SAAS marketing rules and ethics explained for UK teams

What to take away

SAAS marketing rules and ethics are the legal duties and honest-practice standards that apply when a software business promotes its product to UK buyers.

The legal framework behind SAAS marketing

Who regulates what

The Information Commissioner's Office (ICO) enforces data protection and electronic marketing rules. The Advertising Standards Authority (ASA) administers the CAP Code for non-broadcast ads.

The Health and Safety Executive (HSE) regulates workplace safety in England, Wales and Scotland. The Health and Safety Executive for Northern Ireland (HSENI) covers Northern Ireland. Each has its own remit; one campaign can fall under more than one.

For data protection, the operative text is the UK GDPR. You can read the full General Data Protection Regulation (GDPR) on legislation.gov.UK to see the principles, lawful bases and data subject rights that your marketing workflows must respect. Treat it as the baseline rather than a summary.

Two other bodies matter. The Competition and Markets Authority (CMA) can act on misleading pricing or unfair contract terms. Ofcom sets rules for marketing communications services by phone, text or email where a provider is regulated. The ASA is self-regulatory, but persistent breaches can be referred to Trading Standards.

Marketing law overlaps with contract law, employment practice and product safety. A campaign that promises a compliance outcome may create a contractual expectation. That is why most compliance questions start with what you actually said, and where you said it.

The England position

Most marketing and data protection law applies across the UK, but not all of it. Employment law, health and safety enforcement and some consumer rules differ in Scotland, Wales and Northern Ireland. HSE's remit covers England, Wales and Scotland. Northern Ireland has HSENI. If your campaign says compliant across the UK, check that claim for each nation.

Scotland has its own court system. Contractual disputes with Scottish customers follow different procedural rules. Civil claims can be raised in the Sheriff Court or the Court of Session. Copy that names a governing law should reflect where your customer actually sits.

For a detailed look at how data protection duties play out for software firms, see SAAS marketing data protection in England. That article walks through subject access requests, processor terms and breach notification.

Consent, legitimate interests and B2B email

Choosing a lawful basis

You need a lawful basis before you send any direct marketing. Consent is one option, but it is not the only one. The ICO's guidance on sending direct marketing and choosing your lawful basis explains that legitimate interests can apply to B2B marketing where you have a relevant and appropriate relationship with the recipient.

In practice, record why you believe the recipient would expect to hear from you. A generic note that says we think it is fine is not enough. You need a legitimate interests assessment (LIA) that names the interest, the necessity and the balancing test against the individual's rights.

The Privacy and Electronic Communications Regulations sit alongside the UK GDPR and govern electronic marketing specifically. They cover email, texts and automated calls. They do not remove the need for a lawful basis. The ICO can act against organisations that ignore them. PECR fines can reach £500,000.

Soft opt-in and corporate subscribers

The soft opt-in rule lets you email existing customers about similar products if you collected their details during a sale and gave an opt-out at the time. For corporate subscribers, the rules are slightly more permissive than for sole traders and partnerships. You still must identify yourself and provide a working unsubscribe link.

A sole trader or a partnership is usually treated as an individual for electronic marketing, even when the address looks like a business one. That means consent is normally needed. If your records cannot show consent, do not send.

Your privacy notice should state which basis you rely on. If you claim consent, you must be able to show when and how it was given. If you rely on legitimate interests, you must be able to show your LIA. An opt-out must be honoured promptly. For policy wording, read SAAS marketing disclosure policy in England.

Keep consent records in one place. Record the date, source, exact wording the person saw, and form identifier where you have it.

Records rebuilt from memory months later carry little weight. Tools such as HubSpot and Mailchimp can store consent and opt-out flags. HubSpot has a free CRM tier; Mailchimp has a free plan up to 500 contacts.

Advertising claims and the CAP Code

What the CAP Code covers

The CAP Code requires ads to be legal, decent, honest and truthful. That applies to your LinkedIn text ads, your Google search copy, your landing pages and your free-trial banners. If you claim the UK's leading platform, you need evidence that a reasonable reader would accept. If you show a dashboard screenshot, it must reflect what a typical customer sees.

Testimonials must be genuine and used with permission; if a customer was paid or received a discount, say so. Comparative claims should compare like with like and name the basis for the comparison.

The ASA offers training and events on advertising compliance for marketers wanting to understand how the rules work in practice. Its case studies show where advertisers have fallen short.

For a closer look at the specific rules that apply to software ads in England, including comparative advertising and pricing, see SAAS marketing advertising rules in England.

Ethical claims and AI in marketing

Ethics goes beyond the letter of the CAP Code. If you use AI to generate ad copy or personalise emails, disclose that where it affects the recipient's understanding. The principle of transparency applies. A claim that a human wrote or reviewed something should be true.

Similarly, if your product uses automated decision-making, your marketing should not promise human review unless that is accurate. Ethical marketing means your claims match your product's actual behaviour.

Environmental claims attract close attention. The CMA's Green Claims Code asks for claims to be truthful, clear and substantiated across the full life cycle. If your platform runs on renewable-powered data centres, say what you can evidence.

Review how you describe AI features. Calling a rules-based workflow AI-powered is a claim like any other. If the feature cannot do what the copy suggests, the ad can be treated as misleading even when the product is capable of more. Google Ads and LinkedIn Ads both have policies on misrepresentation and restricted targeting.

Data retention, security and workplace duties

Retention and subject rights

GDPR requires you to keep personal data no longer than necessary. For marketing lists, that means a defined retention period, such as 24 months from last engagement, after which you suppress or delete the record. You must also be able to fulfil subject access requests and erasure requests within one month.

A suppression list is different from a marketing list. You keep the minimum needed to honour an opt-out, and you keep it separate from the data you would otherwise delete. Document that distinction, because an erasure request and an opt-out can arrive together.

Your CRM and marketing automation tools should support these workflows. If they do not, you may need to export data manually, which increases the risk of error. Document your retention schedule and review it annually. OneTrust and Cookiebot offer consent and preference management features, with paid plans based on modules or page views.

Security duties sit alongside retention. Limit access to prospect data by role, log who exports a list, and assess your processors before you onboard them. If a breach is likely to risk people's rights, you generally have 72 hours to notify the ICO. Your marketing tools are in scope.

HSE and workplace SAAS

If your software is used by employees at work, health and safety duties can apply. The Health and Safety Executive publishes guidance on display screen equipment, risk assessments and workplace welfare. The Display Screen Equipment Regulations 1992 require employers to assess workstations, reduce risks, plan breaks from screen work and provide eye tests on request.

Do not let marketing encourage unsafe use, or promise employees can work through breaks. "Designed to support healthy working practices" is safer than "boost productivity by cutting breaks".

You need not turn marketing into a safety manual. Avoid claims that could be read as encouraging employers to breach their duties.

The Health and Safety at Work etc. Act 1974 also places general duties on employers to protect workers. HSENI enforces equivalent duties in Northern Ireland. If your product is positioned as a replacement for DSE assessments or breaks, expect procurement questions. Buyers in regulated sectors often ask how your tool fits their existing risk assessment.

Platform rules and paid ads

LinkedIn and B2B targeting

LinkedIn is a common channel for SAAS lead generation. Its text ads format lets you target by job title, industry and company size. The platform has its own advertising policies, which sit alongside the CAP Code. You must not use sensitive personal data for targeting, and you must comply with LinkedIn's terms on prohibited content.

Because LinkedIn is a US-based platform, data transfers are involved. Check whether your contract relies on the UK extension to the EU-US Data Privacy Framework or standard contractual clauses. Your privacy notice should name LinkedIn as a sub-processor if you use its lead gen forms.

Ad review times vary, and rejections usually cite unclear claims, restricted targeting or missing disclosures. Build a buffer into campaign launch dates. Keep a copy of what you submitted, because the live ad can change after a later edit.

Retargeting deserves its own look. Matching a business visitor to a personal profile can blur the line between B2B and consumer processing. Keep audiences small, exclude sensitive contexts, and give people a way to stop seeing the ads.

Affiliates, resellers and contracts

If you use affiliates or resellers, you are responsible for their claims under the CAP Code. Your contracts should include compliance warranties and an indemnity. For guidance on the contractual side, see SAAS marketing commercial contracts in England, which covers liability, termination and data processing terms.

Affiliate disclosure needs to be clear and up front. A small note in a footer is not enough when the reader has already been persuaded. Give partners approved copy, review their pages at least twice a year, and keep a record of the review.

Reseller agreements should say who owns the customer relationship and who answers a data subject request. Ambiguity there is a common source of complaints. Salesforce and HubSpot can record contract terms and data processing roles if configured for that purpose. Salesforce is a paid CRM, while HubSpot offers a free tier with paid marketing add-ons.

Decision table: situation, choose, avoid

How to build a compliance routine

Start with a data map. List every place you collect personal data, from webinar registrations to LinkedIn lead forms. For each, record the lawful basis, retention period and who can access it. Review the map quarterly.

Put one person's name against each entry. Shared ownership is how schedules drift. When a tool is retired, the map tells you what to delete and who to tell.

Next, write a one-page marketing ethics policy. Cover claims, testimonials, AI use and data handling. Train your team on it. The ICO's guidance and the CAP Code are your reference points, but your policy should be specific to your product and market.

Add a sign-off step for any claim that uses a superlative, a statistic or a comparison. One reviewer is enough, provided they can say no. Record the evidence behind the claim so a later query can be answered from the file.

Finally, test your opt-out process. Send yourself a marketing email and try to unsubscribe. If it takes more than two clicks or asks for a password, fix it. The ICO expects opt-outs to be simple. For a forward look at how these rules may interact with changing buyer expectations, see SAAS marketing trends and outlook for England in 2027.

This article is general guidance only. Individual cases need a qualified adviser, and rules can change. Check the current version of the legislation or regulator guidance before acting.

Common questions

Do I need consent for B2B email marketing in the UK?

No, not always. Legitimate interests can apply where you have a relevant relationship and have completed a legitimate interests assessment. Consent is one option, not the only one. You must still provide a working opt-out.

Does the CAP Code apply to my LinkedIn ads?

Yes. The CAP Code covers non-broadcast ads, including social media ads and landing pages. Claims must be evidence-based and not misleading. LinkedIn's own policies also apply, so you need to satisfy both.

How long can I keep marketing data under UK GDPR?

There is no fixed number. You must keep data no longer than necessary for the purpose you collected it. Many firms use 24 months from last engagement as a benchmark, but that is a choice, not a rule. Document your own period and review it.

What are the HSE duties for SAAS used in workplaces?

The HSE regulates workplace safety, including display screen equipment and risk assessments. Employers must assess workstations, plan breaks and provide eye tests on request under the Display Screen Equipment Regulations 1992. Your marketing should not encourage employers to breach those duties.