Rules and ethics
Part of Lead network compliance from the correct geographic layer to bought lists
UK regulations for a lead network, with the DUAA dates entered twice
Map current UK lead generation network regulations for an England service, including data, PECR, consumer, advertising, contracts and DUAA dates.
Lead generation networks in England face several UK regimes, not a single licence. Start by classifying the act: collecting personal information, disclosing a request, sending marketing, publishing a claim, contracting with a consumer or buyer, or working with competitors. Each classification needs its own reviewer and record.
This is a jurisdiction map, not legal advice or a finding that a proposed service is permitted.
Example: collecting a name and email for a quote is personal-data collection. Sending a follow-up marketing email is a PECR electronic mail act. A free quote claim that hides a paid survey is a consumer-law act.
What to take away
- Lead generation in the UK faces several regimes, not one licence, so classify each act before you start.
- The UK GDPR and DPA 2018 apply across the UK, so England is an operating geography, not a separate regime.
- A UK GDPR lawful basis does not settle the PECR test for electronic mail, calls or device storage.
- Record both DUAA commencement dates in the file5 February 2026 and 19 June 2026.
Data protection covers the UK
The UK GDPR and Data Protection Act 2018 provide the general data-protection framework. The DPA's territorial notes say it extends and applies across the UK, apart from minor exceptions. England is therefore an operating geography here, not a separate English data-protection regime.
Ask who decides each purpose and essential means. The form operator may be a controller for collection, a hosting supplier may process on instructions, and a buyer may become an independent controller for its later use. Those outcomes depend on conduct, not the words "platform" or "partner".
PECR adds rules for contact and devices
PECR sits beside data-protection law. It deals with areas including electronic mail, calls and storage or access technologies. Having a UK GDPR lawful basis does not settle the PECR test.
For electronic mail, the ICO's guidance was updated on 28 April 2026. The new charitable soft opt-in is specific to eligible charitable activity. It is not a commercial-network exception. Buyer identity, subscriber type, message, request and collection route still need review.
DUAA dates need two entries in the file
The Data (Use and Access) Act 2025 amended the DPA, UK GDPR and PECR. According to the government's commencement schedule, most Part 5 privacy and data-protection provisions commenced on 5 February 2026. The controller complaints provisions followed on 19 June 2026.
The ICO now says all DUAA data-protection provisions are in force, but some detailed guidance remains under review. Record the commencement position and the status banner on the exact guidance page. Do not use a pre-commencement summary as if it were current operational text.
Consumer protection is another UK layer
Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 regulates unfair business-to-consumer practices. The Act's explanatory notes say its extent and application cover the UK. An England journey can therefore engage UK legislation while using England and Wales courts or legal advice for a dispute.
The consumer reviewer should inspect the entire journey, including commercial intent, material information, total commitment, service description and complaint route. A privacy notice does not cure a misleading main proposition.
Advertising and contracts have different jobs
The CAP Code is the UK code for non-broadcast advertising, sales promotions and direct marketing communications. Its operator says the online code is updated regularly. Archive the version checked and substantiate objective claims before release.
Contracts can define the lead, payment, rejection, responsibilities, audit and exit. Consumer terms still need fairness and transparency review, while business terms require advice on governing law, liability and enforcement. A clause cannot supply missing PECR permission, remove UK GDPR duties or prevent regulator action.
The decision file
For every activity, enter the UK or England-and-Wales scope, source, operative date, guidance status, responsible party, approver and review trigger. Stop if the journey cannot identify its recipient, permission route, commercial claim or complaint owner. The privacy lead signs the UK GDPR entry, the PECR reviewer signs the email entry, and the consumer-law reviewer signs the journey entry.
Before you act
- Classify each act and assign its own reviewer and record.
- Identify the controller for each purpose and essential means.
- Check PECR separately from the UK GDPR lawful basis.
- Record the DUAA commencement position and guidance status banner.
- Review the whole consumer journey for material information.
- Archive the CAP Code version checked and substantiate objective claims.
Common questions
Does the UK GDPR apply separately in England?
No. The DPA's territorial notes say it extends and applies across the UK, apart from minor exceptions. England is an operating geography, not a separate English data-protection regime, so the same framework covers an England journey.
When did the DUAA data-protection provisions commence?
The main privacy and data-protection changes took effect on 5 February 2026; the controller complaints rules took effect on 19 June 2026. The ICO reports that all DUAA data-protection provisions are in force, with some detailed guidance still under review.
Can a contract clause fix missing PECR permission?
No. A clause cannot supply missing PECR permission, remove UK GDPR duties or prevent regulator action. Contracts can define the lead, payment, rejection, responsibilities, audit and exit, but consumer terms still need fairness and transparency review, and business terms need advice on governing law, liability and enforcement.
