Compliance • Marketing Ops • UK Focus
A practical, UK-focused guide to consent, email marketing, cookies, automation, and what changed post-Brexit.
Direct answer: UK marketers should treat GDPR as an always-on part of marketing ops: collect only the data you need, be transparent at every touchpoint, and send marketing emails only with a lawful basis (usually clear opt-in consent). Post-Brexit UK GDPR is broadly aligned with EU GDPR, but 2025 changes raise PECR penalties and tweak cookie rules—so get your martech configured properly.
GDPR isn’t “done”. Enforcement has kept climbing, and UK regulators now have sharper teeth for marketing and cookie breaches. Up to March 2025, the CMS GDPR Enforcement Tracker recorded 2,245 fines with total penalties of around €5.65 billion.[1]
The good news: privacy-led marketing tends to be better marketing. Recent survey data suggests 73% of shoppers prefer brands that handle email data transparently.[2] Trust isn’t fluffy — it’s conversion fuel.
In this guide you’ll get a clear UK view (UK GDPR + PECR), what changed in 2025, and a practical checklist you can hand to your marketing team (and your HubSpot admin) today.
Quick note: This is practical guidance for marketers, not legal advice. If you’re unsure about lawful basis, profiling, or international transfers, speak with your privacy lead or legal counsel.
Want help getting your systems set up properly? Our HubSpot onboarding services are built to turn compliance settings into day-to-day marketing habits (without killing performance).
What is UK GDPR and does it apply to your marketing?
Standalone answer: UK GDPR is the UK’s version of GDPR, retained after Brexit. It governs how you collect, store, use and share personal data — and marketing teams touch personal data constantly: email addresses, CRM activity, website tracking identifiers, form submissions, event registrations, and more.
In practice, UK GDPR is still broadly aligned with EU GDPR. The biggest difference is administration and oversight: the UK Information Commissioner’s Office (ICO) is the primary regulator in the UK, while EU enforcement runs through EU data protection authorities. In 2025 the UK introduced targeted reforms and raised penalties for certain marketing-adjacent breaches (more on that below).[3]
A simple rule: if you market to UK individuals (including B2B contacts, because people are still people), you must follow UK GDPR. If you also market to EU residents or process their personal data, EU GDPR can apply too — and you may need to consider cross-border requirements and representation.
GDPR essentials for marketers: consent, transparency, and data rights
The marketer’s version of GDPR: be clear, be fair, don’t hoard data, don’t surprise people, and make it easy to say “no”.
1) Lawful basis (and why “we found your email on LinkedIn” doesn’t cut it)
Every time you process personal data, you need a lawful basis. For most marketing email, the safest option is consent. In some B2B scenarios you might consider legitimate interests, but you still need to apply additional UK rules (PECR) for electronic marketing — and you must respect opt-outs, preferences, and transparency either way.
2) Consent that actually holds up
Think of valid consent as a clean “yes”: it must be clear, specific, informed, and given by an affirmative action (not pre-ticked, not buried). If your form copy makes people squint, it probably won’t satisfy a regulator.
- Use unticked checkboxes or explicit opt-in toggles for marketing communications.
- Keep consent separate from other terms (no bundling).
- Record how/when consent was captured (form, date/time, source).
- Make it easy to withdraw consent (unsubscribe and preference options).
If you run HubSpot, you can enable data privacy settings and restrict marketing sends to contacts who have a legal basis (opt-in).[4] That’s the difference between “we think we’re compliant” and “our platform enforces compliance by default”.
3) Transparency: say what you do (and then do what you said)
GDPR expects you to be transparent about why you’re collecting data, what you’ll use it for, who you’ll share it with, and how long you’ll keep it. The easiest way to operationalise this is:
- A clear privacy notice linked at every capture point (forms, chat, bookings).
- Plain-English explanation of what someone will receive if they opt in.
- A preference centre (or at minimum, clear subscription management).
Industry experts increasingly frame privacy as a trust and ethics issue, not just compliance — a shift that matters to marketing performance as much as risk management.[5]
4) Data subject rights: plan for the “delete me” moment
People can request access to their data, correction, deletion, or object to processing (including direct marketing). The operational point: your marketing team should not be improvising when these requests land. The ICO’s guidance explains how to calculate the one-month response period (with worked examples).[6]
5) Security and minimisation: don’t collect what you can’t protect
Data minimisation is a marketer superpower: fewer unnecessary fields, fewer messy spreadsheets, fewer risky exports. Keep only what you need, limit access, and make sure vendors (email, CRM, analytics, ad platforms) are properly configured. “It’s only marketing data” isn’t a defence — marketing databases are often the easiest doorway to reputational damage.
Whitehat perspective: GDPR works best when it’s baked into your inbound engine. That’s why we’re big on inbound marketing services (permission-based growth) and on configuring HubSpot so consent and preferences are enforced automatically — not managed in a fragile spreadsheet.
What changed in 2025 for UK marketers?
Standalone answer: UK GDPR remains closely aligned with EU GDPR, but 2025 reforms sharpened enforcement and updated rules around cookies and electronic marketing. For marketers, the headline is simple: the cost of sloppy consent and cookie practices has gone up.
PECR penalties aligned to GDPR levels
The ICO confirms it has a range of enforcement tools for breaches of PECR (the UK rules covering electronic marketing and cookies), including fines up to £17.5 million or 4% of annual worldwide turnover for serious infringements.[7] Translation: cookie banners and “consent” are not UI fluff — they’re now a board-level risk.
Targeted UK/EU reforms (post-Brexit, but not a clean break)
A July 2025 legal analysis comparing UK and EU changes describes these reforms as the first substantial updates to GDPR since 2018, with the UK introducing amendments as part of its post-Brexit framework while remaining broadly aligned.[3]
Cookie rules: some easing, but marketing cookies still need consent
2025 changes introduced more flexibility for certain low-risk cookies in the UK, but marketing/advertising cookies typically still require consent. The safest route is to keep a clear consent mechanism, distinct cookie categories, and documented third-party tracking — and to configure your platform accordingly (for example, HubSpot’s data privacy settings and consent tools).[4]
Practical takeaway: If your compliance depends on “everyone remembering to do the right thing”, it will fail. Make your tools enforce the rules (consent, subscription status, cookie categories) so your team can focus on strategy — not firefighting.
A practical GDPR checklist for marketing teams (email, forms, cookies, automation)
Standalone answer: GDPR compliance becomes manageable when you treat it as a repeatable marketing process: audit what you collect, fix consent at the source, configure your platforms to enforce legal basis, and document how you respond to rights requests.
- Map your data flow (30 minutes, not 30 days).
List your capture points (forms, chat, bookings), storage (CRM/email), and “leaks” (exports, Google Sheets, personal inboxes). If you can’t explain where a contact came from and why you can email them, that’s your first fix. - Fix opt-in at the point of capture.
Add clear consent language to every form and landing page, separate marketing opt-ins from operational messaging, and link to your privacy notice. If you use HubSpot, enable data privacy settings and configure “send only with legal basis”.[4] - Make subscription preferences effortless.
Every marketing email should include an unsubscribe mechanism, and ideally a preference centre. Document your approach and align it with your own standards (see our Anti-Spam Policy for the principles we recommend teams adopt). - Sort your cookie story (before your next campaign launch).
Confirm which cookies fire on key pages (homepage, key landing pages). Categorise them (necessary, analytics, marketing), ensure consent is captured where required, and keep a record of vendors and purposes. - Operationalise data subject rights (so you don’t panic-reply).
Build a short internal playbook: who receives DSARs, how you verify identity, how you collect data across systems, and your response timelines. The ICO provides worked examples for calculating the one-month period.[6] - Configure automation to respect consent (and stop accidental sends).
In modern marketing automation, compliance is a feature — if you turn it on. If you’re using HubSpot, configure privacy settings, consent capture on forms, and rules that prevent marketing emails to contacts without a legal basis.[4] If you’re unsure where to start, our HubSpot onboarding team can help you set this up properly.
Helpful rabbit hole: If you’re using personalisation, take a look at our Smart Content guide. It includes a UK-focused section on GDPR implications for smart content and consent-led personalisation.
If you want the “done properly” version: Our team can help you align compliance with lead generation so it doesn’t feel like you’re choosing between legal safety and pipeline.
Book a call with WhitehatTurning privacy into a marketing advantage (yes, really)
Standalone answer: Privacy-led marketing improves trust, list quality, and long-term performance. When your growth engine is built on permission and transparency, you spend less time repairing damage and more time compounding results.
One reason GDPR-friendly marketing works: it filters out low-intent contacts. Your list may be smaller, but it’s usually healthier — fewer complaints, better engagement, clearer segmentation, and more accurate reporting. And the trust angle is real: PrivacyEngine’s 2024 data suggests 73% of shoppers prefer brands that manage email data transparently.[2]
Usercentrics’ 2025 commentary frames this as a broader shift: consumers aren’t rejecting innovation or personalisation; they’re rejecting opacity. The winning brands are the ones that give people real clarity and control.[8]
Frequently Asked Questions
Does GDPR still apply to UK businesses after Brexit?
Yes. The UK adopted GDPR into domestic law as the UK GDPR, and it still applies to UK marketers. If you handle personal data about UK individuals, UK GDPR applies; if you market to EU residents or process their data, EU GDPR may also apply. 2025 reforms strengthened enforcement around marketing and cookies, so the practical need for compliance is as strong as ever.[3]
Do small businesses need to comply with GDPR for marketing?
Yes. GDPR applies to organisations of any size when they process personal data — including marketing data like email addresses, CRM records, and tracking identifiers. While your documentation can be proportionate, the essentials (lawful basis, transparency, security, and honouring rights) still apply.
What’s the best way to get valid marketing consent under GDPR?
Use clear, specific opt-in language at the point of data capture, with an affirmative action (for example, an unticked checkbox). Keep a record of when and how consent was given, make withdrawal easy (unsubscribe/preference options), and avoid bundling consent into other terms. Double opt-in can strengthen proof and list quality for email marketing.
What penalties can UK marketers face for non-compliance?
Penalties depend on the breach, but the ICO can issue enforcement notices and significant fines. For serious infringements, the ICO notes fines can be up to £17.5 million or 4% of annual worldwide turnover and it also has enforcement powers for PECR breaches related to direct marketing and cookies.[7]
Can I still use marketing automation and analytics under GDPR?
Yes — if your tools are configured to respect consent, subscription preferences, and lawful basis. Many platforms support consent capture and can restrict marketing emails to contacts with a legal basis. HubSpot, for example, documents how to turn on data privacy settings and enforce “send only with legal basis”.[4] For analytics/advertising cookies, use a compliant consent banner and keep your vendor list documented.
Final word
GDPR compliance doesn’t have to be the thing that slows marketing down. In 2025, the teams winning are the ones who build privacy into the system: cleaner consent, clearer messaging, better segmentation, fewer risks, and stronger trust.
If you want a sanity check on your forms, cookie setup, email permissions, and HubSpot configuration, talk to Whitehat — we’ll help you make it compliant and commercially useful.
References
- CMS (GDPR Enforcement Tracker Report, May 2025). Numbers and Figures (2,245 fines; ~€5.65bn total)
- PrivacyEngine (31 Dec 2024). GDPR Statistics Worldwide 2024 (consumer trust and email transparency)
- Skadden (1 July 2025). Something Is Better Than Nothing: UK and EU GDPR Reform Finally Arrives
- HubSpot Knowledge Base (Updated 2025). Manage data privacy settings / enable GDPR functionality
- Solutions Review (30 Jan 2024). Data Privacy Day 2024: Expert quote roundup (privacy as trust/ethics)
- ICO (UK GDPR right of access guidance, accessed 2025). Calculating the one-month deadline for access requests (worked examples)
- ICO (Direct marketing guidance: Enforcement, accessed 2025). PECR enforcement powers and maximum fines
- Usercentrics (State of Digital Trust 2025 commentary, 2025). Privacy-led marketing as a brand differentiator