UK market-entry GTM stack guide

Across the UK, PECR distinguishes corporate subscribers from individual subscribers. Companies, LLPs and Scottish partnerships are corporate examples. Sole traders, certain English, Welsh and Northern Irish partnerships, and other unincorporated bodies are individual subscribers. An employee's corporate work address can belong to the employer's subscription, but identifiable employee data still brings UK GDPR into scope. If subscriber status is uncertain, the ICO recommends applying the individual-subscriber electronic-mail rules.[1]

For UK corporate subscribers, PECR does not require consent for marketing email or texts. Do not conceal the sender and provide a valid unsubscribe address. For individual subscribers, obtain consent for the specific message type unless the products-and-services soft opt-in applies. That exception requires details obtained directly during your sale or sale negotiation, marketing of your own similar products or services, an opt-out at collection and an opt-out in every subsequent message. Buying a prospect list does not establish that relationship.[1][2]

For ordinary UK live sales calls, screen both TPS and CTPS plus your own do-not-call list. Sole traders can appear on TPS, so checking only CTPS misses relevant objections. A listed number requires specific permission for your calls. Identify the caller, display a contact number and provide contact details or a Freephone number when asked. Claims-management and pension marketing have stricter rules. Automated recorded-message calls require consent specifically covering your automated calls, even to companies; a clean register result or live-call consent is insufficient.[1][2]

UK electronic mail includes SMS and stored social-media direct messages. Do not transfer a corporate work-email decision onto someone's LinkedIn inbox. The ICO says a professional-network user may act in a personal, although professional, capacity, in which case messaging them is not B2B marketing. Publicly visible contact data is not agreement to marketing. These channel rules are not a platform-automation authorisation. The ICO B2B page also flags review following the Data (Use and Access) Act, so recheck guidance at launch.[1][2]

UK GDPR requires a lawful basis for identifiable business-contact data. Where PECR does not require consent, legitimate interests may be appropriate after assessing purpose, necessity and the person's interests and rights. It is not a replacement for consent where the channel requires it. A direct-marketing objection is absolute for personal data. The ICO recommends suppression rather than simply deleting the contact and later importing it again.[1]

For UK enrichment and public-source imports, provide your own privacy information unless a valid exception applies. For indirect collection, the deadline is a reasonable period and no later than one month, brought forward to the first communication or disclosure where applicable. Include source, purposes, lawful basis, retention, recipients, transfers and rights. A CRM import is therefore a transparency task, not just a field-mapping task. Our assessment is to store provenance, notice status, subscriber classification and separate channel permissions alongside a suppression key.[3][1]

Map who decides how contact data is used. The ICO distinguishes a controller from an instructed processor and warns that outsourcing sending does not necessarily remove the instigator's PECR responsibility. Our assessment is to review CRM, enrichment and sending roles separately, including contracts and overseas access. Do not assume that one vendor's compliance statement establishes your own marketing permission.[2]

For restricted transfers under UK GDPR, the ICO provides the IDTA or the UK Addendum to the EU SCCs as contractual safeguards, with a transfer risk assessment and any necessary extra protections. EU SCCs alone are not valid for UK restricted transfers. This is a transfer-mechanism analysis, not a blanket UK-hosting rule. Separately, the Commission lists UK adequacy, renewed in December 2025, for covered EEA-to-UK flows. EU exporters still retain other GDPR duties, including lawful processing, security and processor contracts; adequacy does not erase them or automatically resolve a different onward transfer.[4][5][6]

Apollo documents separate Contact and Account HQ location filters, plus job-title and company-size filters. A UK-based person and a UK-headquartered account are different result sets. Cognism documents company and people searches with location filters and explicitly requires the country value United Kingdom rather than UK. These are documented targeting controls. The checked pages do not establish independently audited UK recall, current-title accuracy, email fill rate or reachable-mobile coverage.[7][8]

Our assessment is to compare providers against the same approved UK account sample before choosing a second subscription. Separate UK headquarters from UK operating teams, and measure target-role matches, duplicates, missing work emails and phone availability. Review supplier suppression settings without treating them as proof that both TPS and CTPS plus your own objections have been applied. Keep accepted contact evidence in the existing CRM, not a provider-only list.[7][8][1]

Our assessment is to adapt the existing English sales motion rather than launch a separate UK content operation. Review UK-English spelling, unambiguous dates and GBP commercial examples. Ask buyers about language and procurement needs rather than assuming one preference across England, Scotland, Wales and Northern Ireland. Use a UK-local calendar configuration rather than a permanently fixed UTC offset.

Our assessment is to assign an accountable UK-hours rep before activating a campaign. The handoff should contain the actual contracting account, buying role, source and notice status, approved channel, meeting time zone and any objection. Have the AE confirm success criteria and the next procurement step. Require the CS owner to accept the agreed onboarding milestones, support hours and support language before signature. Carry the quote currency, tax decision and billing contact into finance so an apparent sales-qualified opportunity does not stall on a rewritten order form.

For UK VAT, the B2B general rule places services where the business customer belongs, subject to special rules. HMRC says UK recipients of B2B general-rule services from overseas suppliers generally account through the reverse charge, subject to applicable exceptions. A foreign SaaS seller should establish the service, business status and relevant establishments before deciding treatment. Non-established suppliers making UK-taxable supplies for which reverse charge does not apply can have registration obligations without a registration threshold. Do not treat every UK sale as either domestic VAT or automatic exemption.[9]

Where a UK VAT invoice is required, the general issuance deadline is 30 days from the tax point unless HMRC allows longer. For a UK supply, invoice amounts may be in another currency but total VAT payable must be expressed in sterling. These rules do not make every foreign supplier's commercial invoice a domestic UK VAT invoice. Our assessment is to offer GBP quotes while keeping currency, VAT treatment, legal entity and tax-point handling as separate billing fields.[10][11][9]

Stripe documents Bacs Direct Debit for customers with UK bank accounts, GBP presentment and recurring payments, subject to supported business locations, approval and verification. A mandate is required and confirmation is delayed. Our assessment is to offer it when recurring invoice collection justifies the integration, not to present a mandate submission as settled cash or proof that VAT invoicing is correct.[12]