Navigating GDPR Compliance in Direct Marketing: Key Takeaways from Recent ICO Actions

The ICO’s enforcement against direct marketers in 2026 tells a consistent story. In August it fined Elderly Aids Ltd £190,000 for 758,053 unsolicited calls to numbers registered with the Telephone Preference Service. In January it fined Allay Claims Ltd £120,000 for more than four million marketing texts, and ZMLUK Limited £105,000 for more than 67 million marketing emails sent without valid consent. None of these was a GDPR fine. All were issued under the Privacy and Electronic Communications Regulations 2003 (PECR) — and that distinction matters for how you organise compliance.

PECR decides whether you may send the message at all. Regulation 21 prohibits live marketing calls to TPS-registered numbers unless the person has said they do not object; Regulation 22 requires prior consent for marketing texts and emails, with a narrow "soft opt-in" for existing customers who were offered an opt-out when their details were collected. The UK GDPR then governs the personal data behind the campaign: a lawful basis for processing, transparency about what you do with it, and an absolute right for individuals to object to direct marketing, which must be honoured without question.

Consent is where most of the failures sit, and the standard is the same under both laws: it must be freely given, specific, informed and unambiguous. The ICO has been explicit that generic or bundled third-party consent, "selected partners" lists, pre-ticked boxes and consent buried in a privacy policy do not meet it. The sender is responsible even when the list came from someone else — ZMLUK was fined for emails sent on another company’s behalf using data sourced from a third-party website. And under Article 7(3) of the UK GDPR, individuals must be able to withdraw consent as easily as they gave it.

The audit is therefore a short one. Where did each marketing list come from, and can you show the consent wording and date for every record? Is every calling list screened against the TPS and Corporate TPS before use? Do your callers identify the company and give a contact number? Does your opt-out work, and is it recorded? If any answer is "not sure", that is a gap the regulator has fined repeatedly this year. Appointing a Data Protection Officer or conducting an Article 37 readiness review will surface these gaps before a complaint does.

At Privacy Core Services, we offer outsourced DPO appointments and Article 37 readiness reviews to support businesses in their data protection efforts. Our services can help your organisation navigate PECR and the UK GDPR together and ensure that your marketing practices align with what the ICO actually enforces.