What do you need to be aware of around this new consultation?

The Information Commissioner’s Office (ICO) has issued a consultation on a direct marketing code of practice that is open until 4 March, with the final version intended to be laid before Parliament and issued later this year.

The ICO is clear on the impact, highlighting that ‘processing personal data for direct marketing purposes is carried out by the vast majority of organisations. Businesses from sole traders through to large corporations as well as the public sector, charities, political parties and other not-for-profit organisations all use direct marketing as a tool to grow their business or publicise their causes and aims.’

It states that the code helps businesses comply with and demonstrate compliance with data protection and e-privacy rules when processing data for direct marketing purposes or conducting direct marketing campaigns. It contains a number of examples that look at specific scenarios where GDPR and Privacy and Electronic Communications Regulations 2003 (PECR) apply.

The following is a useful example that will apply to many businesses highlighting the distinctions between solicited direct marketing (marketing material that the person has specifically requested), unsolicited direct marketing where the client has opted to receive future information, with the PECR rules applying, and unsolicited direct marketing without any consent.


An individual submits an online form to a double glazing company requesting a quote. By sending this quote to the individual the company is responding to the individual’s request, and so the marketing is solicited.

When they requested the quote for double glazing, the individual also ticked a box opting in to receiving information about future home improvement offers from the company. A few months later, the company sends an email with details of a new offer.

This is unsolicited marketing, because the customer did not contact the company to specifically request information about that particular offer. However, this does not mean that the company should not have sent details of the new offer. It can do so because the individual has consented to receiving these offers.

An opt-in means that the individual is happy to receive further marketing in future, and is likely to mean that unsolicited marketing is lawful. But it is still likely to be unsolicited marketing, which means the PECR rules apply.

Article from ACCA In Practice