy notice does not meet that standard.

The soft opt-in is a narrow exception. It applies where you obtained contact details in the course of a sale or negotiations, for a similar product, and offered an opt-out at collection and in every message since. It does not cover purchased lists or unrelated products.

Email prospecting rules on consent and the soft opt-in are set out in the ICO's Direct marketing guidance, in its “Electronic mail marketing” section. Keep it open while you build sequences and suppression logic, because the detail decides which contacts you may include.

You cannot switch lawful basis retrospectively to justify processing already carried out. Choose before the campaign and document the reasoning. Changing basis later looks like repairing paperwork, and the ICO treats it that way.

If you rely on consent, record when and how it was given, what the person was told, and which product it covered. Consent that cannot be evidenced is difficult to rely on when a complaint arrives, even if you believe it was freely given.

Purpose limitation matters too. Collecting personal mobile numbers for a corporate email campaign is hard to justify when the same prospects are reachable at work. Take only what the stated purpose needs.

Recording the assessment

A legitimate interests assessment should state the interest, why the processing is necessary, the balancing test and any safeguards applied. Keep it with the campaign record. If the basis is challenged later, that document is your evidence.

Three lines are often enough for a simple campaign: what you want to achieve, why contacting these people is necessary, and what you weighed against it. Sign and date it. A short honest assessment beats a template nobody read.

Live calls, the TPS and CTPS rules that catch out lead generation software users

Live calls sit under a different PECR regime. You must not call a number registered on the Telephone Preference Service unless the subscriber has consented to your call. The Corporate TPS applies the same principle to corporate numbers. Registration lasts until it is withdrawn.

Consent overrides a TPS or CTPS registration. Nothing else does. An existing customer relationship, a previous enquiry or a legitimate interests argument does not displace a registered objection for live calls. Teams that assume otherwise generate complaints quickly.

The ICO's Direct marketing guidance includes the page “How do we comply with the rules on live marketing calls?” (live calls guidance) covering telemarketing obligations, including screening and record keeping. In practice you screen before dialling and keep evidence of the date. If you cannot show the screening, you cannot show compliance.

Screening is not a one-off task. Registers change daily, and a number clear last month may be registered this week. Where compliance rules must be set before you scale calling activity, build the screen into the workflow rather than running it as a manual check on the day.

Automated calls need consent regardless of subscriber type, and recorded messages fall under the same rule. If your dialler can place automated calls, treat that function as a separate compliance decision with its own record and its own sign-off.

Callers must identify themselves and the organisation clearly, and must not conceal the purpose of the call. Accurate caller line identification matters as well, because a withheld number invites a complaint that a clear one often avoids.

The silent call trap

Abandoned and silent calls breach PECR and attract ICO attention. Dialler settings that drop calls without a recorded message create a complaint risk that no list quality can offset. Check the settings before a pilot, not during one.

ICO oversight: fee registration and enforcement

Most organisations processing personal data must pay the data protection fee to the ICO. Non-payment is a separate breach, and the ICO publishes the names of organisations fined for it. Check your tier and confirm you are on the register before campaign season starts.

The ICO's enforcement action record is the most useful free research available to UK sales teams. It shows what the regulator has actually penalised, including unlawful prospecting and nuisance calls, and the reasoning behind each decision.

Patterns recur. Lists bought without due diligence, no screening against preference services, no recorded lawful basis, and continued contact after an opt-out. Every one of those is avoidable with basic process and a field in the CRM.

Enforcement is not limited to large firms. Small companies and sole traders appear in the record. Size affects the penalty, not the finding of a breach, and a first offence can still produce a fine.

Complaints often come from third parties rather than the recipient. A trade body, a competitor or a consumer group can report a campaign, which means low complaint volumes are a weak signal of safety.

Here is how to review your exposure in an afternoon:

What a reprimand costs

A reprimand carries no fine but is published and searchable. For a UK sales team, the reputational cost with enterprise buyers and procurement teams often exceeds the financial one. Procurement teams do search.

Building a documented prospecting workflow that survives an ICO query

Documentation separates a defensible campaign from an indefensible one. The aim is to show, on request, why each contact was made and on what basis. Build the record as you go, because reconstructing it later rarely convinces anyone.

Start with four fields per record: subscriber type, lawful basis, source and collection date. Those four answer most initial questions and cost almost nothing to maintain. Add consent wording where consent is the basis.

Worked example. You buy five thousand records for a software campaign aimed at finance directors at registered companies. Each record is classified as a corporate subscriber, with the source and the purchase date noted in the CRM.

The same campaign runs a legitimate interests assessment and stores it with the send history. You suppress anyone who has objected, screen numbers against TPS and CTPS on the day of dialling, and log that date. If a complaint arrives, you produce basis, source, assessment and screening record in one reply.

Keep these compliance controls visible in the campaign record:

A prospecting software data protection review should confirm that your tools can store and report on each of those fields. If a field has nowhere to live, the control does not exist, whatever the policy says.

Set a review rhythm. Quarterly checks catch drift in subscriber type, stale records and lapsed screening habits. Annual reviews miss too much, and a year of unscreened dialling is expensive to unpick after the fact.

Give each team a named owner for the suppression list and for broker due diligence. Shared responsibility usually means nobody checks, and the gap only becomes visible when someone asks for evidence.

Retention and erasure

Keep prospect data only as long as you need it. Set a retention period, apply it automatically and record deletions. Indefinite retention of cold prospect data is difficult to justify under the storage limitation principle.

When someone objects or asks for erasure, apply it everywhere. Sending tools, spreadsheets, diallers and broker-held copies all need to reflect the change. An opt-out honoured in one system and ignored in another is still a breach.

Where bought-in data brokers fit your lead generation software stack

Bought data is lawful to use only if the broker collected it lawfully and you can rely on a valid basis for your own contact. That is a chain, and one weak link breaks it. The ICO expects due diligence, not assurances.

Ask for the source of each record, the collection date, the notice shown at collection and whether consent or legitimate interests was relied on. Ask how objections are passed to buyers. A broker that cannot answer in writing is a risk you import into your own records.

Due diligence is not a one-off purchase check. Records age, notices change and objections accumulate. Refresh the checks periodically and note when you did so, so the file shows a habit rather than one burst of effort.

Your duties continue after purchase. If someone objects to your marketing, suppress them whatever the broker's records say. The broker cannot manage your suppression list, and its assurances are no defence in an investigation.

A written prospecting software disclosure policy sets out what you tell prospects about sources, rights and how to object. It also gives procurement and legal a document to review before they sign off a campaign.

Enrichment and inferred data deserve the same questions. If a tool appends job titles, direct dials or personal addresses to a company record, that information is personal data and needs a basis for its use on top of the source data's basis.

Contract terms worth insisting on

Push for warranties on lawful collection, an indemnity with real substance, and a duty on the supplier to notify you of complaints or objections relating to records you hold. Those clauses turn a vague assurance into a contractual remedy you can use.

Re-test the data before renewal. Sample a few hundred records, check they still match the source claims, and confirm the opt-out feed still works. Gaps appear over time, and renewal is the natural point to catch them.

Common questions