What proposal software data protection means for England's sales teams

What to take away

The rules that apply in England

England has no bespoke statute for proposal software. The same law applies across the United Kingdom: UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. The ICO regulates all four nations. Tools such as Better Proposals, Qwilr and PandaDoc host quotes and prospect data, so the same rules apply to each of them.

The Data (Use and Access) Act 2025 amended parts of that framework. It became law in June 2025 and has been brought into force in stages, with a listed set of provisions commencing on 20 August 2025, according to the legislation.gov.UK record. It did not remove the need for a lawful basis, a privacy notice or a processor contract.

Retention, security and breach reporting duties follow from that framework, not from the tool you choose. If a personal data breach risks people's rights, report it to the ICO within 72 hours. The ICO can fine up to £17.5m or 4% of global turnover, and has issued penalties such as £20m to British Airways in 2020.

If you are working out which rules bite first, the wider proposal software UK rules and compliance guide for 2027 sets out the sequence before you sign.

Lawful basis and consent

Most B2B teams rely on legitimate interests for prospecting and on contract for existing customers. Record that choice in your record of processing activities.

A legitimate interests assessment needs to name the interest, show why it does not override the individual and record the safeguards you apply.

Marketing emails are separate. PECR requires consent for electronic marketing to individuals, with a limited soft opt-in for existing customers. A downloaded guide is not consent.

Consent must be specific and easy to withdraw. Keep a suppression record when a prospect asks you to stop, so the next campaign does not repeat the mistake.

Set a retention period for declined quotes too. A typical default is 12 months, with 24 months as an outer limit. Document it and delete on schedule.

Contracts, transfers and sharing

Before personal data enters a proposal tool, you need a written contract under Article 28 of UK GDPR. The supplier is the processor and you remain the controller. The contract must cover subject matter, duration, security and sub-processors.

The ICO's guidance on data sharing explains how to map flows between controllers and processors before you connect a quoting platform to a CRM.

Subject access requests often land on a single quote thread. Decide who answers them and how you extract the data from the tool.

If your supplier stores data outside the UK, check which transfer tool they use, such as the UK International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses. Sub-processors matter too, so list them and note where each one stores data.

Security controls to check in proposal software

A proposal platform holds pricing, contacts and often signatures. Ask for encryption in transit and at rest, role-based access and audit logs showing who exported a quote. The cybersecurity standards published by BSI cover these controls and give you a benchmark.

What to put in your own data policy

Write down who may export quote data, where it is stored and how long it is kept. The structure in this proposal software disclosure policy in England is a practical starting point.

Include clauses on the lawful basis for prospecting, retention periods for active quotes (24 months) and declined quotes (12 months), export rules, breach reporting steps, and your current sub-processor list. Add a named owner for subject access requests.

Advertising and claims: evidence for savings

Publish case studies, testimonials or performance claims and the CAP Code applies. The ASA page on how advertising regulation works explains that the Committee of Advertising Practice writes the rules and the Advertising Standards Authority enforces them.

Keep the figures behind any saving you promise, and the date they were measured. Hold the evidence for a comparative claim before you publish, not after a complaint arrives.

For example, a claim that 'our proposal tool cuts quote turnaround by 40% against manual drafting' needs a measured before-and-after on a defined sample, with dates and method. Keep the raw timings and the sample size.

Decision table

This is general guidance. Individual cases need a qualified adviser, particularly where special category data is involved.

Common questions

Does England have its own proposal software data protection law?

No. UK GDPR, the Data Protection Act 2018 and PECR apply across the UK. England-specific conditions come from public sector buyers or sector regulators.

Who is the controller when a supplier hosts our quotes?

Your business is normally the controller and the supplier is the processor. Record that split in the contract.

How long should we keep a declined quote?

There is no single statutory period. A common approach is 12 months for declined quotes, with 24 months as an outer limit. Pick one, document it and delete on schedule.