Local business marketing: build a disclosure policy

What to take away

The four sections to write

Copy-and-adapt policy wording

Start with permission. For unsolicited email and text marketing to individual subscribers, PECR (the Privacy and Electronic Communications Regulations) generally requires consent, except where the soft opt-in applies. That exception is limited to details collected during a sale or negotiations for a sale, marketing similar products or services, and giving a clear chance to refuse both when details are collected and in every message; it does not cover automated marketing calls.

This is separate from the UK GDPR and the Data Protection Act 2018. Record the UK GDPR lawful basis for processing, which may be consent or legitimate interests; legitimate interests does not replace a PECR requirement for consent. The ICO regulates data protection and enforces PECR's direct-marketing rules; use its direct marketing checklist to specify evidence, including the data source and exact consent wording.

For live marketing calls, screen against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS), and honour previous objections. Do not call a registered number unless you have the subscriber's specific consent to call.

Example consent wording

Use clear, affirmative and unticked choices. For example: “Yes, [business name] may send me marketing by [email/text] about [services]. I can withdraw my consent at any time using [method].” Offer a separate choice for each channel where appropriate, and keep the wording and version with the consent record.

Keep that wording version-controlled. If the questions on a sign-up form change, older records rely on the earlier wording, so store each version with the date it came into force. Data about sole traders is personal data, so a business address does not remove the need for a lawful basis.

Next, the first message. Say who you are, why you are contacting them and how to opt out. As an internal house rule, keep it under 60 words. If a lead came through a paid placement, the caller must identify the business paying for the enquiry.

Then paid labelling. For non-broadcast marketing, the CAP Code, administered by the Advertising Standards Authority (ASA), requires marketing communications to be obviously identifiable as such. Make paid placements identifiable before a reader engages with them. For Google Ads, check the guidance on ad labelling and disclosure settings for the specific format when briefing a supplier.

Finally, complaints. One named person owns the inbox, one response template exists and every complaint gets a dated log entry. Set a response deadline in the policy, tell staff what it is, and record whether it was met.

Assign owners before you publish

A policy without names is a wish. Give each of the four sections an owner, a review date and a place where evidence is stored. Marketing owns the first-message wording, operations owns the consent record, and a director signs off annually.

The UK rules and compliance guide explains how PECR, the UK GDPR, the Data Protection Act 2018 and the CAP Code fit alongside disclosure, so you avoid writing the same clause twice. Check the ICO's data protection fee self-assessment to establish whether the business must pay the fee or is exempt, and which fee tier applies: micro, small and medium, or large organisation.

Version control matters as much as ownership. Keep one master copy in a shared drive, log each change, and add the policy to the induction pack so new starters read it before they make calls. A policy that survives a change of staff is worth more than one tied to a single person. For broader continuity context, the ONS business demography data reports UK business births, deaths and survival rates for 2020; it is not evidence of compliance.

Keep the document to two pages, or the person making calls on a Friday afternoon will not read it.

What good evidence looks like

Evidence set: a timestamped consent record with the source, date, exact wording and version; a copy of the message sent; a screenshot of the paid placement; and a complaint log with outcomes.

Set and document a retention period for each record type, based on its purpose and legal need, and review it regularly. The UK GDPR's storage limitation principle means identifiable data should not be kept longer than necessary. If a lead objects, make producing the record within one working day the policy's internal target; delete records you no longer need. When someone withdraws consent, stop contact at once, note the date, and keep only what proves you honoured the request.

Score each campaign

Use this rubric at the start of every campaign and again at review. Score each row from 0 to 5, multiply by the weight, and total. Anything under 70% gets fixed before more budget is committed. Record each score with the date and the person who signed it off. The score is an internal quality gate, not proof of legal compliance; fix any legal breach regardless of the total.

Common questions

Does a disclosure policy have to be a formal document?

No, but it must be written down and dated. A two-page internal note with named owners and stored evidence is enough.

Who should sign it off?

A director or owner should sign it annually. Day-to-day changes can be made by the marketing lead, provided the review date is updated.

What happens if a lead complains about a paid advert?

Log it, stop contacting that person, and check whether the labelling rule was followed. If the advert was not identifiable as paid, fix the template.

Does this guidance apply outside England?

PECR, the UK GDPR and the Data Protection Act 2018 apply across the UK. This article focuses on England; local licensing and sector rules can vary between England, Scotland, Wales and Northern Ireland. The local service marketing regulations in England page sets out where England-specific duties sit; check the relevant nation's requirements and take advice on your own facts.