How the ICO and UK GDPR shape expert outreach campaigns

What to take away

Why UK GDPR sits at the centre of expert outreach

Expert outreach means processing personal data. You hold a name, a work email, a job title, sometimes a public profile. That is personal data under UK GDPR, and the ICO expects you to treat it that way.

Once a creator can be identified, their email address, rate card and audience figures count as personal data. Creator records need a retention and deletion limit.

Many UK teams assume business contacts sit outside data protection law. They do not. UK GDPR applies to personal data whether the person works for a company or runs one. The ICO's UK GDPR guidance and resources set out the principles you must follow when processing that data for marketing.

The practical consequence is that your outreach list is a data asset with rules attached. You need a reason to hold it, a reason to use it, a retention period, and a way for people to object. None of that is optional because the contact is at a limited company.

Outreach also touches the wider compliance picture. This is why data protection starts with lawful outreach, not with the email copy.

Choosing a lawful basis for B2B influencer marketing contact lists

There are six lawful bases under UK GDPR: consent, contract, legal obligation, vital interests, public task and legitimate interests. For B2B influencer marketing, only two are realistic for cold outreach: consent and legitimate interests.

Consent is the safest but the slowest. You need a positive opt-in, recorded, with the right to withdraw. For a list of 500 creators built from public sources, consent rates are low and the record keeping is heavy.

Legitimate interests is the basis most UK agencies use for corporate subscribers. It lets you contact a named professional where you have a genuine business reason and the person would not be surprised.

The ICO's guidance on Sending direct marketing: Choosing your lawful basis explains that legitimate interests is not a free pass: you must balance your interest against the individual's rights.

Contract is rarely available for cold outreach. You cannot claim a contract basis when no contract exists yet. Legal obligation and public task do not fit marketing at all.

Pick one basis per list and stick to it. Switching basis halfway through a campaign is a red flag in any ICO enquiry.

Legitimate interests assessments you can defend to the ICO

The legitimate interests assessment, or LIA, is the document that decides whether your outreach is lawful. It has three parts, and the ICO expects all three.

A defensible LIA is short and specific. It names the data categories, the source, the retention period and the opt-out mechanism. It records the date and the person who signed it off.

Use a worked example. A Manchester agency wants to contact 200 procurement directors for a supply chain podcast. The interest is content production. Necessity holds because the podcast needs named practitioners.

The balancing test notes that the directors are contacted at work about a work topic, the email is relevant, and every message carries a one-click opt-out. The LIA records that reasoning in a page.

What sinks an LIA is vagueness. "Business growth" is not a legitimate interest. "Sourcing speakers for a paid client campaign" is. Keep the language operational.

PECR and the ICO direct marketing guidance for B2B email

PECR sits alongside UK GDPR and governs electronic mail. Its rules differ by recipient type, which is where most UK teams slip up.

Corporate subscribers, meaning limited companies and LLPs, can receive B2B email marketing under legitimate interests, provided UK GDPR is satisfied. Sole traders and non-limited partnerships are treated as individuals. For them you need consent or the soft opt-in.

The soft opt-in applies where you obtained the contact details in the course of a sale or negotiations, you are marketing similar products, and you offered an opt-out at collection and in every message. Cold lists rarely qualify.

The ICO's Business-to-business marketing | ICO page is the one to read before you send. It explains the corporate subscriber distinction and what counts as electronic mail, including direct messages on some platforms.

The ICO's Guide to Privacy and Electronic Communications Regulations | ICO covers the consent standard and the cookie rules that apply when your outreach landing page drops tracking pixels. If your campaign uses a tracking link, PECR applies to that too.

One more point: the rules on how you present your campaign sit alongside data protection. The UK regulations mean for brand teams that disclosure and data handling are checked together, not separately.

Named ICO enforcement notices and what they changed

The ICO enforces through fines, reprimands and enforcement notices. The named cases matter because they show how the regulator reads the rules in practice.

In 2023 the ICO fined HelloFresh for sending millions of marketing messages without valid consent. The case turned on consent quality, not list size. It confirmed that a soft opt-in claim fails when the original collection lacked a clear opt-out.

In 2022 the ICO fined Clearview AI for unlawful processing of facial images, a reminder that scraping personal data for commercial use is not a lawful basis.

In 2020 the ICO fined Experian for using offline data for direct marketing without telling people. The case is directly relevant to anyone buying a broker list: the ICO looked at how the data was sourced and whether individuals were informed.

Earlier, the ICO fined Honda and Flybe over marketing emails sent without valid consent. Those notices established that the sender, not the agency, carries the liability.

Read every notice as a checklist item. Consent quality, data sourcing, transparency and opt-out handling are the four themes that repeat.

Data broker and list purchase risks in creator sourcing

Buying a creator or expert list from a data broker is the highest-risk move in B2B influencer marketing. The ICO has repeatedly treated bought lists as evidence of poor practice.

The core problem is provenance. A broker rarely shows you the original collection point, the privacy notice shown at the time, or the consent wording. Without that, you cannot run a meaningful LIA, and you cannot show transparency.

The Experian case shows the regulator's focus: was the individual told their data would be used for marketing, and by whom? If the answer is no, the list is not safe to use, whatever the broker's contract says.

There are safer alternatives. Build lists from public professional sources where the person has a reasonable expectation of being contacted about their work. Use platform search, company websites and event speaker lists. Record the source for every contact.

If you inherit a list from a client, audit it before use. Ask for the collection point, the privacy notice and the opt-out record. If those do not exist, treat the list as unusable.

Rehearse that failure with risk scenarios before the campaign starts. A list that collapses in week one costs less than one that collapses after three months of outreach.

The same logic applies to creator sourcing. A creator's business details can be verified through Companies House, and that check is good practice, but it does not replace a lawful basis for contacting them.

AI tools, profiling and ICO expectations for outreach

AI tools are now common in outreach: scoring leads, drafting emails, enriching profiles. Each use is processing personal data and needs a lawful basis.

The ICO's Artificial intelligence | ICO guidance sets out expectations on transparency, fairness and accountability. If you use AI to score or rank individuals, you are profiling. Profiling requires you to tell people it is happening and to explain the logic in plain terms.

Solely automated decisions with a legal or similarly significant effect need extra safeguards, including human review. Most outreach scoring does not reach that threshold, but you should document why.

Enrichment is the riskiest AI use. Inferring an email address or a personal interest from other data creates new personal data. If the inference is wrong, you are contacting someone on a false premise and you have no source to point to.

The practical rule: keep AI in the drafting and prioritisation layer, not in the data sourcing layer. Never let a tool invent contact details for a named expert.

Your privacy notice must mention AI-assisted processing if it affects individuals. The ICO expects the notice to be specific, not a generic paragraph.

Building a UK GDPR compliant outreach workflow

A repeatable workflow keeps you out of trouble. Build it once and run every campaign through it.

Run the workflow in order and you have a defensible position if a complaint arrives. Skip the first two steps and everything after is decoration.

Your outreach copy also carries compliance weight. The UK rules and compliance guide covers how campaigns must be presented on paid posts.

When a creator is paid, the disclosure policy explained for UK teams sets out what to say and where. Data protection and disclosure are checked by different regulators but they meet in the same campaign.

Plan for failure, too. Rehearse what happens when a contact complains or a creator posts without a disclosure. Teams that rehearse handle an ICO enquiry calmly.

Finally, keep the paperwork live. An LIA written two years ago for a different campaign will not defend today's outreach. Review it when the list, the message or the tooling changes.

Platform rules, company disclosure and UK-wide duties

Advertising policies from platforms sit on top of data protection law. A policy breach can halt a paid campaign, so run policy checks before a campaign starts. Check the specific ad product and its labelling rules before a creator posts.

Company information behind a paid creator partnership is still governed by the Companies Act 2006, which received Royal Assent on 8 November 2006. That Act covers company disclosure and named partnerships. Ask finance before naming a client in paid work.

Data protection and PECR duties apply across the United Kingdom. The England position matches Scotland, Wales and Northern Ireland, so the rules apply UK-wide.

Common questions