Rules and ethics
Part of Small business CRM rules and ethics: a review framework
Small business CRM disclosure policy: owners by type
A small business CRM disclosure policy should assign an owner, trigger, placement and evidence to each disclosure in the business's CRM workflow.
A small business CRM disclosure policy should tell staff which disclosure belongs at which point in a relationship journey. It should not compress privacy information, advertising labels, commercial qualifications and review incentives into one footer.
For a business operating in England, use this as an operational template, not legal advice. Assign a role to each disclosure and have the appropriate data-protection, advertising, consumer, accessibility or sector specialist review requirements where relevant.
What to take away
- A CRM disclosure policy should assign each disclosure type to a specific point in the relationship journey.
- Create a disclosure register with one row per disclosure type, recording trigger, owner, source and placement.
- Privacy information must be placed at collection and reuse points, with version linked to the CRM record.
- Promotional identity and material connections must be visible, with qualifications linked to evidence.
- Test disclosures in the final channel and withdraw them if they fail to render or evidence expires.
Build a disclosure register
Create one row for every disclosure type:
| Field | What to record |
|---|
Disclosure register fields
- Triggercollection, message, advert, review, offer
- Audience and geographywho and where
- Owneraccountable for accuracy and placement
- Sourcelaw, regulator, code, contract, version
- Placementscreen, field, subject line, script
- Proofapproved copy, screenshot, message version
- Expiry and triggerreview date plus changes
Use one row per disclosure type. Assign each owner role to a person in the business; one person may hold more than one role, but each row should have one accountable owner.
| Disclosure type | Trigger and audience | Accountable owner | Placement in the CRM journey | Source, evidence and review |
|---|---|---|---|---|
| Privacy information | Collecting personal data directly, receiving it from another source, or reusing it for a new purpose | Data-protection lead, or business owner | Collection form, import workflow or relevant reuse message | Approved notice and notice version linked to the CRM event; review when the source, purpose or notice changes |
| Promotional identity | Sending a marketing communication to a contact | Marketing owner | Make the sender and promotional nature clear where the recipient first sees the message | Approved campaign creative and a check of the rendered message; review when the sender, channel or campaign changes |
| Material connection | Requesting or publishing a review, testimonial or affiliate content where an incentive or other connection exists | Partnerships or marketing owner | Beside the review request or affected content, as appropriate | Record the content, incentive and publication decision; review when the incentive or content changes |
| Claim qualification | Using an objective claim that needs a limitation, such as eligibility or availability | Campaign or offer owner | Beside the claim in the CRM message or linked campaign page | Link the exact claim and creative to supporting evidence and its expiry; review when the claim or evidence changes |
| Privacy complaint route | Providing privacy information or handling a privacy complaint | Data-protection lead, or business owner | Privacy notice and the relevant CRM support or complaint workflow | Record the approved route and review it when the process or requirements change |
Use separate rows even when disclosures appear on the same page. Their purpose and reviewer can differ.
In the CRM software, keep separate fields for the notice version and collection event, data source, campaign label, incentive status, and claim and evidence reference. Map the relevant fields into message templates or workflows, then check the final message to confirm each disclosure appears in the intended place.
Place privacy information at collection and reuse points
The ICO's Guide to Data Protection, in its “The right to be informed” section, distinguishes information required when personal data is collected from the person and when it comes from another source. Map the actual fields, purpose, lawful basis, recipients, retention, rights and complaint route. Keep the notice version connected to the CRM record or collection event.
Illustrative operational label: "Privacy notice version [ID] shown at [event and time]." That sentence is an audit pointer, not proof that the notice is complete or the processing lawful.
The ICO's overview of the Data (Use and Access) Act 2025 states that the Act added organisational requirements around data-protection complaints, including helping people complain. The policy should name the complaint route and owner; have a specialist confirm the current requirements and timing.
Make promotional identity and interests visible
CAP Code Section 2 requires marketing communications to be obviously identifiable and deals with commercial intent and advertorials. A CRM merge field naming the sender does not necessarily make an advert recognisable. Record the first point at which the audience sees the message and the approved label there.
Illustrative label: "Advertisement from [legal marketer]." The correct wording and prominence depend on the medium and context. It cannot rescue an otherwise misleading communication.
For reviews, testimonials, affiliate relationships or incentivised content, disclose the material connection beside the affected content. For example, if a CRM workflow asks a customer to leave a review after offering an incentive, record the incentive and make the connection clear in the relevant request and wherever the resulting content is used. The CMA's reviews and endorsements collection reflects the post-April 2025 consumer-law position and provides separate guidance for brands, creators and review publishers. Preserve who supplied the content, whether an incentive existed, the original wording and the decision to publish.
Link qualifications to evidence
CAP Code Section 3 requires evidence for objective claims and says qualifications must be clear and must not contradict the claim they qualify. The register should therefore link every limitation to the exact claim, creative version and evidence expiry.
Do not store "terms apply" as a universal approved phrase. Record which eligibility, price, period, quantity, renewal or availability fact must be disclosed and where a reader encounters it. Consumer and sector reviewers decide materiality.
Version, test and withdraw
Test each disclosure in the final channel at normal reading scale and with relevant assistive technology. Check that personalisation, mobile layout, forwarding and translation do not remove or separate it from the claim. Accessibility approval remains independent from the legal accuracy of the words.
Publish only with owner, evidence link, approval date, expiry, then review afresh after new purpose, data source, audience, incentive or claim. Review afresh after new offer, channel, supplier or regulator update.
If the disclosure fails to render or evidence expires, stop the affected collection or communication and preserve the incident record. A policy controls decisions but never guarantees compliance alone.
Before you act
- Build a disclosure register with one row per disclosure type.
- Assign each row to an accountable role, such as the data-protection lead, marketing owner, partnerships owner or campaign/offer owner.
- Place privacy information at collection and reuse points.
- Make promotional identity and material connections visible.
- Link qualifications to exact claims and evidence.
- Test disclosures in the final channel and withdraw if they fail.
Common questions
What should a disclosure register contain?
The register should have one row for every disclosure type, recording trigger, audience and geography, owner, source, placement, proof, and expiry and trigger. Use separate rows even when disclosures appear on the same page because their purpose and reviewer can differ.
Where should privacy information be placed?
Privacy information should be placed at collection and reuse points. The ICO guidance distinguishes information required when personal data is collected from the person and when it comes from another source. Keep the notice version connected to the CRM record or collection event.
How should qualifications be handled in a CRM disclosure policy?
Link every limitation to the exact claim, creative version and evidence expiry. Do not store terms apply as a universal approved phrase. Record which eligibility, price, period, quantity, renewal or availability fact must be disclosed and where a reader encounters it.
