Introductory guide to using data to market to customers

As direct marketing involves the processing of personal data, marketers need to comply with the Data Protection Act 1998 (DPA) – the key law in this area; as well as the Privacy and Electronic Communications Regulations 2003 (PECR) – containing the rules about electronic marketing and cookies. The DPA and PECR aren’t the only rules though and, when using data for marketing purposes, you may need to also consider the Direct Marketing Association’s (DMA) Code of Practice and the UK Code of Non-broadcast Advertising, Sales Promotion and Direct Marketing (CAP Code) if relevant. 

Introduction

If personal data is being used for marketing purposes, compliance with the eight Data Protection Principles under the DPAis essential. The first principle requires “fair and lawful processing” and ensures that data is only processed either with the consent of the individual, for a purpose that the DPA regards as “necessary” or if it’s in the legitimate interests of the organisation doing the marketing.. Marketers usually, but not always, need consent to process personal data for marketing purposes, as the “necessary” purposes in the Act are narrowly defined and rarely applicable in the marketing context and even if legitimate interests can be relied on, you still need to tell individuals you are going to use their data for marketing so it’s often easier to ask for consent up front so there are no surprises.

The obligation to comply with the DPA falls on the data controller, that’s the person that determines the purpose for which and manner in which personal data is to be processed. So it’s up to the data controller to explain to individuals the marketing use that will be made of the data once collected (this is typically explained through a fair processing notice), and ensure that it is clear how the data controller will market to the individuals (typically by including opt-in choices on data collection).