How to write a prospecting software disclosure policy that holds up

What to take away

A prospecting software disclosure policy is the written rule set for what your team must tell people when personal data is collected, enriched, matched or shared through prospecting tools.

Draft for England first, then check whether Scotland, Wales or Northern Ireland need different wording. This is general guidance only, and individual cases need a qualified adviser.

Step 1: map the data flows

List every prospecting tool that handles personal data, then note where records are stored and who can see them.

Set a retention period for each flow while you map it, tie it to the purpose that flow serves, and write down why the period is justified — the map is what your deletion schedule follows.

The statutory backdrop is three instruments. The UK GDPR and the Data Protection Act 2018 govern how you handle personal data; the Privacy and Electronic Communications Regulations 2003 (PECR) govern B2B email and phone prospecting. The Information Commissioner's Office (ICO) enforces all three, and your clauses must sit inside them.

Step 2: fix the lawful basis

Most B2B outreach leans on legitimate interests, the lawful basis in Article 6(1)(f) of the UK GDPR. It needs a documented balancing test — a legitimate interests assessment. Record the purpose, the necessity argument and the safeguards in one place.

Consent suits some channels better, and it must be specific and recorded. Do not let a tool default decide this for you.

Where you rely on consent, keep the evidence: the wording shown, the date and the channel. A record you cannot produce will not help you if a complaint arrives.

Where two organisations share leads, the ICO's Data Sharing Code of Practice explains how to settle responsibilities before data moves. Read it before you agree any co-marketing or lead-sharing arrangement.

Step 3: write the notice wording

Write in plain English at the point of collection: who you are, why you are contacting the person, and how to object. Article 13 of the UK GDPR lists what that notice must contain — your identity, the purposes, the lawful basis, the recipients, the retention period and the right to object.

Article 14 applies when the data did not come from the person: enriched, matched or bought records, which is most prospecting data. It requires the same information plus the source of the data, and it must reach the person within one month of you obtaining it.

Keep it short enough to read on a phone. Long notices get skipped, and a skipped notice weakens your position.

Show the notice to someone outside the sales team and ask them to explain it back to you. If they cannot, rewrite it.

Agree the standard lines in advance so every team uses the same phrases.

Name the rights people can exercise: access, rectification, erasure, restriction, portability and objection. Say how to withdraw consent, and how to complain to the ICO. A notice that lists them is far easier to defend than one that says only that you respect privacy.

Step 4: control lead sharing

Decide who may share lists, with whom, and on what written terms. A list you sent stays your responsibility.

Log each transfer with a date, a purpose and a named owner. If a partner cannot meet your terms, the answer is no.

Bought or rented lists deserve the same scrutiny as partner transfers, including where the records came from and what permission the seller holds.

For agency-run campaigns, LinkedIn's ad resources for marketing agencies explain how platform targeting and client reporting are handled, which helps you split duties.

Step 5: vendor and security terms

Check every vendor's processing terms against your own notice. If the vendor cannot support your wording, change one or the other.

Require access controls, retention limits and a written deletion route, then test that route once a year.

Keep a short register of tools, owners and review dates — the record of processing activities required by Article 30 of the UK GDPR — so an audit does not rest on one person's memory.

If a vendor or partner processes records outside the UK, put the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in place before any data moves.

Before and after

Step 6: approve and version

Give the policy a named owner and a version number. Review it when a tool changes, not only on a calendar date.

Run a short annual audit against the table above, and fix gaps before they reach a complaint.

Duties beyond disclosure alone sit in the ICO's direct marketing guidance, which covers consent, the soft opt-in and how to handle objections.

Common questions

Does the policy need to cover Scotland, Wales and Northern Ireland?

Data protection law applies across the United Kingdom, so the core wording usually travels. Check devolved rules separately where a campaign touches public bodies or elections.

How long should the policy be?

Long enough to name each flow and its lawful basis, short enough to read in one sitting. Most teams manage two to four pages. Anything longer usually describes internal process rather than what people are told.

Who should approve it?

A senior owner in sales or revenue plus a data protection lead. Keep the sign-off in writing, with a date and a version number.

What if a vendor refuses our terms?

Do not put personal data into the tool until the gap is closed. Record the decision and the alternative you chose.