SAAS marketing data protection without the legal fog

What to take away

A SaaS marketing team in England emails 40,000 trial users, runs LinkedIn ads to a named-account list and hosts customer reviews on its own domain.

Start with the lawful basis

Under the UK GDPR, marketing that uses personal data needs a lawful basis before the first send. Consent is one option, legitimate interests another. That choice decides what you tell people and how you answer an objection.

The UK GDPR is supplemented by the Data Protection Act 2018. Article 6 sets out six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Identify which basis applies to each purpose; consent or legitimate interests do not displace PECR's separate rules for electronic marketing.

Record the basis in your processing records. If you rely on legitimate interests, complete an assessment and keep it.

Name the assessment as a legitimate interests assessment (LIA) and document how your purpose is balanced against people's interests and rights.

Check whether your organisation must register with the ICO and pay its annual data protection fee. Exemptions apply, so use the ICO's fee checker rather than assuming a SaaS business is exempt.

These duties apply UK-wide, in England as elsewhere. Teams that map them early avoid rebuilding campaigns later. The SAAS marketing UK rules and compliance guide for 2027 shows how data protection sits with the rest of a software firm's compliance work.

Consent and B2B email

PECR governs unsolicited electronic marketing, and its consent requirement applies to individual subscribers. Corporate subscribers such as limited companies are treated differently, so a list pulled from personal inboxes carries more risk than one built from company addresses.

The ICO's Direct marketing guidance explains how to apply PECR and UK GDPR to campaigns. Use it to check subscriber type, list source and how consent, soft opt-in and objections are recorded.

UK GDPR still covers the named individuals behind company addresses, and they hold rights over their own data.

Soft opt-in can cover existing customers where details came from a sale or negotiations, the message concerns similar products, and every message offers an opt-out.

Personalised advertising and account targeting

LinkedIn's Dynamic Ads format personalises creative to the accounts a marketer selects, so profile and company data shape what each person sees. That is processing, and it needs a basis.

Name the practice in your privacy notice, state what data feeds the personalisation, how long you keep it, and how someone can object. A line in a sub-processor list is not enough.

Make the data subject rights process operational: people can exercise rights including access, rectification, erasure, restriction, portability and objection. Respond without undue delay and normally within one month of receiving a request; an objection to direct marketing must be honoured for that marketing.

Complete a data protection impact assessment (DPIA) before processing likely to result in high risk. This can include systematic and extensive profiling with legal or similarly significant effects; not every personalised campaign requires a DPIA.

For the wider list of duties a software firm in England has to meet, SAAS marketing UK regulations in England groups them by marketing activity.

Cookies and tracking

PECR requires consent before storing information on, or accessing information from, a user's device, except where the technology is strictly necessary for a service the user requests. This applies to cookies and similar tracking technologies; personal data collected through them also needs a UK GDPR lawful basis.

The ICO's guidance on the use of storage and access technologies explains the PECR rules. Check non-essential analytics and advertising technologies before they are switched on, not just the wording of the privacy notice.

Other campaign data checks

Put a written contract in place when a processor handles campaign personal data, with the terms required by the UK GDPR. Check whether transfers of campaign data outside the UK need an adequacy decision or an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

Have a process to assess personal data breaches, report them to the ICO where required and inform affected people where the risk is high. A data protection officer (DPO) is required only when the UK GDPR's criteria apply, including certain large-scale monitoring or processing activities.

User-generated content and online safety

If customers can publish profiles, reviews or community posts, moderation decisions rest on personal data, so marketing and product share one problem.

The ICO's Online safety and data protection resource explains how data protection duties sit alongside content moderation, user reporting and material that identifies someone. Read it before building a review wall into a landing page.

Moderation records

Moderation logs hold names, IP addresses and sometimes allegations. Set a retention period, restrict access and tell users what you keep. Deleting a post is not the same as deleting the record.

Reviews you republish

Republishing a customer review in a campaign usually falls outside the original permission, so ask the reviewer for consent that covers marketing use and note the date.

Children's data raises the bar again. Under-18 access turns age assurance and data minimisation into marketing decisions too.

Ad claims and ASA rulings

Copy that promises a result is an ad claim, and the CAP Code expects evidence before publication. The ASA's published rulings show how those judgements are made, from pricing language to comparative performance claims.

Keep a dated record of the evidence behind each claim, and cut superlatives the product team cannot support.

A worked example

Illustrative figures only. A software firm in England budgets £6,000 a month on LinkedIn campaigns, £1,200 on a review platform and £800 on email, yet its privacy notice mentions analytics alone.

Closing that gap means updating the notice, adding a retention rule for moderation logs and briefing the campaign owners. The £8,000 monthly spend does not change. Individual cases still need a qualified adviser such as a solicitor.

Common questions

Does B2B marketing always need consent under PECR?

No. The consent requirement targets individual subscribers, and corporate subscribers sit outside it. UK GDPR duties still apply to the people you contact.

Can legitimate interests cover cold outreach?

Sometimes, if an assessment is completed and the individual's rights are properly weighed. It fits large-scale profiling badly.

Must a privacy notice name advertising platforms?

It should describe the purposes and the categories of recipients, which in practice means naming the platforms you use. Vague wording tends to fail when tested.