Marketing automation software: PECR consent checklist

Send-eligibility checklist: can this message go out?

Work through these checks for each automated email or SMS journey before it starts. They draw on the Privacy and Electronic Communications Regulations 2003 (PECR), UK GDPR, the Data Protection Act 2018 and the ICO's direct marketing guidance. If any answer is no, hold the send.

The sections below explain each check.

Before launch: prove the right to send

A platform field marked "opted in" is not permission unless you can show how that status arose. A supplier's name or an automation switch does not create consent, and bought contact data does not make the seller's permission transferable to the new sender.

Before the first automated email or SMS, identify a UK GDPR lawful basis and confirm PECR permission. Regulation 22(2) requires prior consent for unsolicited electronic mail to individual subscribers; regulation 22(3) provides a narrow exception. PECR operates alongside UK GDPR and the Data Protection Act 2018. SMS follows the same rule as email.

Apply the ICO consent guidance: consent must be freely given, specific, informed and unambiguous. Silence, pre-ticked boxes and inactivity are not enough. Work through the legal questions on sender identity, lawful basis, PECR permission, wording and withdrawal before relying on an automated send.

Individual and corporate subscribers

PECR treats the two groups differently. Individual subscribers include private persons, sole traders and some partnerships, and need consent or the soft opt-in. Corporate subscribers, such as limited companies and public bodies, can be emailed without prior consent. You must still identify yourself, give a valid opt-out address and respect objections.

UK GDPR still applies where a corporate address identifies a person, such as a named work email. Record which type each contact is, because a single list often mixes both, and treat an unclear contact as an individual until you know otherwise.

At collection: distinguish the exception from permission

A seller's assurance is not your consent. A purchased list with generic wording does not establish permission for your organisation, and the soft opt-in does not cover cold contacts obtained from a third party with no prior relationship.

The soft opt-in can cover email and SMS only when details were obtained during a sale or negotiations for a sale, messages concern the sender's similar products or services, and an opt-out was offered both at collection and in every message. Miss one condition and the exception does not apply.

Use plain wording that names the sender, message type and frequency, with an opt-out at collection. For example: "We will send you occasional emails about similar products and services. You can opt out at any time using the link in every message." Version the wording and retain each version for the contacts who saw it.

In the contact record: preserve what the person saw

A timestamp and an opt-in flag do not show what a person agreed to. If the wording has changed, or the record contains only a version number, you may be unable to establish which text appeared, how permission was captured, or whether the evidence relates to that contact and channel.

Keep a fixed record for each person and each permission. The automation platform should store the exact wording shown, its version, the date and time, source, capture method, IP address, form or page URL, channel and permission status. Lock the wording so ordinary users cannot alter the evidence.

Use this as a quick record check:

Test the configured account and integrations, not just a product name. When assessing HubSpot, Mailchimp, Klaviyo, Dotdigital, ActiveCampaign or Salesforce Marketing Cloud, ask the supplier to show that each field is captured, retained and exportable. Map permission evidence before migration, then sample ten contacts to confirm you can show what each person saw and when.

There is no fixed retention period in PECR. Keep evidence for as long as you rely on the consent, plus a reasonable period afterwards. The log is evidence, not permission: it cannot replace a lawful basis, valid PECR permission or a working process for withdrawal.

When a person changes their mind: update every route

Unsubscribe is not a one-time campaign action. A campaign built before someone withdrew may still proceed if the system checks permission only when the campaign is created, or reads a cached audience instead of the current consent state.

Make every sending workflow check live permission at send time, including SMS sequences, abandoned basket flows and re-engagement sends. Withdrawal must be as easy as giving consent and should be recorded. A data-protection trail needs to carry the updated state wherever a message could be sent.

An objection and a consent withdrawal are not the same: an objection may stop direct marketing processing entirely, while withdrawal ends the specific consent. Record the date, time, channel and method for either event. If live checks are unavailable, put a suppression layer in front of sends.

Beyond permissions: keep the organisation's evidence current

A consent log alone cannot demonstrate accountability. Without maintained processing records and a reconciliation between withdrawals, objections and suppression, a claim about permission is difficult to support. Writing a policy once does not show that the evidence or the workflow remains current.

Keep records of processing activities for marketing, naming purposes, data categories, recipients, retention periods and security measures. Check whether the organisation owes the ICO data protection fee under the Data Protection (Charges and Information) Regulations 2018. If it is not exempt, keep its entry on the ICO register current, and file the result of the fee check.

Maintain a consent register of wording versions, start dates and the contact groups exposed to each version. Keep a separate withdrawal register and reconcile it with suppression. Run a quarterly sample, check the withdrawal route and document the outcome. Apply the same audience logic and recovery discipline to campaign builds and workflow changes.

For an inherited list: test the evidence source by source

Consider a retailer whose email list has built up over several years from checkout, a lapsed loyalty scheme and a third-party competition, while the platform holds only an opt-in flag and a date. This is an illustrative example, not a reported case. The list cannot be treated as one permission group.

Rebuild the evidence by source. Contacts from checkout may meet the soft opt-in if the other conditions hold. Competition entrants usually need fresh consent, and contacts with no provable source should be removed from marketing sends or re-permissioned by a plain consent request. The platform stored what it was given; the failure lies in collection and record design.

When records leave the UK: assess the transfer too

Consent evidence is not separate from transfer controls. Consent records are personal data: they identify what a person agreed to. Many US-hosted platforms may store or provide access to those records, so the transfer question cannot be ignored.

UK GDPR does not ban transfers. The International Data Transfer Agreement is one possible safeguard; document why it fits. Before relying on a safeguard for data sent abroad, carry out a transfer risk assessment. Ask the vendor for its sub-processor list, data residency options and exit format.

For public sector buyers using Crown Commercial Service frameworks, transfer terms may sit inside the framework. Check them before signing. A vendor unable to answer questions about sub-processors, residency or exit format creates a procurement risk as well as a legal one.

Questions to put to a platform supplier

Use the answers alongside the supplier comparison test when you shortlist platforms.