What do UK GDPR and PECR mean for copywriting audience research?

What to take away

How UK GDPR and PECR split the audience research problem

Audience research for a copywriting brief usually starts with a spreadsheet, a survey export or a customer list. The moment it contains a name, an email address, a job title tied to a person or an IP address, it is personal data. Two regimes then apply at once, and they answer different questions.

UK GDPR asks why you hold the data and what you do with it. It sets principles such as lawfulness, fairness and transparency. Purpose limitation, data minimisation, accuracy, storage limitation and integrity follow close behind. Confidentiality and accountability run through all of them.

The ICO publishes detailed UK GDPR guidance and resources that walks through each principle for organisations.

PECR asks how you reach people electronically. It covers marketing emails and calls, cookies and similar tracking, and it sits alongside UK GDPR rather than replacing it. The full text is in The Privacy and Electronic Communications (EC Directive) Regulations 2003.

The practical split looks like this.

Most briefs fail at the join between the two. A team collects rich interview data lawfully, then reuses it for an email campaign without checking PECR. Or it buys a clean list and assumes PECR compliance covers the UK GDPR side. Neither assumption holds.

If you want the wider workflow, audience research turns briefs into evidence, and the evidence has to be collected lawfully before it can be used.

Where the regimes overlap

Consent appears in both. Under UK GDPR it is one lawful basis among several, and it must be freely given, specific, informed and unambiguous. Under PECR it is the default route for electronic marketing to individuals. A single consent can serve both purposes if the wording covers them.

Accountability also spans both. You must be able to show what you did, not just claim you did it. For a copywriting team that means keeping a short record of where each audience list came from and what notice people received.

Lawful bases for building copywriting audience profiles

A lawful basis is the reason UK GDPR permits you to process personal data. There are six, and you must pick one before processing starts, not afterwards. The ICO's data protection principles guidance explains how the principles and lawful bases work together.

The first three are consent, contract and legal obligation. Vital interests, public task and legitimate interests complete the set. For audience research, legitimate interests and consent do most of the work, with contract close behind.

Special category data needs more. Health, ethnicity, religion and sexual orientation fall into it. So do political opinions, genetic data and trade union membership. You need an additional condition under Article 9 on top of your lawful basis. Audience research that segments by disability, for example, crosses that line.

Choosing between legitimate interests and consent

Legitimate interests is flexible but not a free pass. Ask three questions. Is the interest real and current? Is the processing necessary for it? Would a reasonable person be surprised or upset?

If the answer to the third question is yes, use consent instead. That is usually the right call for anything involving vulnerable people, children, or data people would not expect a copywriter to hold.

Recording the decision

Write the basis down before you collect anything. A single line in the brief, such as "lawful basis: legitimate interests, LIA completed 12 March, reviewed annually", is enough for most projects. It also gives the client something to point at if a subject access request arrives.

Consent, soft opt-in and B2B outreach under PECR

PECR governs electronic marketing. The ICO's direct marketing guidance defines direct marketing broadly: any communication that promotes a product, service, brand or purpose, whether or not it asks for a sale. That definition catches a lot of content that teams think of as editorial.

A newsletter promoting your copywriting services is direct marketing. A case study email sent to a prospect is direct marketing. A survey invitation that also promotes your brand probably is too.

The rules differ by audience and channel.

The soft opt-in lets you email existing customers and enquirers about similar products. It applies where you collected the address in the course of a sale or negotiations. You must offer an opt-out at every message, and you must have offered one when you first collected the details. It does not cover new audiences.

B2B is where the confusion lives. The ICO's business-to-business marketing guidance sets out the corporate subscriber exemption, but it also notes that many business contacts are individuals. A generic info@ address at a limited company is a corporate subscriber. A named person at the same company is not.

Practical B2B marketing rules

Check the entity, not the domain. Companies House is the fastest way to confirm whether a contact sits at a limited company, a sole trader or a partnership. Sole traders and non-limited partnerships count as individual subscribers for PECR purposes.

Keep an opt-out in every message. It must be free, easy and honoured promptly. The ICO treats a slow or awkward unsubscribe as a breach in its own right.

Screen against TPS and CTPS before any call campaign. The registers are checked at the point of contact, not annually.

What counts as consent

Consent under PECR must be specific to the organisation doing the marketing. A tick box that covers "our partners" is not valid. Pre-ticked boxes are not valid either. Silence, inactivity and bundled terms are not consent.

Record when, how and what the person agreed to. That record is your defence if a complaint lands.

Cookies, tracking and analytics in audience research

Audience research often leans on analytics: heatmaps, session recordings, scroll depth, on-site surveys. Most of these set cookies or read information from a device, which brings them under PECR regulation 6.

Strictly necessary cookies are exempt. That covers things like basket cookies and security tokens. Analytics cookies are not strictly necessary, and neither are advertising or personalisation cookies. They need consent before they fire.

The ICO has been clear that analytics cookies require consent, even when the data is aggregated. The exemption is narrow, and "it helps us improve the site" does not qualify.

What good consent looks like

Consent must be refreshed when purposes change. Adding a new analytics tool to a site where people consented to "analytics" two years ago is a new purpose, not an extension of the old one.

Session recording and heatmaps

Session replay tools capture keystrokes, form entries and sometimes personal data typed into fields. Most vendors offer masking, but masking is a setting, not a guarantee. Test it before you record real users, and treat any recording of identifiable behaviour as personal data processing.

Research surveys and panels

Survey tools often set their own cookies and process responses on servers outside the UK. Check the vendor's data processing agreement and transfer mechanism. If you are running a panel for a client, the client usually needs to be named in the privacy notice as a joint or separate controller.

ICO guidance on personal data and special category data

The ICO is the UK's data protection regulator. It publishes guidance, runs audits, handles complaints and can fine organisations. Its guidance is not law, but it is the standard the regulator expects you to meet.

Personal data means any information relating to an identified or identifiable person. Pseudonymised data is still personal data if you can re-identify the person, even indirectly. A spreadsheet of job titles and company names becomes personal data as soon as one row points to a named individual.

Special category data is the subset that needs extra protection. Article 9 covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and genetic data. Biometric data used for identification, health data and sex life or sexual orientation are on the same list.

Audience research touches special category data more often than teams expect. A segmentation exercise that notes a disability, a faith-based publication, or a health condition crosses the line. So does inference: if your notes imply someone's health status, that inference is special category data.

How to handle it

Avoid collecting it unless the brief genuinely requires it. If it does, identify an Article 9 condition, such as explicit consent or a substantial public interest, and document it. Increase the security around the file and shorten the retention period.

The ICO also expects a data protection impact assessment for high-risk processing. Large-scale profiling, systematic monitoring and special category data are all triggers. A DPIA is a short structured document, not a research project, and it often takes an afternoon.

Individual rights in practice

People can ask what you hold, ask for a copy, ask for correction, ask for deletion and object to processing based on legitimate interests. You generally have one month to respond. For a copywriting team, the practical step is knowing where audience data lives: CRM, spreadsheets, survey platforms, inboxes and notebooks.

If you cannot find it, you cannot comply. This is also where data protection law apply to client copy in the same way, because the same records sit behind both.

Data sharing and buying audience data from brokers

Buying a list feels efficient. It also makes you the controller of data you did not collect, which means you inherit the compliance risk.

Before purchase, ask the broker for the source of each record, the notice people received, the lawful basis relied on, and whether consent covered the buyer's use. If the broker cannot show that, the list is not safe to use for marketing.

Data sharing has two forms. A controller to controller arrangement means both parties decide purposes independently, and both need their own lawful basis. A controller to processor arrangement means the processor only acts on instructions, and you need a written contract under Article 28.

Due diligence checklist for bought data

If any box is unticked, do not send. A cheap list that generates complaints costs more than the campaign earns.

Competitor research and public sources

Scraping public profiles is not automatically lawful. If the output identifies individuals, UK GDPR applies to the collection, and PECR may apply to any resulting outreach. The safer route is to work at segment level and keep named examples out of the file. competitor research lawfully means staying inside the same rules as your own data.

Practical examples for copywriting services briefs

These are the situations UK copywriters and content strategists meet most often. Each one has a defensible route.

Example 1: a B2B SaaS client wants a persona pack. The client supplies CRM records of named contacts. Legitimate interests covers the analysis if the purpose is internal content planning and the LIA is recorded. Keep the personas aggregated. Do not put real names, quotes or job titles in the deliverable unless you have consent.

Example 2: a charity wants donor stories. Donors are individuals and the stories often reveal health or religious details. Use explicit consent, explain where the story will appear, and offer a plain withdrawal route. Special category data needs the Article 9 condition documented.

Example 3: a retailer wants an email welcome series. The list came from a checkout with a clear opt-in. That is consent, and it covers the welcome series. If the retailer later wants to add a partner's offer, that is a new purpose and needs fresh consent.

Example 4: an agency wants to cold email 500 marketing directors. Named individuals at limited companies are still individuals for UK GDPR purposes, even where PECR's corporate subscriber exemption applies. Run a legitimate interests assessment, keep the message relevant, and honour opt-outs immediately.

Example 5: a client asks for interviews with people who have a medical condition. This is special category data. Use explicit consent, minimise what you record, and store notes securely with a short retention period.

Turning research into a brief

Once the data is lawful, the brief writes itself. Personas become segments. Quotes become themes. The evidence base is defensible because you can show where each claim came from.

That is also the point where target audience explained for England teams connects back to the research, because the audience definition and the data behind it should match.

A worked example

A Manchester agency wins a brief for a financial services client. The client wants to target small business owners in the North West.

The whole process adds a few hours. It removes the main legal risk from the campaign.

Common questions