Rules and ethics
Part of SAAS marketing rules and ethics explained for UK teams
Check how SAAS marketing UK regulations shape your campaign plan
Which UK rules shape SAAS marketing: the ASA and CAP Code, ICO, PECR, UK GDPR, consumer law and the FCA, plus the checks to run before a campaign.
What to take away
What to take away
- Decide which rules bite on each SAAS marketing campaign, then budget for the checks rather than finding them mid-flight.
- Paid ads follow the CAP Code, written by the Committee of Advertising Practice; the ASA can act against non-compliant online advertisers, including naming them publicly, so ad copy and landing pages both count.
- Email and phone outreach is governed by the Privacy and Electronic Communications Regulations 2003 (PECR). The ICO's direct marketing guidance is the starting point, including where the corporate subscriber exemption and the soft opt-in do and do not help.
- Data handling sits under the UK GDPR and the Data Protection Act 2018, both regulated by the ICO.
- Consumer law can still reach B2B software contracts through the Consumer Rights Act 2015, so terms and sales claims need a legal read.
- This article is general guidance only. Individual cases need a qualified adviser.
Map each channel to its regulator
Paid search, paid social and display ads sold to businesses fall under the UK advertising codes: the CAP Code for non-broadcast ads and the BCAP Code for broadcast. The Advertising Standards Authority can act when an advertiser keeps breaching them. Its 'Non-compliant online advertisers' page sets out how naming works, which matters when you make a bold claim.
Channel to UK regulator
Paid search, social, display
- Regulator
- ASA
- Rule set
- UK advertising codes
- Key risk
- Bold claims
- Check before
- Publishing ad
Email and phone
- Regulator
- ICO
- Rule set
- B2B marketing guidance
- Key risk
- Purchased lists
- Check before
- Loading CRM list
Email and phone sit with the Information Commissioner's Office, and the rules that bite are the Privacy and Electronic Communications Regulations 2003 (PECR). The ICO's direct marketing guidance explains consent, the soft opt-in for existing customers and the corporate subscriber exemption, so read it before you load a purchased list into your CRM. Consent, soft opt-in and the exemption are separate questions, and the guidance walks through each one.
Check your claims and your contracts
The Advertising Standards Authority regulates ad content across media in the UK, working to the CAP Code's rules on misleading advertising. Misleading claims about performance, savings or security are the usual failure point for software firms, and every comparative statement has to be substantiated. Keep evidence for each one, including the source and the date you captured it.
Contract terms and sales practices can also engage consumer protection law. The Consumer Rights Act 2015 is the reference point: it treats a consumer as an individual acting for purposes wholly or mainly outside their trade, business or profession, so a sole trader or small buyer can fall inside it. Trading Standards enforces that regime, which is why the terms your sales team sends matter as much as the ad that generated the lead.
If you want the wider picture across channels, the SAAS marketing UK rules and compliance guide pulls the threads together for planning cycles.
Budget for the compliance work
Compliance is a line item, not an afterthought. For example, a team paying £400 a month for a marketing automation platform may also need a few days of legal review before a new outbound programme goes live. In practice, that review is cheaper than rebuilding a campaign after a complaint.
Build three checks into your process. First, a claims log that records the evidence behind each headline. Second, a consent record that shows how each contact opted in, or why an exemption applies. Third, a review step before any list is uploaded, so a junior marketer cannot bypass it under deadline pressure.
UK data protection law is the UK GDPR and the Data Protection Act 2018, both overseen by the ICO. Every campaign that touches personal data needs a lawful basis, a retention rule and a route for subject requests. The SAAS marketing data protection in England article walks through those, which is useful when your sales and marketing systems share one database.
Know where the rules differ
Advertising and data protection rules apply across the UK, but some consumer and contract rules differ in Scotland, Wales and Northern Ireland. If you sell outside England, check the position in each nation. Sector rules differ too. Financial promotions, for instance, sit with the Financial Conduct Authority rather than the Advertising Standards Authority, and its financial promotion rules in the FCA Handbook (COBS 4) govern how you describe anything that looks like a regulated product.
Map the rules to your campaign plan
- Before you briefagree the lawful basis for every list you will use, because the UK GDPR and the Data Protection Act 2018 sit under the whole programme.
- Channel choicepaid ads bring the CAP Code and the ASA into play, while email and cold calls bring PECR and the ICO.
- Copyevery performance, savings or security claim needs a line in the claims log with its evidence date, as the CAP Code's misleading advertising rules require.
- Targetingdecide whether each contact is a corporate subscriber or a consumer, since that changes what PECR and the corporate subscriber exemption allow.
- Contractscheck terms and sales scripts against the Consumer Rights Act 2015, and route anything that looks like a financial promotion past the FCA's rules.
- After launchkeep the consent record and the claims log current, so a complaint or a subject request can be answered from one place.
Glossary
Glossary
- ASAAdvertising Standards Authority, the UK ad regulator.
- CAP Code and BCAP Codethe UK advertising codes, written by the Committee of Advertising Practice (CAP); the CAP Code covers non-broadcast ads and the BCAP Code covers broadcast.
- ICOInformation Commissioner's Office, the UK data protection regulator.
- PECRPrivacy and Electronic Communications Regulations 2003, the rules for email, phone and cookies.
- UK GDPR and Data Protection Act 2018the data protection regime the ICO enforces.
- Corporate subscribera business contact whose marketing treatment differs under the corporate subscriber exemption in PECR.
- Consumer Rights Act 2015the main consumer protection statute cited here.
- FCAFinancial Conduct Authority, whose financial promotion rules sit in the FCA Handbook.
Common questions
Does the corporate subscriber exemption remove the need for consent?
No. It changes the position for some business contacts, but the ICO's guidance still expects you to identify the lawful basis and honour objections.
Can the ASA act against a B2B software advert?
Yes. The UK advertising codes apply to business-to-business ads, and the ASA can name non-compliant online advertisers.
Do I need a lawyer to sign off every campaign?
Not every campaign. A qualified adviser should review claims, terms and any new data use, and this article is general guidance only.
Which law governs email and phone marketing?
The Privacy and Electronic Communications Regulations 2003, enforced by the ICO. Consent, the soft opt-in and the corporate subscriber exemption each apply to different situations, so check the ICO's direct marketing guidance before you send.
