TPS, MPS, CTPS: the UK suppression regimes marketers must respect
Under UK PECR, marketers must screen telephone lists against TPS every 28 days and CTPS for partnerships and LLPs, with MPS wash expected for consumer postal campaigns by the ICO.
Handling DSARs for data you bought from a broker
UK GDPR Article 15 requires you to respond to a DSAR within one month, naming the data broker source, the lawful basis, and all personal data you hold on the individual.
The right to object in UK marketing: process and consequences
Under UK GDPR Article 21(2), individuals have an absolute right to object to direct marketing that cannot be refused or weighed against your legitimate interests, with permanent cross-channel suppression required.
How long can you keep marketing data under UK GDPR?
UK GDPR does not name a fixed retention period for marketing data, but Article 5(1)(e) requires you to keep personal data only as long as necessary, with 24 months from last engagement the defensible B2B standard.
Consent vs legitimate interests for B2B prospecting
For UK B2B cold outreach, legitimate interests under Article 6(1)(f) is almost always the correct lawful basis, but consent, PECR, and regulated-sector rules can shift the answer.
Article 14 notices: telling people you bought their data
UK GDPR Article 14 requires you to tell individuals you bought their personal data, within one month or at first contact, with a notice covering source, lawful basis, and rights including the right to object.
When do you need a DPIA for purchased marketing data?
A Data Protection Impact Assessment is mandatory under UK GDPR Article 35 for large-scale consumer data processing and automated profiling, but most targeted B2B prospecting to purchased lists does not reach that threshold.
What does the ICO say about buying marketing data?
The ICO does not ban bought marketing lists, but requires every buyer to verify the supplier's lawful basis, complete their own Legitimate Interests Assessment or check consent validity, and notify individuals under Article 14 within one month.
PECR explained: what UK marketers need to know about electronic marketing rules
PECR sets the UK rules for electronic direct marketing, requiring prior consent for most B2C email and SMS, TPS screening before telephone campaigns, and clear opt-out mechanisms in every message.
UK GDPR vs EU GDPR for marketers buying data
UK GDPR and EU GDPR share the same six lawful bases and eight data subject rights, but diverge on supervisory authority, adequacy mechanisms, and electronic marketing rules that matter to every marketer buying contact data.
How to write a Legitimate Interests Assessment for B2B prospecting under UK GDPR
A step-by-step guide to completing a Legitimate Interests Assessment for B2B prospecting under UK GDPR, covering the purpose, necessity, and balancing tests with practical examples for UK marketers.
Can you use legitimate interests as the lawful basis for B2B data under UK GDPR?
Under UK GDPR Article 6(1)(f), legitimate interests is a valid lawful basis for B2B prospecting, provided you complete a documented Legitimate Interests Assessment and honour opt-outs.