Sending direct marketing: Choosing your lawful basis

You must have a valid data protection reason if you want to use people’s information to send your direct marketing messages. This is known in data protection law as having a “lawful basis”. The two lawful bases most likely to apply to sending direct marketing messages are consent and legitimate interests.

The Privacy and Electronic Communications Regulations 2003 (PECR) don’t have lawful bases. But PECR can affect your choice of data protection lawful basis. This is because sometimes PECR says you must have consent to send direct marketing. The standard of consent you must meet for PECR is the same as for data protection law.

The table below shows different methods of sending direct marketing along with the PECR requirement and the likely data protection lawful basis. Sometimes you’ll have a choice between using consent or legitimate interests.

Remember, there are conditions you must meet for consent to be valid. You can find more information about this in our consent guidance. Likewise, for legitimate interests, you must satisfy its requirements. For help with this, see our legitimate interests guidance.

For help complying with PECR rules, see our Canllaw i’r PECR.

Phone calls

Method	PECR requirement	Likely data protection lawful basis
Automated marketing calls (this is where a recorded message is played)	Consent	Consent
Live marketing calls in general (this is a call where a live person is speaking)	The number you want to call: isn’t registered on the Telephone Preference Service or Corporate Telephone Preference Service; and there is no previous objection to your calls.	Legitimate interests or consent
Live marketing calls to numbers registered on the Telephone Preference Service or Corporate Telephone Preference Service	The subscriber (the person named on the phone bill) notified you that they don’t object to your calls	Consent
Live marketing calls about claims management services	Consent	Consent
Live marketing calls about pension schemes by trustee or manager of a pension scheme or Financial Conduct Authority authorised	Consent OR You can meet a strict customer relationship	Consent OR Legitimate interests or consent

Electronic mail (eg emails and text messages)

Method	PECR requirement	Likely data protection lawful basis
Electronic mail marketing to people, sole traders and some types of partnership (called “individual subscribers” in PECR)	Consent OR Soft opt-in	Consent OR Legitimate interests
Electronic mail marketing to limited companies and other types of business (known as “corporate subscribers” in PECR)	No requirement (not covered by this part of PECR)	Legitimate interests or consent

Post

Method	PECR requirement	Likely data protection lawful basis
Postal marketing	No requirement (not covered by PECR)	Legitimate interests or consent

Latest updates

5 December 2022 - This content was published.