Rules and ethics
Part of Private social messages count as electronic mail, and other UK rules for B2B sellers
Data protection for B2B social selling, from source mapping to objections
Build data protection into B2B social selling in England by mapping personal information, lawful basis, transparency, objections and suppliers.
B2B social selling data protection starts when an identifiable person enters the workflow, not when a sales message goes out. A name, work address, profile identifier, role inference or conversation note can be personal information.
The UK GDPR and Data Protection Act apply UK-wide, including England. PECR adds channel rules, so review this operational guide for the real data and contact method.
What to take away
- Data protection duties start when an identifiable person enters the workflow, not when a sales message is sent.
- PECR channel rules and the UK GDPR lawful basis must be decided separately before any contact.
- Privacy information must explain source, purpose, basis, recipients and retention, generally within one month.
- The right to object to direct marketing is absolute, so keep suppression records without creating a new prospect file.
- Organisations using data brokers remain responsible for their own processing and cannot rely only on supplier assurances.
Map information from source to deletion
List every field collected from profiles, company pages, events, brokers, forms and sales records. For each one, record the source, purpose, access, disclosure, retention and deletion route. Separate facts from sales inferences. A published job title does not prove budget authority or interest.
The ICO's B2B marketing guidance confirms that UK GDPR duties apply to identifiable business contacts and to personal data taken from public sources. A generic address that identifies no person may produce a different analysis, but attaching it to a named contact can change the record.
Decide the channel and lawful basis separately
First ask whether PECR requires consent for the method and subscriber. Stored private social messages fall within the ICO's description of electronic mail. Corporate bodies, sole traders and certain partnerships are not treated identically. If the subscriber category is unclear, resolve it or use the more protective route.
Then select and document a UK GDPR lawful basis. Consent and legitimate interests are common marketing candidates, but neither is a label to add afterwards. The ICO's March 2026 legitimate-interests guidance requires purpose, necessity and balancing analysis and explains that direct marketing may qualify in some circumstances rather than automatically.
Tell the person what is happening
Privacy information should explain who uses the data and why. It should also cover the legal basis, the source, the recipients and the retention period.
The B2B page says information collected from another source must generally be explained within a reasonable period, no later than one month, subject to applicable exceptions. Do not assume a link in a platform profile fulfils the seller's own duty.
For audience uploads or matching, record what the platform receives and what people would reasonably expect. The ICO's direct-marketing planning page expressly discusses social targeting and warns that people without an account may not expect their information to be shared with a platform they do not use.
Minimise and respect objections
Collect only the fields needed for the stated decision. The ICO's data-minimisation guidance says personal information must be adequate, relevant and limited to what is necessary. A convenient enrichment field is not necessary merely because a supplier offers it.
Give people a clear route to object. For direct marketing, the data-protection right to object is absolute. Keep enough suppressed information to prevent accidental reacquisition and sending, without treating the suppression record as a new prospect file.
Control suppliers and changes
Check a broker's collection method, privacy wording, data age, permissions and intended uses. The ICO says organisations using data-broking services remain responsible for their own processing and cannot rely only on supplier assurances.
Document controller and processor roles, required contracts, international transfers and sub-processors. Pause if the source cannot be shown, an objection misses a system, targeting expands beyond approved purpose, or a supplier changes its terms.
As at 5 September 2026, some ICO marketing pages are under review after the Data (Use and Access) Act. Recheck them and obtain qualified approval before launch.
Before you act
- Map every field from source to deletion route.
- Separate facts from sales inferences in each record.
- Check whether PECR requires consent for the channel.
- Document a lawful basis with purpose, necessity and balancing.
- Give people a clear route to object and suppress.
- Check broker collection methods, permissions and data age.
Common questions
When do UK data protection duties begin for B2B social selling?
They begin when an identifiable person enters the workflow, not when a sales message is sent. A name, work address, profile identifier, role inference or conversation note can all be personal information, so the UK GDPR and Data Protection Act apply from that point.
How should a seller choose between PECR and the UK GDPR?
Treat them as separate decisions. First ask whether PECR requires consent for the method and subscriber, since stored private social messages count as electronic mail. Then select and document a UK GDPR lawful basis, such as consent or legitimate interests, with a real analysis behind it.
What must privacy information tell a business contact?
It should explain who is using the data, for what purpose, on what basis, from which source, with which recipients and for how long. Information collected from another source generally must be explained within a reasonable period and no later than one month, subject to exceptions.
