Consent or legitimate interest? How content agencies handle data protection

What to take away

A Leeds content agency running a lead-generation campaign asks its client's CRM list to opt in to a monthly newsletter. Half the list ignores the request. The other half clicks. Under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), the agency can email the clickers, but cannot treat the silent half as having agreed.

Where England agencies sit in the UK data regime

Data protection is a reserved matter, so the same rules apply in England, Scotland, Wales and Northern Ireland. The ICO regulates the UK GDPR and PECR.

An agency in Manchester handling a client's newsletter list is a processor unless it also decides why the data is used. That distinction changes the paperwork. A processor needs a written contract with the client under Article 28 of the UK GDPR. A controller needs a lawful basis, a privacy notice and a retention schedule.

For a wider view of how compliance sits alongside contracts and copyright, the UK rules and compliance guide maps the main duties.

Consent, legitimate interests and the email rule

The ICO's guide to PECR explains that electronic mail marketing to individuals generally needs prior consent, unless the soft opt-in applies. That exception covers people who gave their details during a sale or negotiations for a similar product.

A content agency sending cold outreach to a named business address may rely on legitimate interests, but it must offer an opt-out in every message. The balancing test should be written down: what is the interest, is the processing necessary, does it override the individual's rights?

Consent records matter. If the ICO asks, a screenshot of a tick box with a date and source is stronger than a note that the client confirmed it verbally.

What counts as valid consent?

Valid consent under the UK GDPR means a clear affirmative action. Pre-ticked boxes, silence and bundled terms do not count. The person must be able to withdraw as easily as they agreed.

Can we rely on legitimate interests for B2B email?

Sometimes, but not automatically. You need a recorded assessment and a working opt-out. If the recipient is a sole trader, treat the message as consumer marketing and get consent.

Advertising rules that catch content campaigns

Data law is only half the picture. The ASA's advice for businesses sets out how the CAP Code applies to ads and marketing communications, including paid social posts and influencer content.

That matters when a content agency writes a case study or a sponsored article. Native advertising that hides its commercial nature can breach the CAP Code even when the data handling is sound.

For campaigns aimed at US audiences, the FTC's advertising and marketing guidance explains the disclosure expectations there. One campaign can fall under both regimes.

A short glossary

Common questions

Do content agencies need a data protection officer?

Usually not. A DPO is only mandatory in specific cases, such as large-scale monitoring or processing special category data. Most agencies appoint a privacy lead instead.

How long can we keep a client's marketing list?

The UK GDPR does not set a fixed period. Keep the data only as long as needed for the purpose, then delete it. Document the retention period in the contract or privacy notice.

Does Brexit change the rules for England agencies?

The UK GDPR and PECR still apply. Transfers to the EU and elsewhere still need a lawful transfer mechanism.

What happens if we get it wrong?

The ICO can issue reprimands, enforcement notices and fines. The England regulations overview explains how the regime is enforced. Individual cases need a qualified adviser.