Question of the month – Can provision of information required by a regulator ever be direct marketing?

The short answer is yes, it can. Even where you are required by a regulator to communicate information, this does not automatically prevent such messages from falling under the direct marketing regime.

So how should organisations in the regulated sector (sectors where a statutory regulator has oversight – e.g. the financial services sector) ensure, when communicating important regulatory messages, that they don’t inadvertently stray into direct marketing territory, bringing the Privacy and Electronic Communications Regulations 2003 into play?

The ICO advises that you should consider the context and content (i.e., phrasing and tone) of the message, including how it is delivered. Where a message actively promotes an initiative, encouraging individuals to take part, it is likely to be marketing. If you adopt neutral tones, not encouraging people to take any particular course of action, it is less likely this could be considered to be marketing. The ICO guidance advises that messages which are solely for the individuals’ benefit and against the organisation’s interests, where the only motivation is to comply with a regulatory requirement are unlikely to be direct marketing.

The ICO warns against taking a blanket approach to regulatory communications, but instead considering the content of each message individually and being careful not to ad regulatory messages to communications which contain direct marketing.

The ICO gives the following examples of messages which are unlikely to be considered direct marketing, being messages that:

  • give advance warning of changes to terms, conditions or tariffs.
  • explain about statutory complaint or compensation schemes.
  • warn about fraud and how to report it.
  • remind people of how to get in touch if they are struggling with payments; or
  • provide offers of support for those customers most at risk of harm.


There are also ways in which messages can be communicated which will mean they do not fall under the regime, such as displaying the message on your website, using inbound calls, posting on your social media account, via magazines/newspapers, television, radio or streaming services.

The ICO does, however, remind us that whether direct marketing or not, if personal data is involved in conveying these messages, data protection law will need to be complied with.

The full text of the guidance can be found here.


Don't just take our word for it