Small business CRM UK regulations for one newsletter

Small business CRM UK regulations matter even for a routine newsletter to existing customers. The CRM should make the contact's marketing status, the audience selection and the release evidence reviewable before the send; it does not establish legality on its own. The question is which gate each part of the send has to pass before it is released.

The case is one row of the wider rules and ethics review. Here it is worked through for a single send, with five gates marked as engaged, not engaged or unknown. England and UK-wide regimes apply; the Equality Act 2010 does not extend to Northern Ireland.

This is a general activity map, not legal advice. Before the send, assign review to a data protection lead, a marketing compliance reviewer and a security lead; involve a sector specialist where sector rules apply.

What to take away

Five points decide whether the newsletter can go out.

Mark each gate in the CRM newsletter workflow

Five gates apply to a newsletter to existing customers, and each gets its own mark. UK GDPR is engaged because the newsletter uses personal data. PECR is engaged because it is electronic marketing to existing customers.

DMCC is not engaged because the newsletter makes no claim that affects a transactional decision. The CAP Code mark is unknown until the headline claim is checked. The Equality Act is not engaged because no barrier is identified.

Set up the CRM workflow for the send

Treat the CRM as the working control point for the audience and its evidence, not as proof that a send is lawful. For each contact, retain the collection source and date, sale or negotiation context, marketing preference and opt-out status alongside the evidence for the route being used.

Create a send segment that includes only contacts whose route has been checked, and apply opt-out or suppression controls before selecting the campaign audience. Keep unknown records out; test the segment and its exclusions before release rather than relying on staff memory.

Link the campaign to its approved content, claim evidence, reviewer and release decision in the CRM campaign record or a controlled linked file. If the CRM software cannot retain field history or release evidence, keep that evidence in a controlled system and do not treat an empty or missing field as permission.

The Data Protection Act 2018 is read with the UK GDPR. The Privacy and Electronic Communications Regulations add channel-specific rules; their formal name is the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Neither should be replaced in an internal policy by a single "consent required" instruction.

Check the four soft opt-in conditions

PECR's soft opt-in can permit email or text marketing without consent only where every condition is met. Being an existing customer is not enough on its own. Check each condition for a contact before adding that person to the newsletter list.

The ICO's electronic mail marketing guidance puts it the same way. An existing customer who bought, or negotiated to buy, a similar product or service can be emailed if they were given a simple way to opt out when their details were first collected and in every message.

Keep the opt-out choices with the contact record, so a later data protection request can be answered from the same file. A contact who fails any condition needs specific consent or stays off the list.

The Data (Use and Access) Act 2025 amended, but did not replace, the UK GDPR, DPA 2018 and PECR. Its extended soft opt-in for charities, political parties and other non-commercial organisations is a separate rule. Do not rely on it unless its commencement and the current ICO guidance have been checked.

Test the headline claim and the consumer rules

A message that can lawfully be sent may still carry an unsubstantiated claim. The CAP Code is the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing, administered by the Advertising Standards Authority (ASA). Keep evidence supporting objective claims and a record of the code check.

The CMA's unfair commercial practices guidance explains that the relevant Digital Markets, Competition and Consumers Act 2024 (DMCC Act) provisions apply to business-to-consumer commercial practices from 6 April 2025. It also says its examples are non-exhaustive and the guidance is not a definitive legal interpretation.

Do not apply that consumer regime automatically to every business-to-business supplier negotiation. For the newsletter, ask whether any sentence invites a purchase decision on the strength of a claim; if it does, the DMCC mark changes from not engaged to engaged. A disclosure policy can hold the owner, trigger and evidence for each disclosure.

Cover the supplier and any transfer abroad

Where a CRM or newsletter provider processes personal data on your behalf, it is a processor and UK GDPR Article 28 requires a written contract setting out the processing terms. Keep the signed data processing agreement (DPA), including processing instructions and sub-processor terms, and review it when the service changes.

The commercial contracts check covers roles, instructions, transfers, security and exit, which are the clauses this send depends on.

A restricted transfer of personal data outside the UK needs a recorded destination and mechanism. The options are UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

Retain the selected mechanism and any required transfer risk assessment. Not every instance of overseas access is necessarily a restricted transfer, so record the reasoning when you decide that one is not.

Hold the send while any gate is unknown

An unknown mark blocks the send. In the example the CAP Code gate stays unknown until the headline claim is checked, so the newsletter waits while the other gates are worked through. An unknown result means evidence is missing, not that the gate has been passed.

Keep the gates independent. A lawful basis under UK GDPR does not itself authorise an unsolicited marketing email under PECR, and passing a cloud security review does not settle controller and processor roles.

Recheck after a new purpose, channel, subscriber type, automated decision, sensitive field, data recipient, overseas access, advertising claim, customer group or supplier term. If the same message also goes by text or phone, repeat the row for each channel, because PECR rules are channel-specific.

The release record names the source version, reviewer, evidence, decision, exceptions and expiry. Run the pre-launch quality checks before the first send, and treat the workflow as a controlled proposal rather than a compliance claim until then.

Before you act

Work through these six steps before the newsletter is sent.

Common questions

When can a business email existing customers without fresh consent?

Only when every soft opt-in condition is met. The details came directly from the person during a sale or negotiations for one, the message markets the business's own similar products or services, and an opt-out was offered at collection and in every message.

Does a UK GDPR lawful basis cover the newsletter?

Not by itself. A lawful basis under UK GDPR does not authorise an unsolicited marketing email under PECR, so each gate is marked separately and the PECR route is recorded with the contact.

Why does an unknown mark stop the send?

An unknown result means the evidence is missing, not that the gate is passed. In the example the headline claim has not been checked against the CAP Code, so the newsletter is held until it has.