Nine data protection mistakes that sink local service marketing

What to take away

The most common mistake is treating consent as a one-off tick box rather than a record of what someone was told. The ICO's Direct marketing guidance sets out the records to keep.
Buying or scraping a list of local contacts and calling it opt-in is the fastest route to a complaint.
Soft opt-in exists for existing customers, but it is narrower than most teams assume and does not cover cold prospects.
Advertising claims sit under separate rules covering misleading and aggressive promotions, and unfair commercial practices law also applies.

Mistake one: no lawful basis on file

If you cannot say why you hold a person's details, you cannot defend the marketing. For each list, record whether you rely on consent or legitimate interests.

Do you need a lawful basis?

Does the list contain names or contact details?

Yes

Record consent or legitimate interests

Leaflet drop needs no basis

A leaflet drop with no names attached needs no basis. A follow-up call does. Legitimate interests need a balancing test you can show later, weighing your gain against what the person would expect.

Example: a plumber emails past customers about servicing. Gain: repeat business. Expectation: service reminders. Safeguards: easy opt-out. Result: legitimate interests likely apply.

Mistake two: consent captured without a record

Consent must be specific, informed and freely given. A vague "we may contact you" box on a quote form is weak. Keep a screenshot of the exact wording, plus the date and the source page it appeared on. The ICO's Direct marketing guidance sets out the standard and the evidence to keep.

Sample wording: "I agree to receive marketing emails from [Business] about similar services. I can unsubscribe at any time."

Consent evidence to keep

Screenshot of exact wording
Date consent was captured
Source page it appeared on
Specific, informed and freely given

Mistake three: buying a local list

A bought list is almost never consented to you. A seller's opt-in belongs to them, not you. Delete it and rebuild from your own enquiries.

Mistake four: misusing soft opt-in

Soft opt-in lets you email or text existing customers about similar services. It does not cover cold prospects or a rented list. Keep the sale details.

Mistake five: ignoring telephone rules

Screening against the TPS and CTPS is not optional for live calls. Use the official TPS and CTPS online checking service at tpsonline.org.uk. Corporate numbers are treated differently, but sole traders often count as individuals. The ICO can fine up to £500,000 under the Privacy and Electronic Communications Regulations (PECR) for nuisance calls.

Mistake six: no retention limit

Holding old enquiries forever creates risk. The ICO's guidance on the storage limitation principle explains how to justify a retention period: set one, for example 24 months from last contact, and delete on schedule. Keep a deletion log with these fields: record ID, date added, source, lawful basis, retention period, deletion date, approved by.

Mistake seven: using customer details in ads without consent

A before-and-after photo, a named testimonial or a customer quote is personal data, so publishing it needs a lawful basis — usually consent recorded in the same way as any other. Price claims, urgency and testimonials also fall under the Committee of Advertising Practice (CAP) Code. The ASA's explanation of how advertising regulation works in the UK covers the self-regulatory system and its sanctions. The ASA can refer repeat offenders to Trading Standards.

Mistake eight: pressure selling built on personal data

Pressure selling and false scarcity can breach the Consumer Protection from Unfair Trading Regulations 2008. The Digital Markets, Competition and Consumers Act 2024 lets the CMA fine up to 10% of global turnover. Where that pressure leans on personal data — a bought list, a scraped mobile number, repeat follow-ups to someone who opted out — the ICO can act under the UK GDPR as well.

Mistake nine: no written contract with the suppliers who handle your data

Email platforms, CRMs, call centres and list brokers all process personal data for you. Under the UK GDPR you need a written contract — a data processing agreement — with each of them, setting out what they may do with the data and what they must delete. A written data sharing and disclosure policy keeps that visible when a campaign underperforms or a complaint lands.

A fix sequence you can run this month

A fix sequence

Map every contact detail source.
Record basis and exact wording.
Delete bought lists and untraceable contacts.
Screen numbers via the official TPS/CTPS service.
Set retention and deletion dates, and log them.

Where the rules differ across the UK

Data protection law applies in the same way across the UK, but consumer enforcement varies: Trading Standards Scotland, Trading Standards Wales and Trading Standards Northern Ireland handle local complaints, while the ICO covers the whole country. The UK rules and compliance guide covers the rest of the compliance picture for local service marketing.

Common questions

These are the questions local teams ask most about consent, calling and retention.

Do I need consent to email a past customer?

Not always. Soft opt-in may cover a similar service if you collected the address during a sale and offered an opt-out.

Can I call a local business without checking TPS?

Sole traders and some partnerships count as individuals. Use the official TPS and CTPS online checking service at tpsonline.org.uk. Limited companies are generally treated differently, but verify the number type.

How long can I keep enquiry data?

There is no fixed period. Set a justified retention window, for example 24 months from last contact, and delete on schedule.

Does a disclaimer on my website cover everything?

No. A privacy notice explains processing but does not replace consent, screening or accurate advertising.