Rules and ethics
Part of SAAS marketing rules and ethics explained for UK teams
Seven steps to write a SAAS marketing disclosure policy
A seven-step SaaS marketing disclosure policy for UK teams, covering claim ownership, ad labels, evidence, data protection, international transfers and review.
What to take away
- The usual mistake is writing the policy around current channels rather than the claims the business makes.
- A workable policy names an owner, defines approval triggers and gives clear disclosure wording before anyone drafts campaign copy.
- In England, the ASA administers the CAP Code. Consumer-facing unfair commercial practices are covered by the Digital Markets, Competition and Consumers Act 2024, while B2B misleading advertising is covered by the Business Protection from Misleading Marketing Regulations 2008; enforcement can involve the CMA or local Trading Standards.
- Marketing data rules include the UK GDPR, the Data Protection Act 2018 and PECR. International transfers may need an approved transfer mechanism.
- This article is general guidance. Individual cases need a qualified adviser.
Start from the claims register
Most teams begin with someone else's template and end up with a policy that describes a company they do not run. Begin instead with a register of every claim the business makes in public: pricing, performance, security, integrations, customer numbers.
Claims register fields
- Claimpricing, performance, security, integrations
- Where the claim appears
- Who can evidence it
- When it was last checked
- Unevidenced claimsdo not market
For each line, record where the claim appears, who can evidence it and when it was last checked. A claim that cannot be evidenced should not be marketed.
Seven steps to a policy
- Name the owner and approvers.One named role owns the policy. Set a clear approval trigger: every quantified performance, comparative, security or named-customer claim needs approval from a second role, typically legal or finance.
- Define disclosure in plain terms.A disclosure is any statement a reasonable reader needs to understand a marketing message correctly. That covers paid placements, affiliate links, gifted research and sponsored content.
- Set labelling rules.Use clear wording such as “Ad” or “#ad” at the start of paid or gifted content, and “Paid partnership with [brand]” for a platform-branded post. Put the label where readers will see it before engaging with the content; do not rely on ambiguous tags such as “partner” or “collab” alone.
- Map the evidence trail.For each claim type, say what evidence is acceptable: a signed contract, a dated dashboard export or a test report. Set and record a retention period for each evidence category, its deletion trigger and who reviews it. There is no single retention period for every marketing record: justify the period by the purpose, the UK GDPR’s storage-limitation principle for personal data and any applicable limitation period; keep records longer only where a complaint, investigation or dispute requires it.
- Cover data and targeting.Explain which audiences may be targeted and document the lawful basis under the UK GDPR and Data Protection Act 2018. Check PECR separately for electronic marketing, including when consent or the soft opt-in is required, and explain how suppression requests are honoured across tools.
- Add the cross-border rule.Assess whether a transfer of campaign data outside the UK is a restricted transfer under the UK GDPR. Where no UK adequacy regulations apply, specify the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, complete a transfer risk assessment and name who signs it off. Check the ICO’s guidance on international data transfers when selecting and applying the mechanism.
- Set the review cycle.Claims drift as products change. Schedule a quarterly check and a full rewrite each year, with the register as the working document.
The steps matter less than the sequence. Skipping the register produces a policy that cannot be applied to real campaigns.
Train the people who publish
A policy nobody has read is decoration. New joiners in marketing, sales and partnerships should confirm they have read it within their first month. Anyone buying paid media should know the labelling rules, which is why LinkedIn's ads certification is a useful baseline for B2B ad buyers.
Keep a one-page summary for freelancers and agencies. Their contracts should require the same standard, and the policy should name who checks their work.
Keep records that survive a complaint
If a complaint reaches a regulator, the question is what you knew and when. Store the claim register, approvals, evidence files and published assets together, with dates.
For a wider view of how marketing rules interact across channels, see our guide to UK rules and compliance. It sets the policy in the context of the other obligations a software firm carries.
Adapt it for England
England-specific points are narrower than teams expect. Advertising standards are set UK-wide, while some consumer and data rules interact with England and Wales procedure. If your customers are consumers rather than businesses, the risk profile changes and the wording rules tighten.
Our overview of marketing regulations in England explains where those differences bite for software firms selling into the domestic market.
Common questions
Does a disclosure policy need legal sign-off?
Not always. A policy built on a claims register and reviewed by the named approver is often enough. Sign-off is sensible for health, financial or security claims, or where you sell to consumers.
How long should the policy be?
Long enough to be usable. Many teams run a two-page core plus a register. What matters is whether a new marketer can apply it on a first campaign.
What happens if we get a disclosure wrong?
The remedy depends on the claim, the audience and whether it was corrected. Keep the evidence trail and correct the asset promptly. Take advice on anything involving consumer contracts or regulated claims.
