Harper James advises UK businesses on recording marketing consent under the laws of England and Wales. A reliable consent record shows what an individual agreed to, when the agreement was given and how the business will use the information.
Under the UK GDPR, consent must be freely given, specific, informed and unambiguous. The record should include the person’s name or identifier, the date and time of consent, the method used, the wording shown at the point of collection, the marketing channels covered, and the organisation or product categories selected. It should also identify the source of the data, such as a website form, event registration or competition entry.
Consent should be collected through a clear affirmative action. Pre-ticked boxes, silence, inactivity and consent bundled into general terms and conditions do not provide a reliable record. Separate unchecked options should cover different channels, such as email, telephone and text message, where the business intends to use them. The privacy notice should explain who will use the information, why it is used and how consent can be withdrawn.
Businesses should record changes to consent, including amendments to preferences and the date of withdrawal. Withdrawal must be as easy as giving consent. Marketing systems should therefore maintain a suppression list so that a withdrawn contact is not re-added from another database or campaign. Records should be retained for as long as they are needed to demonstrate compliance, while personal data itself should be reviewed under the organisation’s retention policy.
The Privacy and Electronic Communications Regulations 2003 also apply to electronic marketing. The rules differ according to the recipient and communication method. For example, the existing customer relationship exemption, often called the soft opt-in, has specific conditions, including marketing similar products or services and providing a straightforward opt-out when collecting the details and in each subsequent message. Sole traders and certain partnerships are treated differently from limited companies, so the business should classify recipients before sending campaigns.