Written for people who have to comply with data protection law without being specialists in it. Each section quotes the provision itself — so you can see the wording rather than someone's summary of it — and then says what it means when you are actually doing the job. It is a reference, not legal advice, and it does not replace your own organisation's policies.

1 · The words that matter

Four definitions from Article 4. Get these right and most of the rest follows.

Personal data — Article 4(1)

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

In plain terms: if you can work out who someone is from it, it is personal data. A name, a case reference that ties back to a person, an email address, a call recording, notes of a meeting about someone — all personal data. “Indirectly” is the word people miss: data that identifies nobody on its own still counts if it identifies someone when combined with something else you hold.

Processing — Article 4(2)

“‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.

Doing almost anything with data is processing — including simply storing it, or opening a file to read it. There is no “we only looked at it” exemption.

Controller and processor — Article 4(7) and 4(8)

A controller is the person or body which, “alone or jointly with others, determines the purposes and means of the processing of personal data”. A processor is a body “which processes personal data on behalf of the controller”. Two organisations can be joint controllers of the same processing.

This is the single most consequential thing to get right on a contract, because it decides who carries the obligations. Where you deliver a service as a subcontractor, the roles are set by the contract — read it rather than assuming. The label in the agreement is not decisive either: what matters is who actually decides why and how the data is processed.

2 · The seven principles

Everything else is built on these. Six sit in Article 5(1), with accountability in Article 5(2).

“Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
(b) collected (whether from the data subject or otherwise) for specified, explicit and legitimate purposes and not further processed by or on behalf of a controller in a manner that is incompatible with the purposes for which the controller collected the data (‘purpose limitation’);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 84B (‘storage limitation’);
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”

Article 5(2): “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

3 · Lawful basis — you always need a reason

You cannot process personal data without a lawful basis. Pick it before you start, write it down, and be able to say which one it is. There were six; the Data (Use and Access) Act 2025 inserted a seventh, so a policy that still says “one of six” is out of date.

Article 6(1): “Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task of the controller carried out in the public interest or a task carried out in the exercise of official authority vested in the controller;
(ea) processing is necessary for the purposes of a recognised legitimate interest;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

“Points (ea) and (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.”

Point (ea) and the Annex 1 list it refers to were inserted by the Data (Use and Access) Act 2025 s.70, in force 5 February 2026. The recognised legitimate interests are a closed list — disclosure for another body's public-interest task, national security, public security and defence, emergencies, crime, and safeguarding vulnerable individuals — and unlike point (f) they need no balancing test. Each carries its own conditions: the first and broadest only operates where that other body has actually requested the disclosure and it is necessary for their task, so it is not a general licence to share. Outside the list, nothing has changed.

• The most common mistake is defaulting to consent for everything. Consent must be freely given and can be withdrawn at any moment. If someone cannot realistically say no — because the processing is what delivers the service they signed up for — consent is the wrong basis and one of the others fits better.
• The basis for core delivery is rarely the basis for optional extras. Delivering the service might run on contract or public task; publishing someone's story in a newsletter is optional and runs on consent.
• Legitimate interests needs a documented legitimate interests assessment, and “do the balancing test” is not the same instruction. The ICO's LIA has three named parts: the purpose test (is there a legitimate interest?), the necessity test (is this use necessary for it?) and the balancing test (do the person's interests override it?). Someone asked only for the balancing test will produce a third of the assessment. Without the record you cannot demonstrate the basis under Article 5(2).

4 · Special category data — the extra rules

Article 9(1): “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.”

That prohibition lifts only if a condition in Article 9(2) applies. The two met most often outside a clinical setting:

Article 9(2)(a): processing is permitted where “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where domestic law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject”.

Article 9(2)(h): processing is permitted where it “is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” on the basis of domestic law “or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3” — the requirement that whoever processes it is under professional secrecy.

The UK add-on, and who it actually applies to

This is where the shorthand “you always need two conditions” goes wrong. Only five of the ten Article 9(2) conditions need a second condition from Schedule 1 to the DPA 2018: (b) employment and social security, (g) substantial public interest, (h) health or social care, (i) public health, and (j) archiving and research. Explicit consent under 9(2)(a) needs neither a Schedule 1 condition nor an appropriate policy document — so the condition most people reach for first is the one the shorthand does not describe.

The appropriate policy document requirement is narrower still. It attaches to Schedule 1 condition 1 (employment, social security and social protection) and to almost all of the roughly twenty-three substantial-public-interest conditions in Part 2 — but not to health or social care, public health, or archiving and research. A missing appropriate policy document is a common audit finding, but check which condition you are actually relying on before concluding you need one.

DPA 2018, s.10(2): “The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.”

Criminal offence data is a separate regime, not a subset

Article 10 data — including the result of a criminal record check — is not special category data, and needs no Article 9 condition at all. What it needs is an Article 6 lawful basis plus either official authority or a condition in Schedule 1. Going looking for an Article 9 condition for a DBS result is a wasted search, and forgetting the official-authority route means organisations that have it reach for a Schedule 1 condition they do not need. Some, but not all, of the relevant conditions carry the appropriate policy document and record-keeping requirements.

5 · Being transparent

Article 12(1): “The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication made under or by virtue of Articles 15 to 22D and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child”.

In practice this is the privacy notice, given at the point of collection: who you are, what you collect, why, the lawful basis, who you share it with, how long you keep it, and their rights. Article 12(1) sets five separate qualities, and they are not synonyms — the information must be concise, transparent, intelligible, easily accessible, and in clear and plain language. A notice can be perfectly readable and still fail on accessibility because nobody can find it. Two things worth saying plainly:

• An internal data protection policy is not a privacy notice. A policy tells staff what to do; a notice tells the individual what is happening to their data. Having one does not discharge the duty to provide the other. (Note the ICO treats “privacy notice”, “privacy policy” and “privacy information” as the same thing — the distinction that matters is internal versus individual-facing, not the word on the front.)
• “Concise, transparent, intelligible and easily accessible” and “clear and plain language” are five separate legal requirements, not a style preference. The ICO’s advice on testing whether a notice meets them is to put it in front of the people it is written for — user testing and consultation — rather than to score it.

6 · Individual rights, and subject access requests

People have rights to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and rights around automated decision-making (Articles 15 to 22D). The one you will meet most is the right of access.

Article 15(1): “The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed …; (d) where possible, the envisaged period for which the personal data will be stored …; (e) the existence of the right to request … rectification or erasure …; (ea) the right to make a complaint to the controller under section 164A of the 2018 Act; (f) the right to make a complaint to the Commissioner under section 165 of the 2018 Act; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, which is subject to the requirement to provide safeguards under Article 22C and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject”.

The clock — and where it now lives

This is the provision most often quoted from memory, and the wording changed. The one-month deadline used to sit in Article 12(3) itself. The Data (Use and Access) Act 2025 moved it into a new Article 12A, and Article 12(3) now simply points there. Anything still citing “one month under Article 12(3)” is quoting a superseded text.

Article 12(3): “The controller shall provide information on action taken on a request made under or by virtue of Articles 15 to 22D to the data subject without undue delay and in any event before the end of the applicable time period (see Article 12A).”

Article 12A(1): “the applicable time period” means the period of one month beginning with “the relevant time”.
Article 12A(3): “The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of— (a) the complexity of requests made by the data subject, or (b) the number of such requests.”

The month itself is unchanged, and so is the two-month extension. Two things are worth knowing about the new drafting: the extension requires notice to the data subject, and the clock is kinder about missing information — where you reasonably need proof of identity, the month does not start until you receive it (Article 12A(2)), and where you need the request clarified, it pauses while you wait (Article 12A(5)). A genuine improvement on the old position, but only if you actually ask, promptly, and record when you did.

Article 12(5): the information “shall be provided free of charge”, though a “reasonable fee” or refusal is allowed for “manifestly unfounded or excessive” requests.

• A request can be made verbally or in writing, including by social media, to any part of the organisation, without using the words “subject access request” or any form. You can offer a standard form, but you must make clear it is not compulsory. If someone asks any member of staff for what you hold on them, the clock has started — and days lost before it reaches the right person are days off the month.
• Check which text your own procedure quotes. A DSAR procedure citing the one-month deadline as “Article 12(3)” has not been reviewed since the Data (Use and Access) Act 2025 moved it to Article 12A.
• Health and clinical records in a request need care: the DPA 2018 allows some health information to be withheld where disclosure would cause serious harm, and third-party information has to be considered before release. These are not decisions to take alone.
• Never start deleting anything once a request has arrived. Section 173(3) of the DPA 2018 makes it an offence to “alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure” of what the requester would have been entitled to receive. It bites on the controller, its officers, and people employed by or acting under its direction.

7 · Erasure, and the other rights

Article 17(1): “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay … where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected …; (b) the data subject withdraws consent on which the processing is based … and where there is no other legal ground for the processing; (c) the data subject objects … and there are no overriding legitimate grounds …; (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation …; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”

The catch is Article 17(3): erasure does not apply where the data is still needed to comply with a legal obligation, or to establish or defend legal claims. So “the right to be forgotten” does not let someone wipe a record you are contractually or legally required to keep — but you do have to explain why, within the same one month.

The others in brief: rectification (fix inaccurate data, Article 16), restriction (pause processing while a dispute is resolved, Article 18), portability (a reusable copy, Article 20) and objection (Article 21). All carry the same one-month clock under Article 12A. Article 21(2) and (3) are worth knowing separately: an objection to direct marketing is absolute — there is no balancing test, and once made the data “shall no longer be processed for such purposes”.

8 · Keeping data secure

Article 32(1): “Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.”

Note (c) and (d). Backups you have never restored from, and controls you have never tested, do not meet Article 32 — the ability to restore and the process for testing are in the text. This is also where a certification such as Cyber Essentials or ISO 27001 earns its keep: not because either is legally required, but because they are evidence that the measures exist and are checked.

Sending data outside the UK

Chapter V adds a separate requirement on top of everything above: a restricted transfer needs a transfer mechanism. Either the destination is covered by UK adequacy regulations, or you put an appropriate safeguard in place — most often the IDTA, or the UK Addendum to the EU standard contractual clauses — and carry out a transfer risk assessment on whether the protection survives in that country in practice. This bites more often than people expect, because it is triggered by a supplier's hosting or support arrangements rather than by any deliberate decision to send data abroad. Ask the question at the same time as the impact assessment, not afterwards.

9 · Personal data breaches — the 72 hours

A breach is not only a hacker. A lost laptop, an email to the wrong person, a file left on a train, ransomware, and accidental deletion with no backup are all personal data breaches.

Article 33(1): “In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Commissioner, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification under this paragraph is not made within 72 hours, it shall be accompanied by reasons for the delay.”

Article 34(1): “When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.”

• The 72 hours runs from when the organisation becomes aware, which the guidance the ICO works from reads as the point of reasonable certainty that a breach has happened — enough room for a short check, not for a week of deliberation. Report it internally the moment you spot it even if you are not sure it counts, because the clock is not yours to start.
• Two different thresholds, and this is the point most often missed: telling the regulator is triggered by a risk to individuals; telling the individuals is triggered by a high risk. One does not imply the other.
• 72 hours is a backstop, not an allowance — the duty is “without undue delay”. It is a continuous 72 hours rather than three working days, so a Friday discovery does not buy until Monday.
• Article 33(5) requires you to record every breach, including the ones you decide not to report, with the facts, the effects and the action taken. An organisation that reports the serious ones and keeps no log of the rest has a gap an audit will find, and no evidence for the judgement it made.
• Article 33(2): a processor who becomes aware of a breach must notify the controller without undue delay. There is no separate 72 hours for them — and the controller’s own clock generally starts when the processor tells them, which is why “without undue delay” is the phrase doing the work.

10 · Data protection impact assessments

Article 35(1): “Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.”

Note “prior to”. A DPIA done before a system is chosen is a short piece of work; the same assessment after go-live is an argument about a decision already taken. The practical rule for everyone else in the organisation is to raise a new app, tool or supplier that will touch personal data before it is signed, not after.

Three statutory triggers sit in Article 35(3): systematic and extensive automated evaluation producing legal or similarly significant effects; large-scale processing of special category or criminal offence data; and systematic monitoring of a publicly accessible area on a large scale.

The ICO adds ten of its own, and the distinction between them decides the answer. Five stand alone — denial of service, large-scale profiling, data matching, targeting children or other vulnerable people, and processing risking physical harm. Five require a DPIA only in combination with another criterion — innovative technology, biometrics, genetic data, invisible processing, and tracking. Reading past that rider produces a DPIA that was never required; missing one of the standalone five produces the opposite and worse error. The European criteria the ICO also adopts work on a rule of thumb that two factors together usually indicate a DPIA, though the ICO is explicit that this is not a strict rule.

Who has to be asked, and what happens if the risk remains

Article 35(2) puts a duty on the controller to seek the DPO's advice where one is appointed — the ICO states this as a must, and it is a stronger obligation than the DPO's own task list in Article 39(1) implies. On sign-off, the ICO leaves it to each organisation to decide who carries out a DPIA and who signs it; there is no rule that the author cannot. What there is a rule about is the residual risk: under Article 36, if a high risk remains after mitigation, you must consult the ICO before the processing starts. High residual risk cannot simply be accepted internally, however senior the person accepting it.

11 · The data protection officer

Article 38(1): “The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.”

Article 39(1): the DPO's tasks include “to inform and advise the controller … and the employees who carry out processing of their obligations”, “to monitor compliance”, “to provide advice where requested as regards the data protection impact assessment”, and “to act as the contact point for the Commissioner on issues relating to processing”.

Article 38(3): “The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks.” … “The data protection officer shall directly report to the highest management level of the controller or the processor.”

Those last two clauses are the ones that matter, and the ones most often overlooked. A DPO who reports to the person whose decisions they are meant to scrutinise is not independent in the sense Article 38 means. Article 38(6) is often described as barring the DPO from holding other roles. It does not: it says the DPO “may fulfil other tasks and duties”, and puts the duty on the controller or processor to “ensure that any such tasks and duties do not result in a conflict of interests”. The distinction matters, because it is the organisation's job to prevent the conflict, not the DPO's job to avoid the role. In practice the conflict is hard to avoid where the post-holder also decides how personal data is processed — which is why the head of IT, HR or operations is usually the wrong person to hold it.

One more that gets forgotten: Article 37(7) requires the controller or processor to “publish the contact details of the data protection officer and communicate them to the Commissioner”. If the appointment is not recorded in the documents that name role holders, that duty has not been met however real the appointment is.

12 · Accountability — proving it

Article 30(1): “Each controller … shall maintain a record of processing activities under its responsibility.”

The record of processing activities is the document everything else hangs off — privacy notices are built from it, retention schedules are built from it, and a regulator will ask for it first. It is only accurate if teams say when their processing changes, which makes it everyone's job rather than one person's.

Article 30(5) limits the duty for organisations with fewer than 250 staff, but the exemption is narrower than it sounds: it falls away where the processing is likely to result in a risk to individuals, is not occasional, or involves special category or criminal offence data — which covers most of what a small organisation handling case records actually does. In practice the sensible position for anyone in that position is to keep the record anyway.

The clause people forget to put in the contract

Where you engage a processor, Article 28(3) requires a written contract containing specified terms — subject matter and duration, nature and purpose, type of data and categories of individual, and the processor's obligations on instructions, confidentiality, security, sub-processors, assisting with rights requests and breaches, deletion or return at the end, and audit. A general services agreement that never mentions these does not satisfy Article 28, however commercially thorough it is.

The criminal offence worth knowing about

DPA 2018, s.170(1): “It is an offence for a person knowingly or recklessly— (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the disclosure of personal data to another person without the consent of the controller, or (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained”.

In plain terms: looking through records you have no business in, or taking data with you when you leave, can be a personal criminal offence — prosecuted against the individual, not the employer, and not merely a disciplinary matter.

13 · What the Data (Use and Access) Act 2025 changed

UK data protection law was amended by the Data (Use and Access) Act 2025, commenced in stages. The principles, lawful bases and rights above all still stand. The substantive changes for controllers are all in force — the data protection provisions commenced by 5 February 2026 and the new complaints duty on 19 June 2026; the changes worth knowing:

14 · Quotes to paste into an email

Short and self-contained, for when someone needs the actual wording rather than a paraphrase.

Last reviewed 24 August 2026. Quotations are from the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Law moves and this page does not update itself, so check the current position before relying on it. A working reference, not legal advice — for a decision that matters, read the provision itself and take proper advice.

Direct marketing in the UK sits at the junction of two regimes. PECR — the Privacy and Electronic Communications Regulations 2003 — governs the communication; UK GDPR governs the data. PECR is the stricter of the two, and the mistake that costs organisations money is assuming a UK GDPR argument will carry the day when PECR applies.

The core rule: electronic direct marketing to an individual — email, SMS, automated call, fax — needs prior consent. Pre-ticked boxes do not give it, bundled consent does not give it, and “we have a legitimate interest” is not an answer to a PECR question.

The exception that changes everything for B2B: the PECR rule on marketing by electronic mail does not apply to corporate subscribers. You can send marketing email or SMS to a company, a limited liability partnership, a Scottish partnership or some government bodies without PECR consent. UK GDPR still applies to any individual named in the message, the sender must still be identified, and an opt-out must still work — but the consent requirement itself does not bite. Sole traders and ordinary partnerships are individual subscribers, so they do get the full protection.

1 · The words that matter

2 · Is it marketing? The quick test

The awkward middle: a message that is mostly transactional with a promotional paragraph bolted on is a marketing message. Splitting them is safer than hoping the balance of the text saves you.

3 · Soft opt-in is narrower than people think

Five conditions must all hold, and the whole exception falls away if any one fails:

1. You obtained the details yourself, directly from the person. This is the one most often missed. If another organisation collected them for you — including another company in your own group — the soft opt-in does not apply.
2. You obtained them in the course of a sale or negotiations for a sale. Nothing has to have been bought: the ICO's test is that the person actively expressed an interest in buying. An enquiry can qualify; a name captured at an event or from a referral does not.
3. You are marketing your own similar products or services — not a partner's, not a sister organisation's.
4. The individual was given a simple opt-out at the point of collection.
5. An opt-out is offered in every subsequent message.

• “Similar” means similar. A genuinely different offering, a new line, or a service with a different purpose and eligibility is not similar just because you provide both.
• It has never applied to cold contacts who never expressed an interest in buying, and never to a bought-in list — for email exactly as much as for SMS.
• It covers electronic mail. It does not cover live calls, which have their own regime built around the Telephone Preference Service.
• There is no expiry written into it. Whether an old relationship still supports a message is judged on what the person would reasonably expect, not on a fixed cut-off — but the further back the sale, the harder that is to argue.

The charitable purpose soft opt-in — new, and easy to get wrong

The Data (Use and Access) Act 2025 inserted a second soft opt-in at regulation 22(3A), in force 5 February 2026, letting charities send electronic mail whose sole purpose is to further one or more of the charity’s charitable purposes, to people who previously expressed an interest in or offered support to those purposes, subject to conditions mirroring the ones above. Two traps sit around it:

• It is not retrospective. It can only be used where the contact details were obtained on or after 5 February 2026. An existing supporter list collected before that date is outside it.
• The ordinary products-and-services soft opt-in must not be used for campaigning or fundraising, even to existing supporters. Charities that assumed otherwise were non-compliant before this change and still are, outside the new route.

4 · Consent does not transfer

This is the principle that causes the most trouble in organisations that run more than one service. The ICO's test is that consent must be specific to the purposes it was given for, and that you must name any other controller who will rely on it. In practice that means consent given for one service will not usually stretch to marketing a different one — though the unit that matters is the purpose, not the org chart, and the ICO does not demand separate consent for activities that are clearly interdependent. Read the wording you actually used before deciding.

That holds even where the services are run by the same organisation and share a system, and it holds across a corporate group: a separate company is a separate controller, and “we are all part of the same group” is not a consent.

Signposting is not marketing — but the line is real

Mentioning another service in a review meeting, because it is relevant to the person in front of you and your service includes onward referral, is a conversation — and PECR's electronic mail rules do not reach a conversation at all. Emailing everyone who finished last month about that service is marketing.

Two corrections to the way this is usually explained, because the intuitive version is wrong on both counts. Content is decisive. The ICO's position is that if a routine service communication has marketing elements in it, then it is direct marketing — you cannot immunise a promotional paragraph by attaching it to a billing message. And solicited does not mean “not marketing”. A reply someone asked for is solicited marketing: still direct marketing, so it still needs a lawful basis and still engages the absolute right to object under Article 21(2). What being solicited does is take it outside regulation 22, which bites only on unsolicited communications. Those are different things, and treating them as the same is how the objection right gets missed.

What a defensible audit trail looks like

• The original consent: what was agreed, the exact wording shown, the timestamp, and the method.
• Any cross-service consent recorded separately, with its own affirmative action and timestamp.
• A note of the reason a recommendation was made, in the record for that individual.
• Withdrawals recorded with the same care, and acted on immediately.

5 · Channel by channel

6 · The traps

1. Soft opt-in is narrower than you think. Existing customers, similar products, opt-out every time. Miss any element and it does not apply.
2. Interest in one thing is not consent for another. Consent to receive a service is not consent to be marketed about anything else.
3. PECR beats UK GDPR on consent. Even where legitimate interests would support marketing under UK GDPR, PECR's rules for electronic channels are stricter and they govern.
4. Pre-ticked boxes are invalid. Consent needs a clear affirmative action, and a separate one — not bundled into accepting terms.
5. Withdrawal must be acted on without undue delay. The ICO sets no number, but a batch job that runs monthly is not a defence, and a message sent after someone opted out is a breach whatever the internal process says. Do not confuse this with the 28-day grace regulation 21(3) gives a caller after a number joins the TPS or CTPS — a different clock entirely.
6. Liability follows the instigator, not only the sender. If you commission an agency to run a campaign, you instigated it, and the ICO has fined organisations on that basis.
7. Consent does not cascade across services or group companies.
8. Do not treat a closed file as a mailing list. Consent has no fixed expiry, but it should be refreshed at sensible intervals, and the further back the relationship the harder it is to argue the person still expects to hear from you.
9. Buying or renting a list rarely works. The consent must have named you specifically; generic “trusted third parties” consent will not do.
10. Every message must identify you and give a working opt-out. Sending from an unmonitored address with no unsubscribe route is a breach on its own.

Since 5 February 2026 the maximum PECR penalty has matched UK GDPR levels — up to £17.5 million or 4% of global turnover, whichever is higher, replacing the previous £500,000 cap. Getting marketing consent wrong stopped being a cheap mistake.

7 · A consent wording that works

The shape matters more than the words. Separate boxes, none pre-ticked, each naming what it covers and who will be contacting them.

Why this shape works

• Separate consent per service, so the audit trail is per service too.
• Someone can opt into one and not another — which is what “specific” means.
• Nothing is pre-ticked and nothing is bundled with accepting the service itself.
• It names any third party rather than saying “selected partners”.
• It makes clear that refusing has no consequence, which is what makes the consent freely given.

The other half of PECR

PECR is not only about marketing messages. Regulation 6 governs storing information on, or reading it from, someone's device — cookies, but also local storage, device fingerprinting and the tracking pixels embedded in marketing email. The Data (Use and Access) Act 2025 restructured it from 5 February 2026: storing or accessing information is prohibited unless one of the cases in a new Schedule A1 to PECR applies — consent, the long-standing transmission and strictly-necessary exemptions now moved into the Schedule, and a handful of new low-risk exceptions. Analytics is the case most often got wrong. It has never been strictly necessary; the new statistical-purposes exception does let first-party analytics run without consent, but only for improving the service, only if the data is not shared with anyone except someone helping you make those improvements, only with clear information, and only with a free and simple way to object — conditions, not a free-for-all. A guide that stops at email is only half a PECR guide.

8 · Where the rules live

• PECR 2003 — regulation 6 covers cookies and device access; regulations 19 to 24 cover automated calls, live calls, fax and electronic mail. Regulation 22 is the electronic mail rule; 22(3) is the products-and-services soft opt-in and 22(3A) the charitable purpose one.
• UK GDPR Articles 6 and 7 — lawful basis, and the conditions for valid consent.
• UK GDPR Article 21(2) — the absolute right to object to direct marketing. There is no balancing test: once they object, you stop.
• Data Protection Act 2018 — including the enforcement machinery PECR borrows.
• Data (Use and Access) Act 2025 — raised the PECR penalty ceiling, added the charitable purpose soft opt-in and restructured the cookie rules, all from 5 February 2026.
• ICO direct marketing guidance — linked in the Marketing and electronic communications section above.

Last reviewed 24 August 2026, against PECR as amended from 5 February 2026. Law moves and this page does not update itself, so check the current position before relying on it. A working reference, not legal advice: where a decision carries real consequence, read the regulation and take proper advice.

Commands for backup, repair, disk checks, network tests and file listing — each with an explanation of what it does and, where it matters, what it will destroy if you get it wrong. Paths are shown as placeholders: replace anything in angle brackets before running. Type below to filter.

Run an elevated prompt where noted. Treat /MIR, /MOVE, /PURGE, cipher /w, chkdsk /f and anything with -Force as capable of losing data. Check the source and destination before you press enter, and quote any path containing a space.

The commands

Switches worth memorising

Removing worksheet protection from a spreadsheet by editing the underlying XML is sometimes described as a fix. It is left out here deliberately: it is a technique for defeating a control, it only works on sheet protection rather than real encryption, and on a file you did not create it is the wrong thing to be doing. If you own the file and have lost the password, the honest route is your own backup or whoever set it.