Rules and ethics
GDPR-compliant marketing automation in the UK: a seven-question demo checklist against PECR and ICO consent rules
Seven questions for a supplier demo that test GDPR-compliant marketing automation in the UK against PECR regulations 6 and 22 and ICO consent record guidance.
What to take away
- UK GDPR covers personal data. PECR adds its own rules for email marketing and for access to a device, and the tool has to evidence both.
- Check that the platform stores consent source, wording and timestamp, not just an on or off flag.
- Withdrawals and objections must suppress every channel, including triggered and API-driven sends.
- Ask for the data processing agreement and the sub-processor list before you sign.
- General guidance onlya specific setup needs a qualified adviser.
Sort the lawful basis before the shortlist
Most platform comparisons start with features and leave the legal question until implementation. Turn that order round. Decide the lawful basis for each purpose and message type first, using the strategy and planning guide, then check that the tool can record it.
A platform that treats every contact as marketed-to by default nudges you towards a basis you did not choose. You need a written record of the decision, not a recollection. Ask to see where that record lives in the product during the demo, and who can edit it.
What the rules ask of the tool
Compliance failures in automation are rarely about the copy. They sit in default settings: pre-ticked boxes, pixels that fire on page load, imported lists marked as subscribed, and unsubscribe links that miss triggered emails. The table maps each rule to a setting to inspect.
| Requirement | Source | What to check in the tool |
|---|---|---|
| Email consent | PECR regulation 22 | Opt-in recorded per channel, no pre-ticked boxes |
| Soft opt-in limits | PECR regulation 22(3) | A rule that limits it to similar products and services |
| Device access | PECR regulation 6 | Tags blocked until consent, and the choice logged |
| Consent records | ICO consent guidance | Source, data submitted, timestamp and form version |
| Withdrawal | UK GDPR Article 7(3) | One action that suppresses every workflow |
Regulation 22 of PECR stops anyone sending unsolicited direct marketing by electronic mail to individual subscribers unless the recipient has previously notified the sender that they consent. A narrow exception covers people whose details came from a sale or negotiations, for similar products and services only.
Regulation 6 says a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, subject to the exceptions it lists. Data protection is one gate among several, and the rules and compliance guide also covers advertising and consumer law.
A seven-question checklist for the demo
Bring this list to the demo. Each point is a question with a verifiable answer, not a feature to tick. A sales walkthrough will not volunteer weak points, so ask directly and write down what you are told.
- Ask where the consent record lives, and whether it exports with source, wording and timestamp intact.
- Check that a withdrawal suppresses every channel, including triggered, transactional-style and API-driven sends.
- Confirm tracking pixels and analytics tags load only after consent, not on page load.
- Test a list importcan it carry a source and a date, or does everyone default to subscribed?
- Ask for retention rules, and whether deletion can run on a schedule with a log of what was removed.
- Confirm the audit trail shows who changed an audience rule, and when.
- Get the data processing agreement and the current sub-processor list in writing before signature.
Score each answer as evidenced, promised or absent. Promised answers tend to become implementation costs later. See the migration checklist for what must survive a platform change.
Consent records and withdrawal inside the workflow
A consent flag is not evidence. The ICO consent guidance says records of online consent should include the data submitted and a timestamp linked to the relevant version of the data capture form. If the platform cannot export that, you cannot demonstrate it.
Withdrawal needs the same mechanical treatment as an unsubscribe. As the same guidance quotes Article 7(3), it must be as easy to withdraw consent as to give it. The suppression must reach every workflow, including onboarding and abandoned-basket sequences. The data protection guide shows how objections travel.
Retention closes the loop. Set a rule for contact records, event logs and exported reports, then check the platform can act on it. B2B teams should read how B2B lead nurturing handles imported lists before any send.
Contract and supplier evidence
The processing agreement is where consent and suppression become duties. Check processing on your instructions, sub-processor changes, deletion at the end of the contract and audit rights. The contract issues review lists eight to read before signature.
General guidance only. A specific setup needs a qualified adviser, particularly where special category data or children are involved.
Before you sign
- Record the lawful basis for each audience and message type.
- Confirm consent records export with source, data submitted and timestamp.
- Test that a withdrawal suppresses every workflow.
- Check that tags stay blocked until consent is given.
- Get the processing agreement and sub-processor list in writing.
Common questions
Does PECR apply to email marketing in the UK?
Yes. Regulation 22 covers unsolicited direct marketing by electronic mail to individual subscribers and needs prior consent, apart from the narrow exception for similar products and services. UK GDPR applies as well wherever personal data is processed.
Can we rely on the soft opt-in for a purchased B2B list?
No. The exception covers details obtained in the course of a sale or negotiations for a sale, for similar products and services only. A bought list does not meet that condition.
Is a cookie banner enough for tracking consent?
Only if non-essential tags stay blocked until consent is given and the choice is recorded. A banner that appears while analytics already fires does not meet regulation 6.
Who is responsible if the platform sends to someone who withdrew?
Your organisation carries the responsibility for its marketing. The supplier must follow your instructions, which is why the contract and the suppression logic both matter.
