Rules and ethics
Part of Private social messages count as electronic mail, and other UK rules for B2B sellers
B2B social selling UK regulations: advertising law, UK GDPR and PECR for social direct messages
Which UK rules apply to B2B social selling in England: misleading advertising regulations, UK GDPR for named contacts and PECR on social direct messages.
B2B social selling UK regulations depend on what the seller does. A public claim, a comparison, a named contact record and a private message can each engage a different rule. The frameworks below apply across the UK, including England. There is no England-only social selling law, so check your actual offer, audience and channel with a qualified adviser.
What to take away
- Advertising to businesses is covered by the Business Protection from Misleading Marketing Regulations 2008.
- A named work contact is personal information, so the UK GDPR can apply even in a business context.
- PECR treats direct messages via social media as electronic mail, and its consent rule depends on the subscriber type.
- The ICO page on B2B marketing is under review after the Data (Use and Access) Act, so recheck it before launch.
Business advertising and comparisons
Advertising to businesses is covered by the Business Protection from Misleading Marketing Regulations. As well as being accurate and honest, you must not make misleading comparisons with competitors. The GOV.UK advertising regulations page sets this out for sellers.
The 2008 regulations deal with misleading advertising and with comparative advertising that is not permitted. Keep the evidence behind every performance, saving and superiority claim before a seller publishes it. The advertising rules article shows how to check content against them before release.
If a post can reach consumers as well as businesses, consumer-protection rules may need review too. An internal "B2B" label does not settle who the audience is.
Personal information and direct contact
If you process personal data for direct marketing, even in a business context, the UK GDPR applies. A named employee at a company is still an individual. If you collect contact details in their business capacity, you must tell them and have a lawful basis under the UK GDPR.
Businesses and business contacts can object to your direct marketing. Build an objection route before the first message and keep a suppression record. The data protection guide covers source mapping and objections in detail.
Publicly visible profile information is not a shortcut. Seeing a name on a profile tells you nothing about whether you may send marketing to it.
PECR and social direct messages
PECR covers electronic mail. The ICO B2B marketing guidance lists emails, text messages, picture or video messages, voicemails and direct messages via social media, or any similar message stored electronically. A private social message to a prospect is therefore in scope.
The rule on direct marketing by electronic mail does not apply to corporate subscribers. It does apply to sole traders and some partnerships, which PECR treats the same as individuals. Regulation 22 of PECR applies to unsolicited electronic mail to individual subscribers.
| Recipient | Subscriber type | Electronic mail consent rule |
|---|---|---|
| Employee of a company or LLP | Corporate subscriber | Does not apply |
| Sole trader | Individual subscriber | Applies |
| Some partnerships | Individual subscriber | Applies |
Corporate status does not remove every duty. The UK GDPR still applies to the personal data, and the sender still needs to be open about who they are. The UK rules and compliance guide explains how private messages fit the wider rule set.
A four-stage control record
Before activity begins, document four things. The operating workflow shows where each one sits in the process.
- Classification:audience, placement, subscriber type, personal fields and any regulated subject.
- Authority:evidence for claims, lawful basis, any consent and the right to use content.
- Delivery:approved wording, identity, opt-out route and the owner of account access.
- Response:objections, corrections, complaints, incidents, retention and deletion.
Do not make the salesperson resolve uncertain law at the moment of sending. Reviewers should see the real asset and settings, not a generic description.
Who reviews what
Marketing can classify the placement and keep claim evidence. Sales can verify account relevance and subscriber facts. A privacy lead should review lawful basis, notice and objection handling. A sector specialist checks restricted claims.
Record each decision separately. One approval marked "compliant" is hard to revisit when only the audience or contact method changes. Publish a clear disclosure policy for first contact so reviewers and sellers use the same wording.
When to recheck the rules
The ICO guidance on business-to-business marketing is under review and may be subject to change, because of changes made by the Data (Use and Access) Act. Recheck it before publication or launch, along with the sector rules that apply to your clients.
A planned 2027 workflow is a plan, not proof that the law or a platform stays unchanged. Read the market guide for the wider planning context.
Before you act
- Classify each message by audience, placement and subscriber type.
- Hold evidence for every performance, saving or comparison claim.
- Record the lawful basis for each personal data field.
- Give contacts a clear way to object and honour it.
- Recheck the ICO B2B marketing page before each launch.
Common questions
Does the UK GDPR apply to a named work contact at a company?
Yes. If you process personal data for direct marketing, even in a business context, the UK GDPR applies. You must tell the person and have a lawful basis.
Are private social direct messages covered by PECR?
Yes. PECR covers direct messages via social media as electronic mail. Whether the consent rule applies depends on whether the recipient is a corporate or an individual subscriber.
What should be documented before social selling begins?
Document classification, authority, delivery and response. That means audience and subscriber type, claim evidence and lawful basis, approved wording and opt-out route, and how objections, incidents and deletion are handled.
