How to write a UK proposal software disclosure policy for your team

What to take away

Who the policy covers

Cover everyone who drafts, sends or approves a proposal, including contractors and agency staff who use your templates. In a 20-seat sales team that may be six people. In a three-person team it is everyone.

Name roles rather than people. A policy that names one reviewer breaks on the day that person leaves, and nobody notices until a quote goes out unchecked.

Decide early whether internal pricing sheets fall inside the rule. Anything a buyer receives sits inside it. Anything that never leaves the business usually sits outside it.

Alongside the UK GDPR, the Data Protection Act 2018 sets out the UK data protection framework. The Privacy and Electronic Communications Regulations 2003 (PECR) may also apply to electronic direct marketing; use the UK rules and compliance guide as background, and name the rules relevant to your process in the policy.

What to disclose

For AI use, consult the ICO's Guidance on AI and data protection as well as its UK GDPR guidance. Record the lawful basis under UK GDPR Article 6 for each purpose: for processing necessary to take steps at an individual's request before a contract, Article 6(1)(b) may apply; for business contact details used to prepare a proposal, assess legitimate interests under Article 6(1)(f) and document that assessment. The right basis depends on the purpose and circumstances, so do not apply one automatically to every use.

If your tool passes prospect details to a sub-processor outside the UK, identify the provider and processing location. For a restricted transfer, check whether UK adequacy regulations apply or put an appropriate safeguard in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses. In England and Wales, a buyer misled by a proposal may have a claim under the Misrepresentation Act 1967, which applies in England and Wales. Scotland handles the same dispute under different rules, and individual cases need a qualified adviser.

Claims published beyond one buyer, such as a case study page, may also be advertising. Check the CAP Code (the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing); the proposal software advertising rules explain how it treats those claims.

Writing the disclosure

Keep the wording plain and narrow. Say which sections were machine drafted. Name the human step that followed.

A sentence naming two sections and the reviewer beats a phrase such as AI-assisted throughout. Buyers read the second version as an admission and the first as an answer.

Use this wording as a starting point, completing the brackets and checking it against your privacy notice.

We use [tool] to prepare [proposal sections]. AI drafting may use only [permitted fields]; do not enter [prohibited fields]. [Role] reviews each proposal before it is sent. We process [data] for [purpose] on the basis of [lawful basis and reason]. We keep drafts and logs for [period in our retention schedule]. Our tool providers are [processors], and data is processed in [locations]. Where a restricted transfer occurs, we use [applicable transfer mechanism].

For example, permitted fields could include a business contact's name, work email, job title, company name and information needed to prepare the requested quote. Prohibit special category data, passwords and other authentication credentials, payment card details, unrelated personal data and confidential third-party information unless a separate approval process allows it.

Where proposal-related messages are direct marketing, add a rule to check PECR for the recipient type and the communication before sending.

If proposal software adds automated actions to the sending process, update the policy to say which actions are automated, what data they use and where a person reviews the result.

Keeping records

Keep a dated log for each proposal: template version, tool settings, reviewer name and sending date. One minute per document answers most buyer questions later.

Data privacy standards also shape how long that log may be kept. BSI's data and privacy standards guidance covers the practices auditors tend to expect around customer data.

Set a retention period in your schedule and write it down. The UK GDPR's storage limitation principle does not prescribe one universal retention period for proposal drafts. If your schedule keeps drafts for six years, say why, and make sure the privacy notice says the same thing.

Disclosure policy checklist

Work through this list before the next quoting cycle.

Common questions

Use these questions to check how the policy will work in practice. The sample wording above is a starting point; complete its fields for your tools, data and retention schedule before adopting it.

Does the policy need a solicitor?

Not for a first draft. A short internal rule that lists data fields and approval steps rarely needs legal drafting. Ask a qualified adviser to check it if you handle special category data or sell into regulated sectors.

How often should it be reviewed?

Twice a year, and again whenever you change tooling or add a sub-processor. Diary the dates rather than relying on memory.

What happens if a rep ignores the policy?

Correct the document, log what caused the gap, and retrain the team. Formal warnings are a matter for your own HR policy, and employment rules in Scotland and Northern Ireland differ from England, so take advice before acting.

Where should the disclosure sit?

In the proposal itself, near the pricing or the sign-off block. A separate page is easy for a buyer to miss, and a footer is easy for a rep to delete.