You must clearly assign responsibility for data protection oversight when carrying out direct marketing activities.

Where appropriate, you should have steering groups to monitor data protection performance and review relevant issues.

There must be effective reporting lines and links between key roles to ensure a coordinated approach.

A targeted work programme for direct marketing and data protection is required; management should regularly monitor its progress.

You must have policies and procedures, approved by corporate management, to provide guidance to staff on how to comply with data protection legislation when carrying out direct marketing activities.

You must communicate these policies to staff, including fixed-term employees or temporary workers, and review them regularly.

You should establish performance metrics, which reflect the organisation's needs and risks, to allow you to check compliance.

Monitoring should be undertaken on a regular basis and the results reported to the manager in charge of direct marketing so that they can assess the risks and take appropriate action.

Conducting regular checks or audits of your direct marketing practices will help you ensure data protection compliance.

You must inform all direct marketing staff about their data protection responsibilities at or immediately after their appointment, and with regular updates to maintain adequate levels of awareness.

Data protection awareness material could include posters, office-wide emails, intranet updates, or newsletters.

Where necessary, you should provide specialized training to staff in particular specific roles, based on the needs of the professional role performed.

Under data protection legislation (GDPR):

• consent must be a positive action, demonstrating how the data subject accepts the use of their personal data for direct marketing.
• pre-ticked opt-in boxes are not allowed: silence or inactivity of the data subject do not demonstrate the granting of consent.

You should:

• ensure that marketing consent is separated from other consent requests.
• inform the data subject about the marketing methods you intend to use, for example email, text, phone, automated call, mail.
• provide the data subject with the possibility to choose preferred contact systems (so-called "granular consent"). Data subjects should not be forced to accept all or nothing.
• make it easy for the data subject to withdraw consent and provide specific information to do so.
• identify your company and any third party relying on consent to process personal data.

You should be able to identify:

• name or other identifier of the data subject.
• time and date when the data subject gave consent.
• the platform or mechanism you used to obtain consent.
• exactly the activities covered by the consent.

You should be able to easily update the information in the previous point upon receipt of any changes.

You should archive the website text, flyer, contract, phone script, etc. that you used to inform the data subject at the time they provided consent. You need to cross-reference this information with customer records to accurately track what they have consented to if you need to retrieve that information.

If you operate more than one brand or connected business, you must be specific about which business obtained consent. For cross-marketing of brands, you must provide the names of all brands at the time of obtaining consent. You cannot assume that if a data subject consents to marketing from one brand they consent to marketing from all.

If you offer online services to minors and need to obtain consent, you must take age verification measures and seek parental consent for minors under 13.

If you pass data subjects' personal data to third parties for marketing purposes, you must specifically request this consent. You must provide the data subject with the names of all third parties involved. There must be sufficient detail to allow the data subject to make an informed choice regarding marketing.

You should also review existing consents and consent mechanisms to verify that they meet the standards required by the GDPR. If so, there is no need to obtain new GDPR-compliant consent.

However, if the consent is not compliant, you will need to request new consent in accordance with the GDPR or identify a different lawful basis for the processing (and ensure that continuing the processing is fair) or stop the processing.

Not all marketing will require consent since the legitimate interest criterion could potentially be applied in all situations where consent is not mandatory, for example postal marketing, live calls to numbers not registered in the opt-out register, or email, where the "soft opt-in" rule applies.

Your company must:

• demonstrate that direct marketing is necessary for your purposes.
• perform a balancing test to estimate legitimate interest.
• give data subjects a clear option to opt-out of direct marketing when you acquire their personal data.

You should not use purchased lists for emails, text messages, or automated calls unless you have evidence of explicit consent (opt-in) granted in the last six months where your business name is specified.

If you collect consent from minors, you should have adequate evidence to show that you have taken steps to verify the minor's age and that you have obtained parental consent.

You must keep track of when and how the collected consent was obtained and the exact subject matter of the consent itself.

You can maintain a "suppression list" of people who do not wish to receive marketing. You must keep this list up to date and accurate and consider which staff can access it.

You should provide a privacy notice to data subjects outlining:

• what marketing communication methods you will use.
• details of any sharing with third parties.
• the purposes of any sharing that may take place, unless a legal exemption applies.
• the lawfulness criteria for the processing.
• how data subjects can withdraw their consent and object to marketing.

You should ask for consent to pass contact details to third parties for marketing and provide the names of each of them.

You must keep track of when and how the collected consent was obtained and the exact subject matter of the consent itself.

You can maintain a "suppression list" of people who do not wish to receive marketing. You must keep this list up to date and accurate and consider which staff can access it.

If third parties act as data processors carrying out marketing activities, you should have specific contracts in place to ensure the security of all data provided.

You should provide a privacy notice to data subjects outlining:

• what marketing communication methods you will use.
• details of any sharing with third parties.
• the purposes of any sharing that may take place, unless a legal exemption applies.
• the lawfulness criteria for the processing.
• how data subjects can withdraw their consent and object to marketing.

Withdrawing consent must be as easy as it was to give it. This means that the consent withdrawal process should be an easily accessible single-step procedure. Where possible, data subjects should be able to withdraw their consent using the same method as when they gave it.

You must keep a detailed record to demonstrate the collection of consent: who consented, when, how, and what was said. This will make it easier for data subjects to withdraw consent at any time.

Consider using preference management tools so data subjects can access them and update their consent settings. Keep track of collected consents and update them if anything changes. Establish regular consent reviews in your business processes.

Data subjects can object to marketing if you use legitimate interest as a lawful basis for direct marketing.

Data subjects have the right to opt-out of marketing if the soft opt-in criterion was originally applied.

The personal data you hold must be accurate and up to date. What falls into these categories will change over time and as your business needs change.

You must have procedures in place to ensure the regular correction or removal of any personal data used for direct marketing that is inaccurate or out of date.

You must take reasonable steps to ensure the accuracy of personal data collected for direct marketing and to address challenges to the accuracy of personal data from data subjects whose information is acquired over time. This should allow for the modification, removal, or clarification of personal data where appropriate.

Where a data subject finds their data to be inaccurate or asks you to delete it, you should have procedures in place to ensure you respond to their request within one month.

Data collected through direct marketing activities should be adequate, relevant, and limited to what is necessary. If you don't make decisions about what personal data you should keep for direct marketing, then you risk over-collecting data and breaching a data subject's privacy, or you may have too little information to ensure effective decision making about those individuals. Again, what is adequate, relevant, and not excessive will change with business needs.

You need to identify what types of records or datasets are collected and processed as a result of direct marketing activities, what kind of information is kept in these records, and then discard, delete, or anonymize personal data within records you hold as soon as it becomes surplus to your needs.

Once you have identified the types of records or datasets you hold, you can assign retention periods. You can then securely destroy records at the end of their respective periods.