In the How-To Marketing for the UK sections, we provide you with guidance for how to take your product or service into the UK. Successful go-to-market strategies in each new country require an understanding of the market, setting realistic and measurable goals, and understanding what the opportunities are to reach target customers, and we give you resources and examples for what has worked and what hasn’t. Below are marketing regulations that apply when you are marketing in the UK.
Marketing Regulations in the UK
Navigating marketing regulations in the UK? Know your legal landscape. Several key frameworks apply, with overlapping considerations for data privacy and electronic marketing.
Data Protection:
- UK GDPR: Superseded the Data Protection Act (DPA) since January 2021 (post-Brexit). Governs all personal data processing, including marketing.
- PECR: Remains relevant alongside UK GDPR for electronic marketing activities involving personal data, such as email and cookies.
Other considerations:
- Consumer Protection from Unfair Trading Regulations (2008): Prohibits misleading advertising and unfair commercial practices.
- Sector-specific regulations: May apply depending on your industry (e.g., financial services, gambling).
Tip: Consult the Information Commissioner’s Office (ICO) for guidance on complying with these regulations. Remember, this is just a starting point. For in-depth guidance, always consult relevant legal professionals and regulatory bodies.
It is important to note, different types of marketing—phone, text, email, etc.—have different regulations and requirements, so you should understand the differences for each method you choose to use.
Data Protection Act
Marketing and personal data in the UK: UK GDPR reigns supreme
The Data Protection Act 2018 (DPA) works alongside the UK GDPR, which took effect in January 2021. UK GDPR governs all personal data processing, including marketing purposes.
Key points for marketers:
- Consent: Generally required for most marketing activities involving personal data.
- Transparency: Be clear about how you collect and use data.
- Individual rights: Respect rights to access, rectify, erase, and restrict processing of personal data.
- Lawful basis: Identify and document the lawful basis for processing personal data (e.g., consent, legitimate interests).
- Data security: Implement safeguards to protect personal data.
Specific principles relevant to marketing:
- Fairness and lawfulness: Inform individuals about your data collection and use, and obtain consent where required.
- Purpose limitation: Collect data only for the specified purpose and use it only accordingly.
- Data accuracy: Keep data accurate and up-to-date.
For detailed guidance, see the ICO’s UK GDPR guidance.
While Section 11 of the DPA is outdated, UK GDPR continues to grant individuals the right to object to marketing at any time, including through unsubscribe mechanisms. Promptly responding to opt-outs is essential.
Targeted advertising based on user data like browsing history or login info falls under UK GDPR, requiring transparency and consent. Non-targeted or contextual ads may not trigger GDPR obligations.
Compliance and enforcement: The ICO enforces UK GDPR through audits, guidance, and fines up to £20 million or 4% of global turnover.
Privacy and Electronic Communications (EC Directive) Regulations
Privacy and Electronic Communications (PECR) in 2025: Navigate electronic marketing in the UK
PECR remains applicable alongside UK GDPR. It specifically governs privacy in electronic communications and marketing.
PECR applies if you:
- Market by phone, text, email, or fax.
- Use cookies or similar technologies on websites.
- Compile telephone directories or similar public directories.
Key considerations under PECR:
- Consent: Generally required for most electronic marketing involving personal data. Opt-in mechanisms must be clear and accessible.
- Transparency: Be clear about collection, use, and storage of communication data.
- Privacy rights: Individuals can access, rectify, and erase communication data.
- Security: Implement safeguards to protect communication data.
Important terms:
- Electronic communications include phone calls, texts, video messages, faxes, emails, and internet messages but exclude publicly available content like website pages or broadcast programming.
Consent requirements: Consent must be clear, specific, and freely given for your company and marketing channel (email, phone call, text, fax).
The clearest method is using an unticked opt-in box. Pre-ticked boxes or opt-out boxes are not valid under PECR.
Opt-in example: Check if you would like to receive information about our products and offers: by mail / by email / by telephone / by recorded call / by text message
Opt-out example: “By submitting this form, you consent to receiving email marketing messages. To opt out, check here.”
See the ICO’s PECR guidance for more.
Can I use marketing lists?
Navigating marketing lists in the UK: Compliance is key
Using marketing lists requires compliance with both UK GDPR and PECR.
Bought-in marketing lists:
- Generally limited use due to strict consent requirements.
- Specific and recent consent for the exact marketing channel is required.
- Data accuracy and source must be scrutinized to avoid non-compliance.
- Screen lists against the Telephone Preference Service (TPS) for calls, and Fax Preference Service (FPS) for fax marketing.
- Transparency about data source and unsubscribe options are mandatory.
Building your own lists:
- Obtain explicit consent for each marketing channel.
- Use clear opt-in mechanisms.
- Maintain accurate consent records.
- Differentiate individuals from companies (B2B vs. B2C).
- Avoid pre-ticked boxes.
- Provide unsubscribe options in every message.
- Consider double opt-in for consent verification.
Sharing marketing lists:
- Obtain explicit, informed consent before sharing data with third parties.
- Be transparent about data sharing in privacy policies.
- Provide opt-out mechanisms for data sharing.
- Identify lawful bases for processing.
- Implement data minimization and data security.
- Document consent and sharing processes.
For legal advice, consult professionals. Further details at the ICO’s guidance on marketing lists.
Respecting Opt-Outs and Objections: Key Steps for UK Compliance
Respecting individual choices is critical under UK GDPR and PECR.
Responding to opt-outs:
- Add individuals to your “do not contact” list immediately.
- Send confirmation of opt-out and removal.
- Avoid further contact, including re-opt-in attempts.
Responding to objections:
- Address concerns professionally.
- Investigate and rectify issues.
- Comply with rights to object and restrict processing under UK GDPR.
Maintaining data:
- Retain data on “do not contact” lists for a reasonable period to avoid inadvertent contact.
- Securely store this data.
Enforcement and penalties:
- The ICO enforces PECR and UK GDPR, imposing fines up to £20 million for serious breaches.
- Prioritize compliance to avoid penalties and reputational harm.
Communications Act of 2003
Navigating Electronic Communications Regulations in the UK: The Role of the Communications Act 2003 and Ofcom
The Communications Act 2003 regulates electronic communications to protect individuals from misuse, including marketing-related issues like abandoned and silent calls.
Key points:
- Covers telephone calls, text messages, emails, and other electronic communications.
- Ofcom enforces the Act and investigates breaches.
- Prohibits abandoned calls (caller hangs up before answer) and silent calls (no voice transmitted).
- Ofcom can impose fines up to £2 million for serious breaches.
The Act also addresses unsolicited commercial communications, harmful online content, and privacy protections.
More details at Ofcom’s website.
The Consumer Protection From Unfair Trading Regulations of 2008
Protecting Consumers in the UK: Understanding the Consumer Protection From Unfair Trading Regulations 2008
The Consumer Protection from Unfair Trading Regulations (CPUTR) prohibit unfair, misleading, or aggressive marketing practices.
Four key categories:
- General Fairness: Prohibits conduct below the honest and fair standard.
- Misleading Practices: Bans deceptive messages, omissions, and exaggerations.
- Aggressive Sales Practices: Prohibits harassment, coercion, undue pressure, and exploitation of vulnerability.
- Banned Practices: Lists 31 prohibited actions like misleading price promotions and bait-and-switch tactics.
Since 2014, the Competition and Markets Authority (CMA) enforces the CPUTR. Non-compliance risks fines, investigations, brand damage, and criminal prosecution.
The CPUTR complements UK GDPR and PECR for comprehensive consumer protection.
Learn more on the CMA website.
Code of Non-broadcast Advertising, Sales Promotion, and Direct Marketing
Navigating Responsible Marketing in the UK: The Code of Non-broadcast Advertising and ASA oversight
The Code of Non-broadcast Advertising, Sales Promotion, and Direct Marketing (Non-broadcast Code), developed by the Committee of Advertising Practice (CAP), sets ethical standards for marketing outside broadcast media.
Role of the Code:
- Applies to print, digital, and other non-broadcast channels.
- Advertisers, agencies, and media must comply.
Enforcement:
- The Advertising Standards Authority (ASA) enforces the Code, investigates complaints, removes non-compliant ads, and requires amendments.
Key aspects:
- Truthfulness and honesty.
- Avoidance of harassment and offensive content.
- Protection of children and restrictions on age-restricted products like alcohol and gambling.
- Fair competition and transparency.
- Compliance with data protection laws (UK GDPR and PECR).
The Code is government-recognized and considered by courts. Compliance builds consumer trust, reduces complaints, and demonstrates ethical marketing.
More at the ASA website.
Direct Marketing Code of Practice
Navigating Direct Marketing in the UK: Codes and Legal Frameworks
Responsible marketing is guided by industry standards and legal frameworks.
- The Non-broadcast Code by ASA/CAP sets ethical standards.
- The ICO issues Direct Marketing Guidance to ensure compliance with UK GDPR and PECR.
While membership in the Direct Marketing Association (DMA) is not mandatory, adherence to these guidelines helps:
- Maintain high ethical standards.
- Minimize complaints and regulatory action.
- Respect individual privacy rights.
Relevant resources: