The Information Commissioner's Office (ICO) has made clear that data protection is not a paperwork exercise. In a recent enforcement action, the UK's privacy regulator issued fines totalling £225,000 to companies involved in aggressive nuisance marketing. While the financial penalty draws attention, the underlying failure is one that affects every small business and marketer in the country: the misuse of Data Protection Impact Assessments (DPIAs).
For many UK business owners, a DPIA reads as a bureaucratic requirement — a document drafted to justify a marketing strategy that was already decided. As this ruling shows, treating a DPIA as a formality rather than a genuine legal test is a direct route to regulatory intervention and financial loss.
The ICO Enforcement: A Direct Warning to UK Marketers
The enforcement action targeted firms that bombarded UK residents with unsolicited marketing calls and messages. Under the Privacy and Electronic Communications Regulations (PECR), which sits alongside the UK GDPR, businesses must have valid consent or a demonstrable legitimate interest before contacting someone for marketing purposes.
In these cases, the ICO found that the organisations disregarded the rights of individuals, many of whom were registered with the Telephone Preference Service (TPS). The fines, totalling nearly a quarter of a million pounds, reflect both the scale and the nature of that intrusion.
The takeaway for UK marketers is this: the ICO is increasingly focused on the intent behind compliance, not just its appearance. A privacy policy on your website is no longer sufficient. You must be able to show that high-risk processing activities — telemarketing in particular — were subject to a genuine, honest DPIA.
Why Poorly Drafted DPIAs Lead to Enforcement
A Data Protection Impact Assessment is a structured risk assessment for personal data. It is a mandatory requirement under UK GDPR when you are introducing new technologies or processing data in ways that are likely to present a high risk to individuals.
The core mistake in recent enforcement cases is what might be called outcome-driven drafting. This happens when a business decides on a goal first — say, cold-calling 10,000 prospects — and then writes a DPIA to justify that decision rather than to assess it.
When a DPIA is written around a desired outcome, the balancing test gets ignored. The real question — does our commercial interest outweigh the individual's right to privacy? — goes unanswered. If the honest answer is no, but the document records yes to keep a campaign on schedule, the business is exposed. The ICO will see through it, and the DPIA itself becomes evidence of the problem.
The Outcome-Driven DPIA: Myth vs. Reality
Myth: A DPIA is a document I file away in case the ICO asks for it. Reality: A DPIA is a working process. If it does not result in the project being changed, limited, or in some cases stopped, it is unlikely to have been a rigorous assessment.
Myth: I can commission a consultant to do the DPIA and leave it at that. Reality: You can take advice, but the controller — the business owner — carries legal responsibility. You must understand the risks identified and be able to demonstrate that the mitigations are being applied in practice, not just described on paper.
How to Conduct a Rigorous Legal Basis Test
To avoid the failures that produced the £225,000 fines, UK GDPR compliance must begin with a genuine legal basis test — not a post-hoc justification.
Identify the Need. If you are profiling customers, using location data, or contact-tracking at scale, a DPIA is required.
Describe the Processing Honestly. If you are purchasing a leads list, state exactly where it came from and how those individuals were told their data would be used. Vague language does not protect you.
Assess Necessity and Proportionality. Is there a less intrusive way to achieve the same outcome? If opt-in email marketing can reach your target audience, cold-calling is unlikely to be proportionate.
Identify and Evaluate Risks. Consider the human impact. Could this contact cause distress? Is the person elderly or otherwise vulnerable? These are not peripheral questions.
Obtain Sign-off. The DPIA should be reviewed by your Data Protection Officer, if you have one, or by a senior person with genuine authority to stop the project if the risks cannot be adequately managed.
UK GDPR Compliance Checklist: Marketing Edition
Check the TPS: Have you screened your calling list against the Telephone Preference Service?
Verify Consent: Can you prove exactly when and how each individual opted in? Silence and pre-ticked boxes do not constitute valid consent.
Review Your DPIA: Does it actually identify risks, or does it record everything as low risk without explanation?
Clear Opt-Out: Is opting out as straightforward as opting in?
Transparency: Does your Privacy Notice explicitly describe the type of marketing you conduct?
The Consequences of Outcome-Driven Drafting
When the ICO investigates a complaint about nuisance calls, a DPIA is one of the first documents requested. If the assessment glosses over obvious risks in order to keep a campaign on schedule, it functions as evidence of recklessness rather than good faith.
That distinction matters considerably. A DPIA drafted honestly — even one that contains errors — signals that the organisation took the law seriously. A DPIA drafted to bypass the law signals the opposite, and materially increases the likelihood of a maximum penalty rather than a warning.
FAQ: Protecting Your Small Business
Do I really need a DPIA for a small marketing campaign? If you are using automated calling, large-scale data sets, or data sourced from social media, yes. Under UK GDPR, scale is not only about the number of people contacted. The nature of the intrusion matters equally.
What is the difference between UK GDPR and EU GDPR for marketing? The frameworks are closely aligned, but post-Brexit the UK operates its own version of the law. Enforcement sits with the UK ICO, which publishes specific Codes of Practice for direct marketing that UK businesses must follow.
How do I respond to a DSAR related to marketing? If someone submits a Data Subject Access Request asking why they are being contacted, you must provide all the data you hold on them and explain your legal basis for that contact. A poorly constructed DPIA often surfaces its weaknesses at precisely this point.
Moving Forward: Privacy by Design
The recent fines are not only a penalty. They demonstrate clearly how data protection failures occur and where the responsibility lies. For small businesses and marketers, the practical response is Privacy by Design — treating data protection as part of the planning process, not a compliance step added at the end.
Rigorous, honest DPIAs are the mechanism through which that approach is made visible and defensible. Businesses that do this well are not simply avoiding fines. They are making a credible case to their customers that their data is handled with care. In a market where customer trust is hard to earn and easy to lose, that is a position worth protecting.
If you are uncertain whether your current marketing strategy can withstand a genuine legal basis test, review your DPIAs now — before the ICO does it for you.