How UK GDPR and ICO rules shape SaaS marketing lists

What to take away

SaaS marketing lists in the UK sit under two regimes at onceUK GDPR and the Privacy and Electronic Communications Regulations (PECR).
Consent is not the only route for business email. Legitimate interests can work, but only with a documented assessment and a clear opt-out.
The corporate subscriber exemption in PECR is narrower than most sales teams assume, and sole traders and some partnerships count as individuals.
International transfers need a tool such as the UK IDTA or the UK addendum, plus a transfer risk assessment.
A marketing data map and a suppression register turn compliance from a story into evidence the ICO can inspect.
Buying from data brokers does not transfer responsibility. Your SaaS business remains the controller for the list it mails.

Why UK GDPR and PECR both apply to SaaS marketing lists

Two rulebooks govern the same email. UK GDPR sets the principles, lawful bases and individual rights. The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) sets the channel rules for electronic mail, calls and cookies. A campaign that clears one can still breach the other.

UK GDPR applies whenever you process personal data, including a work email address that identifies a person. It operates alongside the Data Protection Act 2018 (DPA 2018), which sets out the ICO's statutory functions and enforcement powers. PECR applies when you send that person an electronic message. The Information Commissioner's Office (ICO) enforces these rules, and it can act on a single complaint from one recipient.

The split matters for a SaaS business because your list mixes types. A named inbox at a limited company, a generic inbox such as info@, and a sole trader's address all look similar in a CRM but are treated differently.

PECR's corporate subscriber exemption sits at the centre of this. The ICO's Direct marketing guidance explains how the exemption applies and when consent is required.

Sole traders and non-limited partnerships are treated as individuals under PECR, even when the address looks corporate. So are employees of a company when you email them at a personal address. Consent rules apply to those, not the exemption.

Regionally, the same rules bind a SaaS team in Greater London and one in Scotland or the North West. There is no devolved variation. What changes is the data you hold: Companies House records, HMRC filings and FCA registers differ in coverage, but PECR does not.

Treat channel and data law as one design problem rather than two reviews. Teams that do this early spend less time rebuilding lists later. Our guide to SAAS marketing data protection covers the wider picture for UK teams.

Choosing a lawful basis for B2B email under ICO guidance

You need a lawful basis before the first send, not after a complaint. UK GDPR lists six, and the ICO's Direct marketing guidance explains how to choose and record one.

Lawful bases for SaaS email

Consent

Typical use: Newsletters, cold outreach
Must record: What, when, how opted in
Fails when: Pre-ticked or bundled box

Legitimate interests

Typical use: B2B prospecting, upsell
Must record: Assessment, balancing test
Fails when: No balancing test done

Contract

Typical use: Onboarding, renewal emails
Must record: Which contract, necessity
Fails when: Message not necessary

Three bases do most of the work for SaaS marketing lists. Consent suits newsletters and cold outreach to individuals. Legitimate interests suits existing business relationships and some prospecting. Contract covers messages needed to deliver a service the customer already bought.

Choosing a lawful basis

Basis	Typical SaaS use	What you must record
Consent	Newsletter sign-ups, event lists, individual subscribers	What they were told, when they opted in, how
Legitimate interests	B2B prospecting, existing customer upsell	The assessment, the balancing test, the opt-out route
Contract	Onboarding, renewal and service emails	Which contract, why the message is necessary
Legal obligation	Security notices, billing records	The law that requires it

Consent under UK GDPR must be freely given, specific, informed and unambiguous. A pre-ticked box fails. So does a bundled acceptance buried in terms and conditions. You also need to name any third parties who will rely on the consent.

Legitimate interests is not a shortcut around consent. It requires a three-part test: identify the interest, show the processing is necessary, then balance it against the individual's rights and expectations. The ICO expects that reasoning in writing.

Keep the basis per contact, not per campaign. A prospect who consented to a webinar reminder has not consented to a monthly product email. Your CRM should store the basis as a field, not a paragraph in a notes section.

If your team is still mapping obligations, our piece on SAAS marketing UK regulations shows how the rules feed into a campaign plan.

Legitimate interest assessments and the soft opt-in for corporate subscribers

A legitimate interest assessment is a short document, not a legal essay. It should name the interest, the data used, the necessity argument, the balancing test and the safeguards. One page is usually enough if it is honest.

The balancing test is where most assessments fail. Ask what the recipient would expect from a company like yours, in their role, at that moment. A finance director expects pricing information. They do not expect a daily sequence about a product they have never heard of.

Safeguards do real work here. Limit frequency, keep the content relevant to the recipient's role, suppress anyone who has opted out, and make the unsubscribe link work in one click. Log each of those controls.

PECR adds a soft opt-in for email, but it is narrower than the name suggests. It applies where you obtained the details in the course of a sale or negotiations for a sale, you are marketing similar products, and you offered an opt-out at collection and in every message.

The soft opt-in is not a general licence for cold B2B email. It covers existing customers and near-customers for similar goods or services. A purchased list of strangers cannot use it, however corporate the addresses look.

Corporate subscribers still have rights under UK GDPR even where PECR's consent rule does not bite. They can object to processing based on legitimate interests, and you must stop unless you can show compelling grounds.

Record the assessment alongside the campaign, not in a shared drive nobody opens. When a complaint arrives, the ICO will ask what you weighed and when. Our article on SAAS marketing rules and ethics covers how to keep that reasoning consistent across channels.

International transfers: the UK IDTA, the addendum and transfer risk assessments

Most SaaS stacks move personal data out of the UK. A CRM hosted in the United States, a marketing automation tool in the European Union, a support desk in India: each is a restricted transfer under UK GDPR.

The ICO's guidance on International transfers sets out the tools available. The main ones are an adequacy regulation, the International Data Transfer Agreement (IDTA), and the UK addendum to the EU standard contractual clauses.

Adequacy is the simplest route. Examples of UK adequacy destinations include the EU/EEA, Japan and South Korea, as well as Canadian commercial organisations covered by the relevant adequacy decision. The UK-US data bridge covers eligible US organisations certified under the UK Extension to the EU-US Data Privacy Framework. The list and its conditions can change, so check them before you sign anything.

The UK IDTA is a standalone document for transfers from the UK. The UK addendum amends the EU standard contractual clauses so they work for UK transfers. Pick one and use it consistently rather than mixing templates.

A transfer risk assessment sits underneath either tool. It asks whether the destination country's law undermines the protections in the contract, and what supplementary measures are needed. Encryption, pseudonymisation and access controls are common answers.

Keep the documents with the vendor record, not in a folder labelled legal. Your data map should point to the transfer tool, the assessment date and the person who signed it. That is what makes a transfer defensible months later.

Sub-processors are the usual gap. Your vendor's own suppliers may move data again, so check the sub-processor list and the notice period for changes before you sign.

What to record in a marketing data map and suppression register

A marketing data map is a table of every place personal data sits in your marketing stack. It records what you hold, where it came from, why you have it and who else sees it. Build it in a spreadsheet before you buy any tooling.

Record these fields for each source and system:

Source or provider, collection method and collection date
The categories of personal data held and the purpose for using them
The UK GDPR lawful basis, including the legitimate interest assessment where relevant
Recipient type and channel, with PECR consent or exemption status and supporting evidence
The privacy information shown and, where relevant, the consent wording, date and method
Systems, processors and sub-processors that can access the data
Transfer destinations, the transfer tool used and the transfer risk assessment
Retention period and the review or deletion trigger

Marketing data map fields

Data sourceform, event, broker, referral
Categories of personal data held
Lawful basis and date established
Consent wording or LIA reference
Retention period and its trigger
Recipients, processors and sub-processors, with countries
Transfer tool used, such as UK IDTA

The suppression register is the part auditors ask about first. It lists everyone who has opted out, objected, bounced hard or complained, and it must be checked before every send. Keep it separate from the main list so a re-import cannot resurrect them.

Retention needs a trigger, not a vibe. "Three years from last engagement" is a rule. "As long as useful" is not. When the period ends, delete or anonymise, and record that you did.

A data map also makes subject access requests cheap. If someone asks what you hold, you can answer from the map rather than searching five systems. You normally have to respond within one month of receiving the request, subject to permitted extensions for complex requests.

Review the map quarterly and after any new tool purchase. Most compliance failures come from tools bought by a team that never told the person who owns the map. Our guide on how to define your target audience helps you keep list scope tight in the first place.

Buying lists from data brokers and the ICO's expectations

Buying a list does not buy you a lawful basis. The ICO's Direct marketing guidance explains the rules for organisations using marketing services, including data brokers: you must be able to rely on a lawful basis and must have told people what you would do with their data.

Before you buy, ask the broker for the source of each record, the consent wording used, the date and method of collection, and the categories of third parties named. If they cannot supply that per record, the list is unusable.

Do not accept a warranty in the contract as a substitute. A clause saying the data was lawfully collected does not transfer the risk. The ICO has taken action against buyers as well as sellers.

Run a sample check. Take a few hundred records and try to trace them back to a real sign-up or a real public source. If the trail stops at the broker's own database, treat the whole file as unverified.

Even a clean broker list needs a lawful basis of your own. Consent obtained by the broker only works if your organisation was named at the point of collection. Legitimate interests may cover some corporate contacts, but the balancing test still applies to your send.

Check the addresses against your suppression register before loading anything. A broker list that reintroduces people who opted out of your emails is a breach of their rights and a quick route to a complaint.

Accountability, the data protection fee and breach reporting

Accountability means showing how you comply, not just claiming it. Under UK GDPR you must keep records of processing, run data protection impact assessments for high-risk processing, and appoint a data protection officer where the law requires one.

Most UK controllers must pay the data protection fee to the ICO unless an exemption applies. The fee is tiered by organisation size and turnover, and it is separate from any fine. Non-payment is itself an enforceable breach.

Breach reporting has a 72-hour clock from the moment you become aware. Not every breach is reportable, but you must record all of them and be able to justify why one was not notified. A lost laptop with an unencrypted marketing list is a reportable incident.

Keep the breach log with the data map. It should record what happened, what data was involved, what you did, and whether the ICO and affected individuals were told. Marketing teams are often the first to notice, so give them a route to report internally.

Other UK regulators can overlap. The Advertising Standards Authority covers ad claims, the Competition and Markets Authority covers consumer law under the Digital Markets, Competition and Consumers Act 2024, and the FCA covers financial promotions. None of them replaces the ICO.

Your SAAS marketing disclosure policy should state how you describe data use to prospects, so the public wording matches what the data map records.

Auditing your SaaS marketing list before the next campaign

Run the audit before the campaign is built, not after the first send. Work through these steps and fix what fails.

Inventory each list and system. Record its source, owner, purpose and the date and method of collection.
Classify each address by subscriber type and channel. Check whether PECR consent, the corporate subscriber exemption or the soft opt-in applies.
Confirm the UK GDPR lawful basis for each use. Check consent evidence or the documented legitimate interest assessment, and make sure the privacy information matches.
Check broker records against their source and collection evidence. Do not use records whose provenance or permissions you cannot verify.
Check the suppression register, objections, retention rules and any outstanding data subject requests before the send.
Review processors, sub-processors and international transfers. Record the audit result, fix gaps and hold the campaign until unresolved issues are addressed.

Pre-campaign list audit

Export contacts with source, basis and date
Quarantine records with no traceable source
Remove suppression register matches permanently
Confirm transfer tool for each non-UK system
Test unsubscribe works in one click
Delete records past their retention period

The ICO's Direct marketing checklist is a practical way to structure that review. Work through it section by section and keep the completed version with the campaign file.

Re-run the audit whenever you add a tool, a region or a new list source. A list that passed in spring can fail by autumn if a broker record was appended without a basis.

Common questions

Do we need consent to email a business address in the UK?

Not always. PECR's corporate subscriber exemption means some corporate addresses can be emailed on a legitimate interests basis. Sole traders and some partnerships are treated as individuals, so consent rules apply to them.

Can we rely on legitimate interests for cold B2B email?

Yes, in principle, but only with a documented legitimate interest assessment and a working opt-out. The ICO expects the balancing test to consider what the recipient would expect from your organisation.

What is the difference between the UK IDTA and the UK addendum?

The UK IDTA is a standalone transfer agreement for UK exports. The UK addendum amends the EU standard contractual clauses so they cover UK transfers. Either can work, provided a transfer risk assessment supports it.

Can we buy a B2B marketing list from a broker?

Only if you can rely on a lawful basis and the people on it were told their data would be used by organisations like yours. Ask for per-record source and consent evidence, and check the file against your suppression register.

Do we have to pay the ICO data protection fee?

Most UK controllers do, unless an exemption applies. The fee is tiered by size and turnover, and failing to pay is a separate breach from any marketing complaint.

What must we do if a marketing list is breached?

Record it, assess the risk to individuals, and notify the ICO within 72 hours if the risk is high enough. Tell affected people without undue delay where the risk is high.