GDPR and B2B Marketing: The Go-To Guide for UK Businesses

GDPR and B2B Marketing: The Go-To Guide for UK Businesses

GDPR changed the face of marketing and the use of personal data. In many ways, these data protection laws encouraged businesses to adopt best practice, and strongly discouraged the quick-fix approaches that often give marketing a bad name.

General Data Protection Regulation (GDPR), which came into effect in May 2018, is now a major priority for UK businesses – it has to be, legally. The rules have also since evolved, and businesses now need to understand how the UK GDPR, Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) work together.

One area that still causes confusion is legitimate interests. Businesses sometimes assume they need consent for any and all marketing activity. Others assume that legitimate interests means they can contact any business prospect they want. Neither is correct.

So, in this guide, we’re explaining the main principles, the difference between consent and legitimate interests, and the practical steps you can take to make your B2B marketing more responsible and effective.

Note: This guide covers UK data protection and marketing rules. It provides general information, not legal advice. The right approach depends on the data you use, the people you contact and the marketing activities you carry out.

If you don’t have time to read everything, here’s our key takeaways:

  • UK GDPR governs how you use personal data. PECR governs how you send electronic marketing. You need to comply with both.
  • Work contact details for named individuals can still count as personal data.
  • Legitimate interests must be assessed and documented through an LIA, not assumed. It can’t replace consent where PECR requires consent.
  • Limited companies and LLPs can generally be emailed without consent. Sole traders and some partnerships generally can’t, unless the soft opt-in applies.
  • Buying a list doesn’t make using it lawful, so check where the data came from.
  • Keep privacy notices clear, record objections and make unsubscribing easy.

Jump to a section:

What is GDPR?

GDPR stands for General Data Protection Regulation. The original EU regulation came into force on 25 May 2018 and is, according to them, “the toughest privacy and security law in the world”. While it’s an EU-based legal framework, it imposes obligations on organisations from anywhere, so long as they target or collect data related to people in the EU.

Following Brexit, the UK retained its own version of the framework, commonly referred to as the UK GDPR, alongside the Data Protection Act 2018. The UK also has PECR, which sets out separate rules governing electronic marketing.

Together, these laws protect individuals’ personal information and how it is collected, used, stored and shared. In a time when it’s practically automatic that people entrust their personal data with cloud services, this confidence and control is crucial.

Who does GDPR affect?

If your business processes the personal data of any EU citizen, you must comply with GDPR. ‘Personal data’ means anything that can be used to identify a person, even indirectly: this includes names, photos, contact details, posts on social networks, medical information and IP addresses.

The UK GDPR, as well, applies to all organisations that process personal data within its scope. It can also apply to organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour here.

This matters to B2B businesses because a person’s professional contact details can still be personal data. A named employee’s work email address, direct telephone number or job-related profile may fall within data protection law, even when the information’s used for business purposes.

Businesses therefore need to understand what personal data they hold, why they hold it, how they use it and what lawful basis supports that use.

For more information, see the ICO’s guide to data protection.

Are there fines for non-compliance?

Oh yes – serious infringements of the GDPR can attract hefty fines. These max out at £17.5 million (€20 million) or 4% of an organisation’s total annual worldwide turnover in the preceding financial year – whichever is higher. Also, data subjects have the right to seek compensation for damages.

That said, the maximum is not the penalty for every breach. Enforcement depends on the circumstances, the nature of the infringement and the applicable legal provisions. However, businesses should never treat GDPR compliance as simply an administrative exercise. Especially since poor data practices also damage customer trust, disrupt marketing and create reputational risks.

What does GDPR mean for B2B marketing?

This is a particularly important question because GDPR actually works differently for B2C and B2B marketing. The legal difference between these activities is derived from an older piece of EU legislation – the Privacy in Electronic Communications Regulations (PECR) – which remains in force.

So, GDPR offers two legal bases for marketing purposes. First, consent, in which a data subject (the individual customer, contact or body) has agreed to specific marketing activities.

Second, legitimate interest, in which a business’ day-to-day operations necessarily include some degree of marketing to data subjects.

Under PECR, legitimate interest cannot be used to justify B2C marketing. This is because legitimate interest only applies in instances that involve contacting an individual in their capacity as an employee of an organisation, using a corporate email address, phone number or otherwise, and not their personal ‘non-work’ contact.

So with B2B marketing, the two sets of rules work in the following ways:

  • UK GDPR and the Data Protection Act 2018 govern the processing of personal data, including the lawful basis for using it and individuals’ rights.
  • PECR governs certain marketing communications, including emails, texts, cookies and telephone marketing. The rules depend on the type of communication and the person or organisation being contacted.

The distinction matters because having a lawful basis under the UK GDPR does not automatically give you permission to send a particular marketing message under PECR.

Comparison of UK GDPR and PECR: UK GDPR governs how you use personal data, PECR governs how you send electronic marketing, and B2B marketers need to comply with both

For example, you can generally send unsolicited marketing emails to a corporate subscriber, such as a limited company, without consent under PECR. But if you’re emailing a sole trader or certain types of partnership, you will generally need consent or a valid soft opt-in.

Where personal data is involved, you must also comply with data protection law. This includes being transparent about how you use contact information and respecting individuals’ rights.

Six lawful bases for processing personal data

The UK GDPR sets out six lawful bases for processing personal data. Before using that data, an appropriate basis must be established for each processing activity. No single basis is automatically preferable in every situation, but here are the options:

  1. Consent: The individual has freely agreed to the processing for a specific purpose.
  2. Contract: The processing is necessary to enter into or perform a contract with the individual, or to take steps they have requested before entering into a contract.
  3. Legal obligation: The processing is necessary to comply with a legal obligation.
  4. Vital interests: The processing is necessary to protect someone’s life.
  5. Public task: The processing is necessary to perform a task in the public interest or exercise official authority with a clear basis in law.
  6. Legitimate interests: The processing is necessary for a legitimate interest pursued by your organisation or a third party, unless the individual’s interests, rights or freedoms override it.

For many commercial marketing activities involving personal data, legitimate interests may be appropriate. But it must be assessed, not assumed, and it can’t be used to bypass a separate requirement for consent under PECR.

What is legitimate interest?

Legitimate interest is a legal ground on which businesses can process the personal data of their existing audience. It allows an organisation to process personal data when it has a genuine, lawful purpose and the processing is necessary to achieve that purpose. As long as the individual’s interests, rights and freedoms do not override that purpose, that is.

For example, a business may have a legitimate interest in contacting relevant professionals about a service that could help them do their jobs. But first, it must consider the relevance of the communication, how the information was obtained, the individual’s reasonable expectations and the potential impact on their privacy.

Rather than an objective restriction, legitimate interest is a subjective option: it involves weighing marketers’ right to market against individuals’ right to privacy. If marketers offer a compelling case for why someone may be interested in their goods or services, they can continue marketing to them – as long as the recipients are clearly informed of what’s happening and the marketer gives them a clear opportunity to opt out.

Importantly, legitimate interest is not blanket permission to market to anyone whose contact details you can get your hands on. You need to be able to explain why the processing is justified and demonstrate that you’ve considered the individual’s rights.

How do I know whether legitimate interests apply?

It’s all rather vague, we know, and GDPR itself admits that the “regulation itself is large, far-reaching, and fairly light on specifics”. Fortunately, the ICO stepped in to recommend a three-part Legitimate Interests Assessment (LIA):

  1. Identify the purpose: What legitimate interest are you pursuing, and who benefits from the processing?
  2. Establish necessity: Is using this personal data necessary to achieve that purpose? Could you reasonably achieve it another way?
  3. Balance the interests: Do your interests outweigh the individual’s interests, rights and freedoms? Consider their reasonable expectations, the nature of the data and any potential harm or intrusion.

Record the assessment and the reasoning behind your decision, and if the circumstances change, review it. Ultimately, it’s that simple.

The key question is not simply whether you would like to contact someone. It’s whether the proposed use of their information is justified, necessary and proportionate.

When can B2B marketers use legitimate interests?

Legitimate interests are definitely useful for supporting some B2B marketing activities, but it depends on what information you use and how you contact the recipient.

Email marketing to limited companies

PECR’s consent requirement for unsolicited electronic marketing doesn’t generally apply to corporate subscribers, which includes limited companies and limited liability partnerships.

This means you can generally send unsolicited marketing emails to these organisations without consent under PECR.

However, if you use a named employee’s contact details, the UK GDPR likely still applies.

Email marketing to sole traders and certain partnerships

PECR treats sole traders and certain partnerships as individual subscribers, so you’ll generally need their consent before sending unsolicited marketing emails or texts, unless the soft opt-in applies.

The soft opt-in is a limited exception for when you obtained someone’s contact details during a sale or negotiations for a sale, are marketing your own similar products or services, and gave them a clear opportunity to opt out both when you collected their details and in subsequent messages.

Be careful not to assume that a publicly listed email address or a purchased contact record means you can send marketing emails.

Postal marketing and telephone calls

Postal marketing is not subject to PECR’s electronic-mail consent rules, although the UK GDPR may apply when you use personal data. Legitimate interests might work if your assessment supports it.

Telephone marketing has its own requirements. Before making live marketing calls, check the relevant Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS) register, as applicable, and respect any previous objection.

Chart of B2B marketing rules by channel: email to limited companies and LLPs generally needs no PECR consent, email to sole traders needs consent or soft opt-in, post may rely on legitimate interests, and live calls must be screened against TPS and CTPS

Consent is a clear, affirmative agreement to the processing of personal data for a specific purpose. Under the UK GDPR, it must be freely given, specific, informed and unambiguous. This means:

  • People must have a genuine choice
  • You must explain what they are agreeing to
  • Consent must relate to a clearly defined purpose
  • You must keep a record of the consent given
  • People must be able to withdraw consent easily

Pre-ticked boxes, silence and inactivity do not constitute valid consent.

Note: Consent is not the only lawful basis for processing personal data, but where consent is required for marketing under PECR, you cannot replace it with legitimate interests.

Do I need double opt-in?

Double opt-in means someone submits a sign-up form and then confirms their subscription by clicking a link in a follow-up email.

That’s quite advanced, however, and isn’t a universal UK GDPR requirement. However, it certainly helps verify email addresses, demonstrate active subscription, and improve the quality of your marketing list.

Can I use bought-in contact lists for B2B marketing?

Bought-in data has long been used to help businesses identify relevant prospects, but purchasing a list (even through lawful channels) doesn’t make its use lawful.

Before using a list, establish where the information came from, how recently it was verified, what the supplier told individuals about its use and whether your intended marketing activity is permitted.

Ask the supplier for evidence of how the data was collected and what permissions or other lawful grounds support its use. Check that the information is relevant to your target audience, and don’t assume that publicly available contact details are automatically fair game.

Where consent is required under GDPR or PECR, the supplier’s assurances alone do not remove that requirement.

How do I implement legitimate interests in practice?

A documented LIA is one part of the process, but you should also have clear systems for managing data and marketing activity. Here are our recommendations:

1. Audit the personal data you hold

Identify what information you collect, where it comes from, where it’s stored, who can access it and why you use it.

‘Data’ constitutes everything a business knows about its clients, customers and marketing contacts, including written records, voicemail, CCTV recordings and business cards in desks. This includes personal data that can be used to identify individuals, such as names, addresses, phone numbers, IP addresses and demographic information.

Your audit needn’t take longer than necessary. Keep it focused on compliance, and seek to demonstrate your awareness of the new wider meaning of the term ‘personal data’ under GDPR.

2. Document your lawful basis

For each relevant processing activity, record the lawful basis you’re relying on and why it applies. If you use legitimate interests, retain your LIA and review it when the purpose, audience or processing changes.

Note: Don’t choose a lawful basis simply because it feels like it might make marketing easier – it has to fit the actual activity.

3. Update your privacy notice

Under GDPR, privacy notices must be easy to find and easy to understand. Yours should explain why your business is collecting data, how it will use it, and how long you’ll be keeping it for. You should also offer users a clear, unambiguous and affirmative way to opt out.

This may require you to update your website. For B2C marketing, you’ll need to request explicit consent for data collection, and if your business has a B2B focus, you’ll need to explain your procedures and controls so that subjects know how to request their data.

4. Make opting out straightforward

People have an absolute right to object to the processing of their personal data for direct marketing. Once someone objects, you need to stop using their data for that purpose (straightforward, though you might not like the answer).

Make sure all your marketing emails have a clear, functional unsubscribe or opt-out method, and that objections are recorded and acted on across relevant systems.

It’s important here not to simply delete an objector’s details if this could result in their information being re-added to a future list.

5. Review your data suppliers and systems

Check the privacy and security practices of suppliers that provide, store or process personal data on your behalf. Where required, put appropriate contracts in place and understand who is responsible for each part of the process.

Review access permissions, retention periods, backups and security controls. If personal data is transferred outside the UK, assess whether the applicable international-transfer rules are met.

GDPR compliance checklist for B2B businesses

All of this can be rather vague or hard to action – we get it. So, here’s a checklist we’ve compiled to help you stay on track and identify areas that may need attention:

  • Audit the personal data you hold and where it came from
  • Document the purpose and lawful basis for each relevant processing activity
  • Carry out and record a LIA where you rely on that basis
  • Check that your email, text and telephone marketing comply with PECR
  • Review bought-in data and the evidence supplied by data providers
  • Update your privacy notice and data collection forms
  • Make it easy for people to withdraw consent or object to direct marketing
  • Establish processes for data access requests and other individual rights
  • Review data retention, security controls and supplier contracts
  • Train staff to handle personal data responsibly and report potential breaches
  • Check whether international data transfers require additional safeguards
  • Review your processes regularly as your business, technology and the law change

GDPR compliance is an ongoing responsibility

Data protection didn’t spell the end of effective B2B marketing, though many feared it would. It does, however, require businesses to be clear about who they contact, why, and how they use personal information.

Legitimate interests can be a useful lawful basis for appropriate B2B marketing, but it’s not a shortcut around consent requirements or individuals’ rights. The best approach is to understand the rules for each channel, use relevant and reliable data, document your decisions and make it easy for people to control how their information is used.

Over the last few years since GDPR laws came out, we’ve found that responsible data practices actually support better marketing. When your data is accurate, your targeting is relevant, and your communications respect the recipient, you’re better placed to build trust rather than simply add more names to a database.

If you’re reviewing your marketing strategy and want to understand where your processes could be more effective, take The Marketing Centre’s Marketing 360 Assessment to identify areas for improvement. Alternatively, give us a call at 020 8012 8281 – we’d be happy to help you figure it all out.