Cardiff lead generation: Welsh-language ads and UK GDPR

What to take away

Welsh-language advertising requirements for Cardiff lead networks

Cardiff is the Welsh capital and its consumer market includes first-language Welsh speakers, learners and English-only households. The Office for National Statistics 2021 Census found that Cardiff was one of the few local authorities where the percentage able to speak Welsh did not fall between 2011 and 2021. The share remains around 6% of residents aged three and over.

A lead network running paid social or search ads into Cardiff cannot assume English is the default. The named UK marketplaces many buyers compare, including Bark, MyBuilder and Rated People, are national platforms rather than Cardiff-only networks. No named marketplace should be assumed to offer a Welsh-language form; test the live route before buying.

The Welsh Government treats the Welsh language as a live policy area, not a heritage label. Public bodies receive compliance notices from the Welsh Language Commissioner under the Welsh Language (Wales) Measure 2011. The standards cover service delivery, policy making, operational matters and record keeping, including correspondence, telephone calls, websites and public notices.

Welsh-language advertising means more than swapping headlines. The ad copy, landing page, form labels, privacy notice and confirmation email all need to work in Welsh. If a Cardiff lead network promises a Welsh-language route and delivers an English form, the mismatch can breach the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing, known as the CAP Code.

The CAP Code requires ads to be legal, decent, honest and truthful. It also treats misleading omissions as a breach. The Advertising Standards Authority enforces the CAP Code, so an English-only form behind a Welsh ad can be a misleading omission if it stops the reader completing the promised route.

For lead generators, the practical test is whether a Welsh-speaking consumer can complete the whole process without switching language. That includes the consent tick box, the privacy information and the point where the lead is sold or passed to a client. Cardiff also has a growing professional services market, so B2B lead ads may target Welsh-speaking business owners.

UK GDPR compliance when ads and forms run in Welsh

UK GDPR does not have a separate Welsh-language regime. Article 5 requires fair, lawful and transparent processing, and Article 12 requires information in a clear and plain language the person can understand. Article 13 lists the information a lead form must give when data is collected directly, including purposes, lawful basis, recipients and retention.

Name the lawful basis for each lead. Article 6(1) allows consent, contract, legal obligation, vital interests, public task or legitimate interests. Most lead networks rely on consent under Article 6(1)(a) or legitimate interests under Article 6(1)(f). Contract under Article 6(1)(b) fits only where the person is buying the network's own service.

Article 7 sets the conditions for consent: it must be freely given, specific, informed and unambiguous. The ICO consent guidance applies to every lead form, whatever language it is written in. A Welsh consent line should say, in Welsh, that the person agrees to be contacted by the network and its partners. A first-language Welsh speaker should review that wording before launch.

When a Cardiff lead network runs bilingual ads, each language version is a separate point of collection. Record the lawful basis for the lead and the language the person saw. Mixing languages at the point of consent weakens the evidence that the person understood what they agreed to.

PECR sits alongside UK GDPR for electronic marketing. A Cardiff lead network sending follow-up texts or emails in Welsh still needs the right consent or soft opt-in. This is where a lead network's advertising rules matter. An advert that looks compliant in English can fail in Welsh if the qualification text is missing or the brand identity is unclear.

Welsh Government digital and Welsh language policy context

Welsh Government digital policy affects Cardiff lead networks mainly through public sector contracts. Public bodies in Wales must offer Welsh-language digital services, and that duty flows into procurement and partnership work. If a network runs a campaign for Cardiff Council, Cardiff and Vale University Health Board or a Welsh Government-funded programme, the compliance notice can pass standards down the contract.

Public sector lead generation in Cardiff is common: housing, skills, health and transport campaigns all run in the city. A network that can show a bilingual route is better placed to win that work. The same discipline applies to lead network data protection: show where the data came from and what it was collected for.

A Cardiff lead network handling public sector leads should keep a campaign record that names the public body, the contract, the Welsh-language requirement and the data-sharing basis. That record makes a later audit or subject access request much easier to answer.

Consent records when a lead is captured bilingually

A bilingual consent record has to answer four questions: what language the person saw, what they were told, what they agreed to, and when. If the record cannot answer those, it is weak evidence. The ICO expects organisations to be able to demonstrate consent, not just claim it.

A worked example makes this concrete. A Cardiff Council housing-repair lead campaign runs a Welsh ad on social media. The ad links to a Welsh form. The person ticks a box agreeing to be contacted by the network and its partners. The record stores the language, consent text version, timestamp, partner list version and IP address.

Six months later the person complains. The network can show exactly what was agreed, in Welsh. That is a defensible record. Contrast that with a network that stores only the lead's name and email. If the person says they never agreed to partner calls, the network has nothing.

The difference is not legal theory. It is the practical gap between a disclosure policy that names partners and one that does not. In practice, a Cardiff lead network should store the language version of the form alongside the lead. That means a language field, a timestamp, the exact consent wording shown and the source URL.

If the wording changes, the old wording should be versioned so the record still reflects what the person saw. Bilingual records also help with withdrawals. If a person withdraws consent in Welsh, the suppression record should note the language and date. That prevents a later campaign from re-adding them because the Welsh withdrawal was not matched to the English lead record.

Data security and breach handling for Cardiff lead databases

Lead databases are attractive targets because they hold names, contact details and sometimes financial or health information. The ICO's data security guide expects appropriate technical and organisational measures proportionate to the risk, plus regular review. Health information also needs an Article 9 condition.

For a Cardiff lead network, a typical baseline is access controls, TLS 1.3 in transit, AES-256 at rest, audit logging and a retention rule that deletes inactive leads after 24 months. Review the rule at least annually.

Most controllers must pay the ICO data protection fee and appear on the ICO register of fee payers unless an exemption applies. Check the ICO's current fee page for the tier that matches the network's size and turnover. The register entry is not a compliance certificate, but buyers often ask for it during due diligence.

Bilingual data does not change the security standard, but it does change the search problem. If a person asks for their data in Welsh, the network needs to find records that may be labelled in Welsh or English. A language field in the database makes subject access requests faster and less error-prone.

Breach handling follows the same route. A personal data breach that risks people's rights must be reported to the ICO within 72 hours where required under Article 33. The ICO's breach reporting guide explains the threshold and the information needed. A Cardiff lead network should have a breach playbook that covers Welsh-language communications, because affected people may need the notice in Welsh.

Smaller networks often rely on bought lists or partner data. Those sources carry extra risk: the network may not know how consent was collected or in what language. If a bought list contains Welsh-speaking consumers, check whether the original consent covered the new use. If it did not, the lead is not safe to contact.

A Cardiff lead generation compliance checklist

Use this checklist before a Welsh-language campaign goes live in Cardiff. Each step should leave a record.

For networks weighing consent against legitimate interest, what UK law says on bought leads is worth settling before the campaign brief is signed off. The choice affects what the Welsh form must say and which Article 13 information must appear.

Finally, keep a simple evidence pack per campaign: the Welsh ad, the Welsh form, the consent wording, the partner list and the language field sample. If the ICO or the Welsh Language Commissioner asks, the pack answers the question without a rebuild.

Common questions