Why prospecting software compliance rules must be set before you scale

What to take away

The rules that apply to prospecting software

PECR and electronic marketing

The Privacy and Electronic Communications Regulations, usually shortened to PECR, govern electronic marketing in the UK. They sit alongside data protection law rather than replacing it. If your prospecting software sends email, SMS or automated calls, PECR applies to each message you send.

For email marketing to individuals, consent is normally required. Business-to-business email can sometimes use the softer consent rule, but it is narrower than many sales teams assume. It does not cover sole traders as people expect, and it never removes the need for a clear opt-out.

The ICO's direct marketing guidance explains how PECR applies to different channels and recipient types. Use it alongside the ICO's PECR training videos when configuring sequences in lead generation software; the videos are an introduction, not a substitute for checking each campaign.

PECR also reaches past outbound messages. It covers cookies and similar technologies on your own website, so a tracking pixel on a landing page or analytics on a demo booking form sits inside the same framework.

Treating a purchased list as if it were consented data is a common mistake. The sender remains responsible for checking how the data was collected, what people were told and whether the required permission covers the proposed channel and message. A supplier's assurance alone does not establish that a list can lawfully be used.

Agencies and freelancers do not absorb that responsibility for you. If a contractor sends sequences from your domain on your behalf, the duties stay with your organisation. Brief them on your routine and check what they actually send.

UK GDPR and the Data (Use and Access) Act 2025

UK GDPR sets principles that shape everything else, among them lawfulness, fairness, transparency and purpose limitation. Data minimisation, accuracy, storage limits and accountability follow from the same framework. Prospecting software touches most of them.

For personal data, UK GDPR Article 6 lists six lawful bases: consent, contract, compliance with a legal obligation, vital interests, public task and legitimate interests. Choose and document the basis that fits the purpose; legitimate interests does not remove any separate PECR requirement for sending marketing.

Enrichment adds personal data, and scoring creates inferences about people who never spoke to you. Sync features move records between systems, sometimes between countries. Each of those is a processing operation with its own justification.

The Data (Use and Access) Act 2025 amends parts of the framework, including provisions that bear on marketing data and automated decisions. The Act's text on legislation.gov.uk is authoritative. Read it with your data protection lead and check commencement dates and transitional provisions before deciding which rules apply.

Accountability does the heavy lifting. Keep records of what you collected, why, where it is stored and who can see it. Add retention periods and what happens when someone objects. A tool that cannot produce those records is a liability, not an asset.

For further implementation detail, our guide to prospecting software data protection in England shows how to map those records to the systems you already run.

Restrictions on solely automated decisions rarely bite on lead scoring. Profiling still triggers transparency duties, though. If scoring decides who gets credit terms, or who is turned away, check the position before you switch the feature on.

Sending data outside the UK adds another layer. Check where your vendor stores and processes records, and what transfer mechanism covers the move, before you load a single contact.

Where outreach crosses into advertising and competition rules

The CAP Code and non-broadcast marketing

The Committee of Advertising Practice Code, enforced by the Advertising Standards Authority, covers non-broadcast marketing communications. That takes in many online and direct marketing messages, not only display ads. The CAP non-broadcast advertising code is the reference point.

Most problems follow a few patterns. Marketing has to be obviously identifiable as marketing, and any claim needs evidence behind it. Targeting must not exploit vulnerability or breach data protection rules.

Testimonials and case-study numbers on a landing page are claims as well. If a customer quote says a tool doubled pipeline, keep the evidence behind it on file. The same goes for a headline promising a set number of meetings each month.

For further examples, our article on prospecting software advertising rules in England looks at how the code applies to sequences, landing pages and lead magnets.

Enforcement usually begins with a request for substantiation. The ASA can require changes and publish a ruling that names the advertiser, which is where the commercial damage tends to land.

Competition, consumer law and unfair commercial practices

The Competition and Markets Authority enforces rules against unfair commercial practices and anticompetitive behaviour. Its CMA regulator page on GOV.UK sets out its role and powers. Two risks stand out for buyers of prospecting software.

Misleading claims about data provenance are a commercial practice issue, not only a data protection one. A vendor that describes its database as "fully consented" when it is not can mislead buyers.

Read the data-use clause in the order form before you sign it. Terms that let a supplier reuse your records, or that restrict what you can do with data you supplied, are commercial risks as much as legal ones.

Contract terms that block you from exporting your own records can raise competition questions too. Keep evidence of what you were told at purchase. Our note on prospecting software commercial contracts covers the clauses to look for.

Consumer protection powers now sit closer to the CMA than they once did. The Digital Markets, Competition and Consumers Act 2024 gives the regulator a direct route to decide breaches of consumer law and impose penalties, rather than going to court first.

For software buyers, the practical step is to keep the sales deck, order form and security questionnaire together. If a claim later proves wrong, that file is your evidence.

A working compliance routine for 2027

Step-by-step: from list build to send

Use this sequence as a checklist. Adapt it to your own risk appetite and have someone independent review it before increasing campaign volume.

Step three is where permission to send is checked, not assumed. A clean import is not a clean send: confirm that the recipient type, channel and evidence meet the applicable rule, and carry objections through every connected system so an opt-out is not followed by another sequence.

There is no general contact-count threshold at which prospecting becomes compliant or non-compliant, and volume alone does not automatically require a data protection impact assessment (DPIA). The practical risks grow with the number of records and systems involved: inaccurate source data, missed objections and weak audit trails can affect more people and become harder to correct. A DPIA is required before processing that is likely to result in a high risk to people's rights and freedoms, so assess the nature and context of enrichment, profiling and automated ranking rather than relying on a volume rule.

Write the routine where the work happens. A sequence builder that requires a source field will hold the line better than a spreadsheet nobody opens. Where the tool allows it, make the source and opt-out fields mandatory before a contact can enter a campaign.

Records, retention and supplier checks

Prospecting software makes it easy to accumulate data. That is also the risk. UK GDPR does not set one standard retention period for all prospects: set and document periods by purpose, such as active prospects, dormant records and closed-lost records. Delete or anonymise data when the period ends, unless a valid reason requires it to be kept, and retain only what is necessary to honour an objection.

Two formal records are often relevant. A record of processing activities under UK GDPR Article 30 records processing purposes, data categories, recipients and other required details where the record-keeping duty applies. A DPIA is required before processing likely to result in a high risk to people's rights and freedoms; the ICO's DPIA guidance explains how to assess and document that risk. Also check the ICO data protection fee self-assessment to establish whether your organisation must pay the fee and which tier applies.

Subject access and erasure requests are harder than they look in a connected stack. Know which systems hold the record, and test the process before a deadline forces you to learn it.

Supplier checks matter because you inherit the consequences of their compliance failures. Ask for their lawful basis, sub-processors, breach notification terms and deletion process. If they cannot answer in writing, treat that as a finding. For further operational detail, see our operations and delivery guide for 2027.

Breach response belongs in the same routine. Decide who assesses whether an incident is reportable, who contacts affected people and who keeps the timeline. Under UK GDPR, when a personal data breach is likely to result in a risk to people's rights and freedoms, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. A breach that is unlikely to create that risk does not require notification under this rule.

Keeping the routine honest

Compliance drifts when it is nobody's job. Give one person ownership of the routine and another the right to challenge it. Review complaint and opt-out data monthly. If a sequence is drawing complaints, pause it before a regulator asks.

New joiners inherit the routine, so put it in induction. Walking a new salesperson through the source field and the opt-out rules takes less time than fixing a badly built sequence later.

Transparency is part of keeping it honest. When you obtain personal data indirectly, UK GDPR Article 14 generally requires privacy information within a month, or by the first communication with the person or first disclosure to another recipient if that happens sooner; exceptions apply. The information must explain matters including the source and purpose of the data and the person's rights. Our article on prospecting software disclosure policy in England gives further examples of what belongs in a privacy notice and when a message should explain where the contact came from.

As campaigns grow, test whether your software can preserve a clear source record, apply an objection across connected systems and produce evidence for a specific send. Do not assume a tool's automation handles those duties: check the workflow with test records and pause campaigns if suppression or audit records fail.

Keep the ethics visible. Lawful is the floor. Ask whether a reasonable person would be comfortable receiving your message, and whether they would understand how you got their details. If the answer is no, change the sequence.

Log the decisions you take. A dated note explaining why you kept a list, or why you dropped a supplier, is worth more than a policy nobody has read. It also makes the annual review far quicker.

Common questions

Do I need consent for every cold email?

No. For email to corporate subscribers, PECR generally does not require prior consent, but the message must identify the sender and provide a valid way to opt out. Sole traders and some partnerships are individual subscribers: marketing email to them generally requires consent unless the PECR soft opt-in applies. That exception requires the contact details to have been obtained during a sale or negotiations for a sale, the marketing to concern your similar products or services, and an opportunity to refuse both when the details were collected and in each message. UK GDPR still requires a lawful basis where the message uses personal data. Document the rules you rely on for your audience and channel.

Does the Data (Use and Access) Act 2025 replace UK GDPR?

No. It amends parts of the UK data protection framework, so UK GDPR principles still apply. Read the text and check commencement dates rather than assuming a wholesale replacement.

Can I use a purchased list?

Only if you can show a lawful basis for contacting each person and the list was collected fairly. In practice, purchased lists rarely clear that bar for individuals. If you cannot evidence the basis, do not send. The sender carries responsibility, not the list vendor.

What happens if we get it wrong?

The ICO can fine organisations for serious breaches of PECR or data protection law, and the ASA can require changes to non-broadcast marketing. The CMA can act on misleading commercial claims. The practical cost often arrives first as complaints, deliverability damage and lost pipeline.

Official sources

• Data (Use and Access) Act 2025 privacy changes guidance
• ICO guidance on key concepts for direct marketing using electronic mail