GDPR accountability shapes UK direct marketing code

The Information Commissioner's Office (ICO) opened a consultation on a new draft direct marketing code last week in which it has encouraged businesses to plan their direct marketing activities.

"A key part of GDPR is accountability. You are responsible for ensuring that your direct marketing practices are compliant and you must be able to demonstrate your compliance. You are likely to need to: adopt data protection policies; take a ‘data protection by design and default’ approach; maintain documentation of your processing activities; have written contracts with organisations that process personal data on your behalf; and carry out data protection impact assessments (DPIAs)," the ICO said.

According to the ICO's draft code, it is best practice for businesses engaging in direct marketing to carry out DPIAs for new projects even if there is no legal obligation on them to do so. DPIAs are a legal obligation in some circumstances under the GDPR, including where the processing of personal data is likely to present a high risk to individuals.

The draft code also addresses the lawful bases for processing personal data for direct marketing purposes. The ICO's good practice recommendation is that organisations obtain consent to the data processing even if there are other lawful means of proceeding with the processing.

While consents can be obtained through third parties, the ICO recommended that businesses "do not rely on consent that was given more than six months ago" in such circumstances.

The information commissioner is under an obligation to set out a code of practice to regulate direct marketing activities under the Data Protection Act. The ICO last updated its guidance on direct marketing in 2018, shortly before the new Act took effect.

The draft new code is open to consultation until 4 March. The ICO is expected to publish the finalised code later this year.