Compliance
How do I handle GDPR in financial marketing?
Last reviewed 22 April 2026 · Reviewed by Jake McQuillan
Quick answer
How do I handle GDPR in financial marketing?
Lawful basis (consent or legitimate interests), clear privacy notice, data minimisation, 12-36 month retention with review, data-processor contracts with all vendors.
Want us to do this for your firm?
Get a compliant lead-gen plan tailored to your niche and compliance setup.
Checklist
- Lawful basis declared per data flow
- Privacy notice linked from every form
- Data minimisation: only collect what you use
- Retention policy: 12-36 months default, document exceptions
- Processor agreements with Meta, Google, CRM, email
- DSAR workflow under 30 days
Overlap with PECR
Email/SMS marketing rules are stricter than GDPR; get both right.
Was this useful?
Related questions
Is Platinum Prospects FCA regulated?
Platinum Prospects is a marketing agency, not a regulated financial firm. All financial promotions produced by the agency are signed off by the client firm's a…
How does Consumer Duty affect financial adviser marketing?
Consumer Duty requires all marketing to be fair, clear, not misleading, aligned to target market and delivering good outcomes meaning claims, risk balance and…
How do I handle protected characteristics in financial marketing targeting?
Do not target or exclude on protected characteristics (age is protected only in limited contexts). Use proxies carefully and document rationale.
Can financial services firms send cold email in the UK?
Cold email to sole traders and limited company contacts is permitted under PECR for B2B, but consumer cold email requires soft opt in or consent.
How do I verify my Google or Meta ad account for UK financial services?
Google requires financial services verification via the FCA register (FRN). Meta requires authorisation via their Financial Products and Services policy. Both…