Check proposal software advertising rules before your next campaign

What to take away

This checklist is for UK campaigns. PECR, UK GDPR and the Data Protection Act 2018 apply across the UK, and the CAP Code is the UK non-broadcast advertising code. Check sector-specific or local requirements before extending a campaign. The wider proposal software rules and compliance guide covers contract terms and procurement questions.

Before you write the campaign

Pick a lawful basis

Where a campaign processes personal data, the UK GDPR requires a lawful basis. The ICO's Direct marketing guidance explains how to choose one; its six bases are consent, contract, legitimate interests, legal obligation, vital interests and public task.

Legitimate interests may be a lawful basis for some B2B processing, but you need a balancing assessment. It does not remove PECR's separate electronic-mail rules, which depend on whether the recipient is an individual or corporate subscriber. Record the basis, date and approver in the campaign brief.

Check audience and suppression lists

Under PECR, unsolicited marketing email to an individual subscriber generally requires consent unless the soft opt-in applies; corporate subscribers do not need prior consent under that rule. Sole traders and some partnerships are individual subscribers. For all marketing emails, identify the sender and provide a valid address for opting out.

The PECR soft opt-in is limited: you must have obtained the details directly during a sale or negotiations for a sale, be marketing your own similar products or services, and have offered a clear chance to refuse at collection and in each message. A broker's cold list does not meet those conditions. A trial user qualifies only if the circumstances meet each condition.

Reviewing campaign copy

Evidence performance claims

For UK non-broadcast ads, use the CAP Code, the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing; the ASA administers it. Section 3 covers misleading advertising, including rule 3.7 on substantiation and rules against misleading claims and material omissions. It also sets requirements for comparative claims, price and “free” claims, testimonials and endorsements; comparisons must be objective, relevant and verifiable, and compare products meeting the same need. A headline claiming a quoting tool halves proposal turnaround needs data behind it. Unsubstantiated claims can be challenged; keep the source, sample size and date.

For B2B advertising, also check the Business Protection from Misleading Marketing Regulations 2008. Trading Standards enforces these rules.

A vendor paying £600 a month for paid search should show where a three-times-faster claim came from. If that came from one internal trial, say so.

Describe AI features accurately

Buyers ask how a drafting suggestion was built. BSI publishes technical AI standards such as BS ISO/IEC 22989:2022 on terminology and BS ISO/IEC 23894:2023 on risk management. These can inform technical or security evidence, but they are not advertising rules and do not substantiate performance claims. Avoid words like autonomous unless the tool acts without review.

If your software sends customer data to a third-party model, that transfer belongs in your privacy notice. Our guide to a proposal software disclosure policy in England explains what that notice should contain.

Data handling in the quoting workflow

Map personal data

A quoting workflow touches names, email addresses, job titles and pricing history. The UK GDPR and Data Protection Act 2018 govern how that data is handled. The UK GDPR provides rights such as subject access and sets personal-data breach notification duties; the Act supplements it in UK law.

List every system that holds prospect data: CRM, email platform, e-signature tool, analytics. Note who can export from each. That list starts your data protection impact assessment.

Set retention dates

For a B2B sales cycle of six to nine months, a 24-month retention period can be an operational review point for lapsed prospect details, not a legal requirement. Set a review date for consent evidence too; at 24 months, document why any record remains necessary and delete it when it is not. Keep only the minimum suppression record needed to prevent further marketing.

Train quote builders to spot a data request. A prospect asking to see everything you hold is a subject access request, and the clock starts at once.

Glossary

Common questions

Does cold email to business addresses need consent in England?

Not always. Legitimate interests can cover business-to-business marketing where you have done a balancing assessment. Sole traders are treated as individuals and usually need consent. Record your reasoning.

Can I advertise AI drafting features without naming the model provider?

You can describe the function without naming the vendor, but do not overstate what the tool does. If data leaves your platform, disclose that in the privacy notice.

Who enforces advertising rules for software vendors?

The ASA administers the CAP Code and handles complaints. Trading Standards enforces the Business Protection from Misleading Marketing Regulations 2008 for misleading B2B advertising. The ICO regulates direct marketing under PECR and data protection law.

How long should I keep campaign consent records?

Keep evidence while relying on consent and use a documented 24-month review point; it is not a statutory retention limit. After review, retain records only while needed to demonstrate consent, and keep the minimum suppression record needed to honour an opt-out. Individual cases may need advice from a data protection adviser.

Official sources

• ICO guidance on electronic mail marketing rules
• UK Business Protection from Misleading Marketing Regulations 2008