Seven rules and ethics points for proposal software compliance

What to take away

Rule 1Find a lawful basis for every field and processing activity under the UK GDPR and the Data Protection Act 2018. Proposal software captures prospect data, so data protection rules attach to quote templates, notes and analytics. Consent must be specific and freely given if you rely on it for electronic marketing.
Rule 2Treat quote follow-ups and automated sequences as electronic mail marketing. The ICO says consent is generally needed, with a narrow soft opt-in for existing customers. Bought lists rarely satisfy this.
Rule 3Evidence every claim in quotes, case studies and comparison pages. The CAP Code and ASA rulings show how the regulator assesses misleading or comparative statements.
Rule 4Control contract formation, e-signature and records. Keep the version history, timestamp and acceptance record for the limitation period.
Rule 5Apply anti-bribery controls to discounts, gifts, hospitality and intermediaries. GOV.UK guidance expects proportionate procedures and top-level commitment.
Rule 6Align document control and access management with ISO 9001 and ISO 27001. Buyers ask for ISO 27001 certification or equivalent evidence.
Rule 7Go beyond the law on tracking, dark patterns and AI claims. Tell people what the software collects and why. This article is general guidance only. Individual cases need a qualified adviser.

Why proposal software is a compliance surface

The most common mistake is treating proposal software as a neutral document builder. It captures prospect data, sends marketing email and publishes claims. Data protection, direct marketing, advertising and anti-bribery rules attach to how you use it.

Proposal software sits where marketing, sales and contract data meet. A quote template can hold a prospect's name, role, email address, company turnover, project budget and pricing history. That is personal data in most cases. It can include special category data if a project relates to health or similar fields.

The same tool often sends follow-up email, tracks document opens and stores win/loss notes. Each action has a rule attached. Teams that treat the software as a neutral word processor tend to miss that until a complaint or an audit arrives.

Platforms such as PandaDoc, Proposify and Qwilr combine templates, e-signature and document analytics. Those features make the compliance questions concrete.

This guide sets out the main UK rules and ethical expectations for 2027. It covers England, and where a rule differs in Scotland, Wales or Northern Ireland we say so. It is written for sales operations, revenue operations and legal teams choosing or running proposal and quoting software.

If you are still mapping the wider regulatory picture, our companion guide on proposal software UK regulations in England sets out which regimes apply to which activities.

Rule 1: data protection duties when you store prospect data

The Data Protection Act 2018 and the UK GDPR require a lawful basis for processing personal data. For sales prospecting, the common bases are legitimate interests, consent or contract. Record which basis you rely on and tell the individual in a privacy notice.

The Data Protection Act 2018 sits alongside the UK GDPR and sets out how the regime is enforced in the UK. It also creates offences for unlawful obtaining or disclosure of personal data. That matters if a member of staff exports a prospect list from proposal software.

Data minimisation applies. If your quote template asks for a date of birth or a home address and you do not need it, remove the field. Retention matters too. A prospect who never became a customer should not sit in the system indefinitely without a documented reason.

International transfers need care. Many proposal platforms host data outside the UK. Check the transfer mechanism and the sub-processor list before you sign. Review it when the vendor changes.

Access requests and erasure requests must be actioned within one month in most cases. Test how your proposal software finds and deletes a person's data across templates, sent documents, notes and analytics. A tool that cannot do this creates a manual burden.

Our detailed walkthrough on proposal software data protection in England covers subject access requests, retention schedules and processor contracts.

Rule 2: direct marketing rules for quotes, follow-ups and sequences

Electronic mail marketing is regulated separately from general data protection. The ICO's guidance on direct marketing using electronic mail explains that you generally need consent from the recipient, unless a narrow soft opt-in applies.

The soft opt-in can cover people who gave you their details during a sale or negotiations. It applies if you offer similar products and give a clear opt-out in every message. A prospect who downloaded a generic guide has not necessarily entered negotiations. Relying on the soft opt-in there is risky.

Bought lists are the biggest single problem. If the seller cannot show how each person consented to receive email from you specifically, the list is unlikely to be lawful for outreach. Deleting it is often cheaper than defending a complaint.

Automated follow-up sequences in proposal software are marketing email. The fact that a message is triggered by a document view does not exempt it. Include a working unsubscribe link and honour opt-outs promptly.

Corporate subscribers have different rules from individual subscribers. Sole traders and some partnerships count as individuals. Do not assume a business address removes the need for consent.

Rule 3: advertising and claim rules for quotes and sales pages

Sales documents make claims: fastest, most accurate, guaranteed to win more work. The CAP Code, enforced by the Advertising Standards Authority, requires that marketing communications are honest and evidence-based. The ASA's published rulings show how it assesses comparative claims and testimonials.

If you publish a comparison against a named competitor, hold evidence for each point and date it. If a customer testimonial includes a result, such as a percentage improvement, you need permission and a basis for the figure. Label illustrative examples as illustrative.

Claims inside a generated proposal matter too. If your software inserts a standard line such as "saves 40 per cent of admin time", that is your claim, not the software's. Review template libraries for unsubstantiated statements before they reach a customer.

Our guide to proposal software advertising rules in England looks at comparative advertising, testimonials and pricing claims in more detail.

Rule 4: contract terms, e-signature and record keeping

A proposal that is accepted can form a contract. The terms you attach, the order of documents and the method of acceptance all affect what was agreed. Under the Consumer Contracts Regulations and the Consumer Rights Act, different rules apply if your customer is a consumer rather than a business.

E-signature platforms used alongside proposal software must produce a reliable audit trail. For most business-to-business contracts in England, a typed name or click-to-accept can be valid. Regulated sectors and deeds have stricter requirements.

Record keeping is an ethics point as well as a legal one. If a customer disputes what was quoted, the version history, timestamp and acceptance record are your evidence. Configure the software to keep them and set a retention period that matches your contract limitation window.

Our article on proposal software commercial contracts in England covers incorporation of terms, e-signature evidence and unfair terms risks.

Rule 5: anti-bribery and gifts in the sales process

Sales teams that entertain buyers, offer discounts or use intermediaries need anti-bribery controls. The Bribery Act 2010 guidance published by GOV.UK sets out the six principles for commercial organisations, including proportionate procedures and top-level commitment.

Proposal software can support those controls. Record approvals for discounts above a threshold. Log hospitality and gifts against the opportunity, and keep the reason attached to the record. A workflow that leaves a clean audit trail is easier to defend than a spreadsheet.

Facilitation payments are generally prohibited under the Act. If your sales process in any market involves payments to speed up routine government action, treat that as a red flag and escalate.

Due diligence on introducers and resellers matters. If a partner submits quotes through your platform, know who owns them and whether commissions are proportionate to the work.

Rule 6: quality and information management standards

ISO standards and BSI publications give a framework for quality management and information security. The BSI standards catalogue lists standards including ISO 9001 for quality and ISO 27001 for information security.

Buyers increasingly ask vendors for ISO 27001 certification or equivalent evidence. If you run proposal software internally, aligning your document control and access management with those standards reduces risk and speeds up customer security reviews.

Standards are voluntary unless a contract or regulator requires them. They still provide a defensible benchmark when you explain how you protect prospect data and control document versions.

Rule 7: ethical practice beyond the letter of the law

Compliance is the minimum. Ethical proposal practice means being clear about what the software does, how pricing is presented and what the customer is agreeing to.

Avoid dark patterns in acceptance flows. A pre-ticked box, a hidden fee or an auto-renewal that is hard to cancel may breach consumer law. It will damage trust in business markets too.

Be honest about AI features. If a tool drafts text or scores leads, say so. Check that outputs do not introduce discriminatory criteria or invented facts. Review generated content before it reaches a customer.

Give prospects a real choice about tracking. Read receipts and document analytics are useful. People should be able to ask what is collected and why.

How to build a compliance checklist for your proposal stack

Start with a data map. List every field the software collects, where it is stored and who can see it. Then map each processing activity to a lawful basis.

Build a compliance checklist

Map data fields and storage
Review email sequences
Audit claim library
Document anti-bribery controls
Set review dates

Next, review your email sequences against the ICO guidance. Remove any list you cannot source, and add a clear opt-out to every template.

Audit your claim library. Delete unsubstantiated statements and label illustrative figures. Keep evidence for comparisons and testimonials.

Document your anti-bribery controls for discounts, gifts and intermediaries. Make the approval route obvious inside the tool.

Finally, set review dates. Rules and regulator guidance change, and vendor sub-processors change more often. A short annual review with a named owner keeps the stack defensible.

Understanding your buyers and their expectations also reduces compliance risk. Our proposal software audience research guide for England explains how to gather evidence about what customers need from quotes and contracts.

Glossary

UK GDPR: the retained version of the EU General Data Protection Regulation that applies in the UK alongside the Data Protection Act 2018.
Lawful basis: the reason under data protection law that allows you to process personal data, such as consent, contract or legitimate interests.
Soft opt-in: a limited exception that can allow electronic marketing to existing customers in narrow circumstances.
CAP Code: the advertising code enforced by the Advertising Standards Authority.
Bribery Act 2010: the UK law creating offences including failure to prevent bribery by associated persons.
ISO 27001: an international standard for information security management systems.

Common questions

Do we need consent to send a quote follow-up email?

If the follow-up is marketing, you generally need consent or a valid soft opt-in. A quote request may count as negotiations, but a generic enquiry often does not. Keep records of what the person was told and how they opted in.

Can we use proposal software analytics to track document opens?

Yes, if you tell people what is collected and why, and you have a lawful basis. Do not use tracking to build hidden profiles. Honour objections.

Does the Bribery Act apply to small sales teams?

Yes. The failure to prevent offence can apply to commercial organisations of any size. Proportionate procedures are expected, scaled to your risks.

Are BSI and ISO standards mandatory for proposal software?

No, they are voluntary unless a contract or regulator requires them. They are useful evidence of good practice when customers ask about security and quality controls.