When to check lead generation software compliance

What to take away

The 2003 electronic marketing regulations still cover email, SMS and calls, with data protection duties on top.
Buying prospect data transfers no consent, and the ICO holds the sending organisation accountable.
Public sector targeting in England works better when ONS statistics anchor the territory plan.
A short pre-campaign checklist catches most routine problems before a send goes out.
Borderline cases need a qualified adviser rather than a template.

What the electronic marketing rules cover

The rules that shape most lead generation sit in The Privacy and Electronic Communications (EC Directive) Regulations 2003. For lead generation software, check these alongside the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018: PECR governs unsolicited marketing by email, SMS and telephone, while UK data protection law governs personal-data processing. These rules apply across the whole UK, not England alone.

Which electronic marketing rule applies

Is the subscriber an individual (e.g. sole trader)?

Yes

prior consent generally needed

corporate subscriber, lawful basis still required

Two things usually decide which PECR rule applies: the channel and the type of subscriber. Unsolicited email to an individual subscriber such as a sole trader generally needs prior consent. Corporate subscribers are treated differently under PECR; where contact data identifies an individual, UK GDPR still applies and you need a lawful basis for processing it.

The soft opt-in is narrow. It can cover similar products where details were gathered during a sale or negotiation, but each message still needs a clear opt-out at the point of collection and in the send itself.

Live calls add a layer. Screen numbers against the Telephone Preference Service and the Corporate Telephone Preference Service, and log the date you checked them.

Check software at each campaign stage

At setup:Map the software's email, SMS and dialler functions to the relevant PECR rules. Configure fields for data source, consent evidence and suppression, and check the privacy information presented to people.
Before each list import:Verify the source, collection date, wording, organisations named, subscriber type, lawful basis for personal data and suppression status. Do not treat a supplier's assurance as proof.
Before enrichment:Check that the new source and intended use are covered by your privacy information and lawful-basis assessment. Record where the added data came from.
Before activating a dialler or starting calls:Screen current numbers against the TPS and CTPS, and log the check date. Repeat the check after list changes and before later call rounds.
Before each email or SMS send:Check the audience, subscriber types, suppression list, sender identity and working opt-out. Repeat the relevant checks if the channel, purpose, source or software workflow changes.

Why bought prospect data carries no consent

The ICO's Direct marketing guidance and its guidance on using the services of data brokers make clear that buying a list does not transfer consent or responsibility. The organisation doing the marketing remains responsible for its own checks and compliance, even when a broker supplied the file.

Four questions for a data broker

What is the source of each record?
When was it collected?
What wording did the person see?
Which organisations were named at that point?

Before loading a list, ask the supplier four things. What is the source of each record? When was it collected? What wording did the person see? Which organisations were named at that point? If the answers are vague, treat the file as unusable.

Keep those answers on file with dates. If a complaint arrives, the regulator will ask what checks you ran and when, so a dated audit trail carries more weight than a supplier's verbal assurance.

What changes when you target public sector buyers

ONS statistics on government, the public sector and taxes can help you size departments and build territory plans. They do not establish that contact data can lawfully be used: apply the same PECR and UK data-protection checks to public-sector contacts, and treat procurement requirements as a separate matter.

England's public sector sits alongside the devolved administrations in Scotland, Wales and Northern Ireland. A territory model built only on Whitehall departments will miss councils, trusts and arm's length bodies.

When disclosure duties bite

When lead generation software collects or enriches personal data, check when the information is obtained and when the relevant privacy information must be provided. For direct collection, check the notice at the point of collection; for imported or enriched records, check the applicable UK GDPR transparency requirements before putting the data to use. The notice should cover the purposes, lawful basis, data sources and recipients.

Record the version of the notice you showed and the date it went live. A prospect who asks later will want both.

A pre-campaign checklist for UK teams

Run this before every send or call round, and keep the completed version.

Confirm the lawful basis for processing personal data before the file is loaded; consider consent or legitimate interests where appropriate.
Record whether the recipient is a corporate or an individual subscriber.
Store consent evidence with its source, date and wording.
Set out in writing who is controller and who is processor.
Screen call lists against the TPS and CTPS, and emails against your suppression list.
Include your organisation's name and a working opt-out in every message.
Log when each record was last contacted and when it should be reviewed or deleted.

This is general guidance rather than legal advice, so a qualified adviser should review anything unusual.

Where the wider programme sits

Repeat the relevant checks when you change the data source, purpose, audience, channel or software workflow. Review retention at the date set in your schedule, and when the campaign ends or you no longer need the records.

Common questions

Do these rules apply only in England?

No. The electronic marketing regulations and the data protection regime run across the UK. England-specific work is mostly about which public bodies you target and how those contracts are procured.

Can we email a work address without consent?

The consent requirement bites hardest on individual subscribers, including sole traders. Corporate subscribers are treated differently under PECR, but UK GDPR still applies when the contact data identifies an individual. Identify a lawful basis, such as consent or legitimate interests where appropriate, and provide a clear opt-out.

How long may we keep prospect data?

There is no single retention period. Under UK data-protection law, keep records only while you need them, write down the reason and set a review date. Delete or re-verify them at that review, and review sooner if the campaign ends or the purpose for keeping the data changes.