Writing AI marketing tools data protection rules without slowing campaigns

What to take away

Where UK GDPR duties bite in marketing analytics

Analytics is processing. Scoring a lead, predicting churn or grouping customers by behaviour involves personal data. Duties start when records leave your CRM for a model. They follow the data into any copy held by the vendor. The wider picture is in the UK rules and compliance guide for 2027.

Two rules do most of the work: a lawful basis you can record, and a risk assessment before you start.

Choosing and recording a lawful basis

Consent is rarely practical for analytics on existing customers. It must be freely given, specific and as easy to withdraw as to give. Legitimate interests often fits better, with a documented balancing test and a clear opt-out. Performance of a contract can cover basic service delivery.

Running the DPIA before launch

Article 35 of the UK GDPR requires a DPIA where processing is likely to result in high risk. Large-scale profiling with new technology is a listed trigger. Combining data sources or inferring sensitive traits pushes ordinary scoring into that territory. Write it before launch, not after a complaint.

How to keep campaigns moving

Use a three-day compliance sprint during campaign build. Day one: map data and set retention. Day two: write the DPIA. Day three: check contract terms and vendor roles. Run this in parallel with creative work, not as a gate.

Use a tiered review. Low-risk tools need a checklist and 48 hours. Medium-risk profiling needs a light DPIA and five days. High-risk profiling needs a full DPIA and legal sign-off. Pre-approve templates so legal is not a bottleneck.

Ask vendors for sub-processor lists, breach notice times and training data locations. Put the agreed answers in the contract schedule.

What the ICO toolkit asks you to evidence

The ICO's toolkit for organisations considering using data analytics works through lawful basis, data minimisation, accuracy and evaluation in order. Answering it gives you an evidence file that a regulator or procurement team can read.

Contracts decide the vendor's role

A platform that only follows your instructions is normally a processor. Article 28 of the UK GDPR requires a written contract covering security, sub-processors and breach support. A vendor that reuses your data to train its own models is likely a controller. The clauses worth arguing over are in AI marketing tools commercial contracts in England.

Retention rules you can set now

Set a default retention schedule in the contract. Score inputs: 12 months. Inference logs: 6 months. CRM source records: 24 months after last activity. Model weights and embeddings: delete or anonymise after 12 months. Backups: 30 days.

Worked example: tooling on £1,200 a month

A five-person team might pay £1,200 a month for analytics, £250 for a customer data platform and £180 for enrichment. HubSpot offers a free CRM and paid Marketing Hub seats, which suits small teams testing lead scoring. Salesforce Marketing Cloud and Data Cloud suit larger teams, but enterprise contracts often need procurement review.

Klaviyo charges by contacts and includes predictive analytics for ecommerce. Segment charges by monthly tracked users and centralises event data. OneTrust provides privacy management with DPIA workflows, usually on quote-based pricing.

Budget two days for the DPIA. Budget half a day for the legitimate interests assessment. Spend an afternoon checking Article 28 terms. If a vendor cannot say where training data is stored, renegotiate or switch.

Agent frameworks add a governance question

If you deploy an agent that reads your CRM and sends emails, the automated decision is yours, not the framework's. Microsoft's Agent Framework overview explains how agents chain tools and models. That helps you map where personal data flows. The machine learning guides from Google cover evaluation choices that shape what you can evidence later.

Common questions

Do we need consent to use AI analytics on customer data?

Usually not. Consent must be freely given, specific and easy to withdraw. That rarely suits analytics on an existing customer base. Legitimate interests or contract often fit better, if you document the reasoning.

Is a DPIA needed for a small lead-scoring pilot?

It depends on scale and risk. A pilot on existing customers may not cross the threshold. Large-scale profiling or sensitive inferences usually does. Record the decision either way.

Who is liable if the vendor's model causes a breach?

Liability follows the roles in the contract. As controller you stay accountable to the individual for processing you instructed. This is general guidance. Your own facts need a qualified adviser.