| Requirement | What it means for Viewee | Owner (Instinct / Alex+Cain / External assessor) | Effort | Status | Evidence needed | Source URL |
|---|
| Cookie and similar-technology consent | Marketing site and SaaS must not set/read non-essential cookies or pixels before valid consent. Strictly necessary technologies may be exempt; explain them clearly. | Alex+Cain | M | Before site/app tracking goes live | Cookie inventory, consent-platform configuration, scan and cookie notice | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ |
| Valid consent standard | Where consent is required it must meet UK GDPR: freely given, specific, informed, unambiguous, affirmative, easy to withdraw and evidenced. Reject-all should be as easy as accept-all. | Alex+Cain | M | Before tracking | Consent records, banner screenshots and withdrawal test | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ |
| Email/text marketing to individuals | Do not send unsolicited electronic marketing to individual subscribers without consent unless the soft opt-in conditions all apply. Corporate subscribers can be contacted, but UK GDPR still applies to named business contacts. | Alex+Cain | H | Before outreach starts | Audience classification, consent/soft-opt-in evidence and lawful-basis/LIA records | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/ |
| Identity and unsubscribe in every marketing message | Do not conceal sender identity; provide a valid contact address and a simple way to opt out in each message. Honour objections/suppressions promptly. | Alex+Cain | M | Before outreach starts | Message templates, unsubscribe test, suppression list and audit log | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/ |
| Screen telephone marketing | For live marketing calls, screen against TPS/CTPS and Viewee suppression lists; identify Viewee and provide contact details. Automated calls need consent. | Alex+Cain | M | If calling begins | TPS/CTPS screening logs, calling script and suppression process | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/ |
| Bought/scraped lists require due diligence | Do not assume a vendor or public website makes contact lawful. Verify consent provenance where needed, purpose compatibility, transparency, accuracy, suppression and contract controls. | Alex+Cain | H | Before list use | Supplier due diligence, sample records, notices, LIA/consent proof and suppression checks | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/ |
| Maintain suppression rather than deleting objections | Keep a minimal suppression record so people who opted out are not re-added; restrict its use to suppression. | Alex+Cain | L | Before outreach starts | Suppression policy, access controls and test | https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/ |
