Rules and ethics
Lead network compliance from the correct geographic layer to bought lists
Lead generation network rules for UK data, marketing, advertising, consumer journeys, contracts, disclosure and qualified review in England.
What to take away
- UK GDPR, the Data Protection Act 2018 and PECR apply across the UK, so England starts from one data framework.
- Contract law and court routes are not UK-wide. Name England and Wales law and the chosen forum.
- Roles follow activity, not contract labels. A processor that sets its own purposes becomes a controller for that work.
- PECR conditions and UK GDPR lawful bases are separate tests for the same email or call.
- A bought list stays unresolveda seller warranty allocates loss but creates no permission.
The launch gate before a live lead
Run these five steps and keep the evidence for each.
- Write the consumer's requested outcome in their own words.
- List every organisation that may contact them, and by which channel.
- Classify the subscriber as individual or corporate, and each data item as personal or not.
- Set a UK GDPR lawful basis and a separate PECR condition for each channel.
- Test suppression, objection and complaint routes with a live internal request.
A record per event beats a single consent tick. The lead network data protection route shows how that record is built from real collection and disclosure events.
Regulators and rules, mapped to tasks
| Authority or rule | Covers | Task it creates |
|---|---|---|
| ICO: UK GDPR, DPA 2018, PECR | Lawful basis, transparency, electronic marketing, cookies | Record purpose, basis, channel condition and retention per row |
| CMA: DMCC Act 2024 consumer regime | Misleading actions, omissions, aggressive conduct, commercial intent | Audit advert, form, results page and complaint route as one journey |
| ASA: CAP Code Section 3 | Non-broadcast claims and qualifications | Hold documentary evidence before publishing "verified", "local" or "best" |
The CAP Code is self-regulatory, not an Act of Parliament. Legislation, regulator guidance and code rules are different kinds of authority. The Data (Use and Access) Act 2025 amended UK GDPR, the DPA 2018 and PECR, with most Part 5 changes from 5 February 2026 and controller complaints provisions from 19 June 2026.
Example: consent and disclosure wording
"We will pass your details to Acme Claims Ltd and up to four other named companies, who may contact you by email and telephone about payment protection claims. You can withdraw consent at any time."
Use the actual buyer name where the chosen basis needs it. "Selected partners" does not explain who receives the record or what follows. A category works only if it is specific enough for the intended use. A qualified reviewer decides what identification this journey requires.
Role assessment and data flow in one table
| Event | Actor | Who decides | Likely role |
|---|---|---|---|
| Form design and buyer allocation | Network | Network | Controller |
| Hosting and security | Platform | Network | Processor |
| Onward sale for another's marketing | Network or buyer | Buyer | Independent controller |
| Product analytics on lead data | Platform | Platform | Controller |
The ICO's controller and processor guidance warns that a processor acting beyond instructions becomes a controller for that processing. A contract label records intention rather than the test.
Bought lists and the soft opt-in limit
The ICO's guidance on data-broker services calls for due diligence before use and warns that a seller's assurance is insufficient. Ask for the source, collection wording, timestamp, named organisations, channels covered, withdrawal history, suppression process and transformation record. Test a sample without contacting the people.
For individual subscribers, bought-in details cannot use the soft opt-in, because the sender did not collect them during its own sale. The vendor due diligence checks that inspect records apply the same test to each supplier.
Business contact is not automatically corporate. The ICO treats limited companies differently from sole traders and some partnerships for electronic mail. UK GDPR may still cover a named employee's details.
The consumer journey and its claims gate
The CMA's unfair commercial practices guidance covers misleading actions, misleading omissions, aggressive conduct and failure to identify commercial intent. The consumer regime under the DMCC Act 2024 began on 6 April 2025. Whether a presentation breaches it needs qualified legal assessment.
CAP Code Section 3 requires documentary support for objective claims before publication. "Local", "verified" and performance language each need a written claim definition, an evidence owner, the geography applied and an expiry date.
Contracts, objections and complaints
A buyer agreement should define the lead event, permitted purpose, rejection proof, price basis, payment, service level, complaint handling, audit, security, incident notice, retention, exit and liability. Those clauses make performance auditable, but cannot validate an unlawful source or override an objection. The contract records that define a lead and its exit list the five documents to keep.
The ICO says a direct-marketing objection must be respected, and a minimal suppression record prevents later reintroduction. Since 19 June 2026, controller complaints duties apply, with acknowledgement expected within 30 days.
Common questions
Which regulator covers a lead generation network?
Several. The ICO covers data protection and electronic marketing, the CMA covers unfair commercial practices, and the ASA covers non-broadcast claims under the CAP Code.
Can a UK network email a bought list?
Not for individual subscribers using the soft opt-in, because the sender did not collect those details during its own sale. A bought file needs provenance that supports the specific activity, and the buyer remains responsible for its use.
Who is the controller when leads are shared?
It depends on activity. A network may control form design and buyer allocation, while a buyer deciding its own marketing purposes is an independent controller.
In this guide
- UK regulations for a lead network, with the DUAA dates entered twiceMap current UK lead generation network regulations for an England service, including data, PECR, consumer, advertising, contracts and DUAA dates.
- Testing a lead network advert for identity, impression and substantiationCheck lead generation network adverts for clear identity, commercial intent, material limits, substantiation, comparisons and suppression controls.
- Lead network data protection drawn from the real route, not the labelsBuild lead generation network data protection around factual roles, separate purposes, transparent sharing, source checks, suppression and complaints.
- Five contract records that define a lead, its data and its exitReview five lead generation network contract records covering the lead unit, data roles, claims, consumer terms, collaboration and exit controls.
- A lead network disclosure policy built around each moment of hand-offBuild a lead generation network disclosure policy around the real journey, named recipients, direct marketing, timing, objections and change control.
