An email field can serve several different purposes. It may deliver a receipt, answer an enquiry, create an account or add somebody to marketing. Problems begin when one vague checkbox is expected to authorise all of them.
Map each message before designing the form. This article provides operational guidance, not a legal opinion. Organisations should assess their audience, message and circumstances against current ICO guidance.
Separate service messages from marketing
A message needed to provide a requested service is not automatically marketing. An order confirmation can give delivery facts without promoting another product. Adding a sales offer changes the character of the content and may bring electronic marketing rules into the decision.
Label website choices by purpose. “Send my quotation” describes the immediate request. A separate choice can invite product news or useful guidance. Do not make optional marketing permission a condition of receiving a quote unless there is a sound and transparent reason.
Know which recipient you are contacting
ICO guidance treats individuals, sole traders and some partnerships differently from corporate subscribers under the electronic mail rules. Marketing to an individual generally needs specific consent or a valid soft opt-in. Corporate bodies can be approached without that PECR consent, but the sender must identify itself and provide a valid opt-out address.
Personal data rules still apply when a named business contact is involved. A work email address containing a person’s name is personal information. Record the lawful basis, be fair and make the privacy information available.
Use consent that can be understood and proved
Consent should be a clear positive action, specific to the channel and purpose. Leave optional boxes unticked. Name the organisation sending the messages and avoid bundling unrelated companies into an open-ended statement.
The database needs more than a yes or no value. Keep the wording shown, time, source form, channel and account or record linked to the action. If the wording changes, preserve the version that applied when the choice was made.
Apply the soft opt-in narrowly
The soft opt-in is not general permission to email anybody who entered an address. ICO guidance limits it to the organisation’s own customers, or people in genuine sale negotiations, for similar products and services. An opt-out must be offered when details are collected and in every later message.
A request for general information does not necessarily amount to negotiation for a sale. Document why the rule applies to the route rather than adding every contact-form enquiry to a campaign automatically.
Make unsubscribing work end to end
Every marketing email needs a simple way to object. The link should not require an account password or a long survey. Process the request promptly across all relevant marketing tools, not only the list that sent the last campaign.
Keep a minimal suppression record so the address is not imported again later. Suppression is different from deleting every trace of the request; enough information may need to remain to respect the objection.
Review purchased and shared lists carefully
A supplier’s assurance that a list is “GDPR compliant” does not prove permission covers your organisation, purpose and email channel. Obtain the collection wording, source, date and method. If those details cannot demonstrate appropriate permission, do not use the list.
Take the same care when moving contacts between group companies, partners or platforms. A technical export does not expand what people were told or what they agreed to receive.
Test the complete website flow
- Submit with the marketing choice left blank.
- Submit with it selected and inspect the stored evidence.
- Confirm the promised welcome or double-check message arrives.
- Use the unsubscribe link and verify future sends are suppressed.
- Check that failed form submissions do not create consent records.
- Confirm staff can find and apply an objection received by phone.
Review third-party form, CRM and email permissions as part of the test. Each integration should receive only the fields needed for its stated role, with access limited to people who use them.
Give the record an owner
Name the person responsible for form wording, audience rules, suppression and periodic review. Campaign activity can move quickly; an owned decision record prevents a convenient data import from quietly changing the permission model.
Sources and further reading
- ICO guidance on complying with electronic mail marketing rules — the source for consent, the soft opt-in and list checks.
- ICO direct marketing advice for small organisations — the reference for individual and corporate contacts, identity and opt-out duties.
Xapner can connect forms, consent evidence and campaign systems through its digital marketing and automation services.