How UK GDPR and PECR shape B2B social selling under ICO guidance

What to take away

What ICO guidance says about B2B social selling under UK GDPR and PECR

The Information Commissioner's Office regulates data protection and electronic marketing in the UK. Its dedicated Business-to-business marketing | ICO guidance sets out how PECR and UK GDPR apply when you contact people at work.

The same rules apply whether you use LinkedIn, email or a sales engagement platform. That guidance explains the corporate subscriber distinction and the soft opt-in for business contacts. It is the first place to check before you build a prospecting sequence.

Social selling is not a legal category. The ICO looks at what you actually do: how you collect data, what you send, and whether the recipient can object. If you send a connection request and then a sales message, that is direct marketing under PECR.

If you enrich a profile with personal email addresses, that is processing under UK GDPR.

This matters because the ICO can act on complaints from individuals. It can issue reprimands, enforcement notices and fines. The ICO also publishes a direct marketing checklist that auditors and compliance officers use. Working through that checklist before a campaign is cheaper than responding to a complaint afterwards.

The Advertising Standards Authority also covers marketing communications, including some social media content. The CAP Code, UK GDPR and PECR interact when a post or message is both an ad and a marketing message. For a broader view of how those regimes fit together, see our guide to the CAP Code, UK GDPR and PECR.

Lawful basis for LinkedIn prospect data: legitimate interests in practice

Under UK GDPR you need a lawful basis before you process personal data. For B2B prospecting, legitimate interests is the most common choice. The ICO's A guide to lawful basis explains that you must identify a legitimate interest, show the processing is necessary, and balance it against the individual's rights.

You cannot simply assert legitimate interests; you must record the assessment.

A three-part test works well in practice. First, identify the interest: telling a relevant operations manager about a service that solves a problem they have. Second, show necessity: could you achieve the same result with less data or a less intrusive channel? Third, run the balance test: what is the individual's reasonable expectation?

Context drives the balance. A message to a named procurement lead at a company that buys your category is easier to justify than a bulk message to every marketing manager in a sector. The more personal data you append, the stronger your justification must be.

Sensitive data, such as health or political opinions, needs extra care and often a different basis.

Legitimate interests is not a free pass. Individuals have an absolute right to object to processing based on legitimate interests. If someone objects, you must stop processing their data for that purpose unless you can show compelling legitimate grounds. In social selling, the practical response is to suppress the record and stop outreach.

You should also check whether another basis fits better. Consent is harder to manage because it must be freely given, specific and withdrawable. Contract is rarely available before a sale. Legitimate interests is usually the right fit for B2B social selling, provided you document it.

Data minimisation and the personal information boundary for B2B contact records

Data minimisation is a UK GDPR principle: personal data must be adequate, relevant and limited to what is necessary. In social selling, the risk is collecting too much because it is easy. A LinkedIn profile, a personal email address, a mobile number and a home address are not all necessary for a first conversation.

Draw a boundary between business contact data and personal data. A work email address and a job title are usually enough to start a B2B conversation. Personal mobile numbers, private social profiles and inferred personal interests go beyond what most outreach needs. If you cannot explain why a field is necessary, do not collect it.

Scraping is a particular risk. Automated collection of profile data can breach LinkedIn's terms and UK GDPR if it captures more than you need. The ICO expects you to have a lawful basis for scraping and to respect any objections. It also expects you to check the accuracy of enriched data.

Retention is part of minimisation. Set a retention period for prospect records, such as twelve months from last contact, and delete or anonymise data after that. Document the period and the reason. A CRM that keeps every lead forever is a liability, not an asset.

For a fuller treatment of source mapping and objection handling, see our article on data protection for B2B social selling.

PECR rules on electronic mail: when LinkedIn messages and email outreach are covered

PECR regulation 22 restricts unsolicited electronic mail for direct marketing. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO explains that electronic mail includes email, SMS, and similar messages.

Its Electronic and telephone marketing | ICO page confirms that private messages on social platforms can count as electronic mail.

The practical point for sellers is simple: private social messages count as electronic mail. A LinkedIn InMail or direct message that promotes a product is likely to be covered by PECR regulation 22.

A public post is different, because it is not addressed to a specific individual in the same way. The line between public and private is where most compliance risk sits.

The rules differ by recipient type. For individual subscribers, you generally need consent. For corporate subscribers, you can rely on the soft opt-in in some circumstances. Corporate subscribers include limited companies, limited liability partnerships and public bodies. Sole traders and some partnerships are treated as individual subscribers, so they need consent.

You must also identify yourself and provide a valid address for opt-out in every message. A reply to a LinkedIn message may be enough if it is clearly monitored, but a dedicated opt-out address is safer. Keep records of when and how someone opted out.

PECR sits alongside UK GDPR. Even if you have a lawful basis under UK GDPR, you still need to satisfy PECR for the marketing message itself. The two regimes are cumulative, not alternatives.

The soft opt-in and corporate subscriber distinction for UK B2B sellers

The soft opt-in is an exception to the consent rule for electronic mail. It applies when you obtained the contact details in the course of a sale or negotiations for a sale, you are marketing similar products, and you offered an opt-out at collection and in every message.

For B2B sellers, the soft opt-in is most useful with existing customers and active prospects. If a prospect downloaded a whitepaper and gave a work email, that may count as negotiations for a sale. If you bought a list from a third party, it almost certainly does not.

The corporate subscriber distinction decides whether you need consent at all. Corporate subscribers are bodies such as registered companies. Individual subscribers include sole traders and non-limited partnerships. A message to a generic company inbox is usually treated as a corporate subscriber message. A message to a named sole trader is not.

This is why list quality matters. A list of generic company addresses is lower risk than a list of personal addresses at those companies. If you cannot tell whether a recipient is a corporate or individual subscriber, treat them as an individual and seek consent.

The soft opt-in does not override objections. If someone has opted out, you cannot rely on the soft opt-in for that person. Suppression always wins.

Individual rights, objections and suppression lists in a social selling CRM

Individuals have rights under UK GDPR, including access, rectification, erasure, restriction and objection. In social selling, the most common is the right to object to direct marketing. When someone objects, you must stop using their data for that purpose. You should also tell them what you have done.

A suppression list is the operational answer. It records people who have opted out, objected or asked not to be contacted. The list should be checked before every campaign and shared with anyone who sends messages on your behalf. It should include the channel and the date of the objection.

Your CRM needs to handle rights requests within one month. That means you need a way to find all data about a person across LinkedIn, email, the CRM and any enrichment tools. If your data is spread across tools with no shared identifier, you will struggle to respond in time. Map your sources before you need to.

Objections are not the same as erasure. Someone may object to marketing but still be a customer, so you keep the contract data. Record the distinction. Deleting everything can create its own compliance problem if you need the record to prove you stopped.

A disclosure policy helps here too. Our guide to writing a disclosure policy for B2B social selling covers how to label the first interaction so recipients know who you are and why you are contacting them.

DPIAs, breach reporting and the ICO data protection fee for social selling tools

A Data Protection Impact Assessment is required for processing that is likely to result in a high risk to individuals. The ICO's Data Protection Impact Assessments (DPIAs) | ICO guidance explains when a DPIA is needed and what it should contain.

Social listening and lead scoring can qualify, especially when they involve profiling or large volumes of personal data.

Lead scoring that ranks people by inferred behaviour is profiling. If it affects what they are offered, or uses sensitive data, a DPIA is likely. Social listening that monitors public conversations at scale can also trigger one. Build the DPIA before you switch the tool on, not after.

Breach reporting is separate. If a personal data breach is likely to result in a risk to individuals, you must report it to the ICO within 72 hours of becoming aware. You must also tell affected individuals if the risk is high. A lost laptop with prospect data or a misconfigured CRM export can both be reportable.

The ICO data protection fee applies to most organisations that process personal data. It is an annual fee, with tiers based on size and turnover. Check whether your business is exempt, and keep the payment record. Operating without paying the fee when required is a breach in itself.

For market context on how large the UK social selling sector is, see our piece on sizing B2B social selling in England.

A compliance checklist for UK B2B social selling outreach

Use this checklist before each campaign. It is not legal advice, but it covers the questions the ICO is likely to ask if a complaint arrives.

The order matters. Start with lawful basis and recipient type, because those decide whether you can send at all. Then move to message content, data limits and retention.

A worked example shows how this fits together. A UK software firm wants to contact operations directors at manufacturing companies in the West Midlands and North West England. It builds a list from LinkedIn Sales Navigator and a webinar attendee list.

For the webinar list, it relies on the soft opt-in because attendees gave details during a sale-related interaction. For the LinkedIn list, it relies on legitimate interests, records the assessment, and sends a short message that identifies the sender and offers an opt-out.

It checks the suppression list, keeps records for twelve months, and pays the ICO fee. When one director objects, it suppresses the record and stops outreach. That is the pattern the ICO expects.

Common questions