Collecting leads with a digital business card: a plain-English UK GDPR checklist
By Online Business Cards Editorial Team | Published | Updated | Leads, privacy and security
When people leave their details on your digital business card, you are collecting personal data. Here is what UK GDPR and the email marketing rules mean in practice.
A digital business card can do more than share your details — it can collect other people's. Our Business Plan, for example, adds enquiry forms, contact leads, subscribers, a simple CRM and data export. That is useful, but the moment someone leaves their name and email with you, you are handling personal data, and UK data protection law applies.
This is a plain-English checklist for sole traders and small teams in the UK. It is general information, not legal advice. The Information Commissioner's Office (ICO) publishes detailed, free guidance, and rules do change, so check the ICO website for the latest position.
Which rules apply?
Two sets of rules matter most:
- UK GDPR and the Data Protection Act 2018 cover how you collect, use, store and delete personal data.
- The Privacy and Electronic Communications Regulations (PECR) cover electronic marketing — emails, texts and calls you send to promote your business.
1. Only collect what you need
If you just want to send a quote, you probably need a name, an email address and a short message. You do not need a date of birth or a home address. Be especially careful with anything about someone's health, which is special category data; our guide for clinics and health practitioners explains how to keep it off enquiry forms. Keeping your form short is good practice under the law (data minimisation) and gets more people to fill it in.
2. Know your lawful basis
UK GDPR lists six lawful bases for using personal data. For a digital business card, two come up most:
- Legitimate interests — for example, replying to someone who has asked you a question or requested a quote. They would reasonably expect you to use their details for that.
- Consent — needed for most marketing emails to individuals (see below). Consent must be a clear, positive action, such as ticking an unticked box.
3. Tell people what you will do with their details
Add a short line next to your form, such as: "We will use your details to reply to your enquiry. See our privacy notice." Link to a privacy notice that explains who you are, what you collect, why, how long you keep it and how people can contact you. The ICO has templates you can adapt.
4. Get marketing consent separately
Replying to an enquiry is not the same as adding someone to your newsletter. Under PECR, marketing emails and texts to individuals generally need their consent. If you want to send updates, add a separate, unticked box: "Send me occasional updates by email." Keep a record of who agreed and when.
There is a limited exception, often called the soft opt-in: you may email people whose details you collected during a sale or negotiations for a sale, about your own similar products or services, as long as you gave them a clear chance to opt out when you collected their details and in every message since. If in doubt, ask for consent — it is simpler.
5. Make it easy to stop
Every marketing email should include a simple way to unsubscribe, and you should act on it promptly. If you export your subscribers into an email tool, carry the opt-outs across as well.
6. Keep the data safe and tidy
- Use strong, unique passwords and two-step sign-in on the accounts that hold your leads.
- Limit who on your team can see and export contact data.
- If you export leads to a spreadsheet, store it somewhere secure and delete copies you no longer need.
- Decide how long you will keep enquiries that never became work, and delete them after that.
7. Respect people's rights
People can ask what data you hold about them, ask you to correct it, or ask you to delete it. You normally have one month to respond. Having all your leads in one place, with an export option, makes these requests much easier to handle.
8. Check whether you need to pay the data protection fee
Most organisations and sole traders that process personal data must pay an annual data protection fee to the ICO, unless they are exempt. The ICO website has a short self-assessment that tells you whether you need to pay.
Quick checklist
- Form asks only for what you need
- You know your lawful basis for each use
- A short privacy line and a link to your privacy notice sit by the form
- Marketing consent is a separate, unticked box
- Every marketing email has an unsubscribe link
- Accounts holding leads are protected and access is limited
- Old enquiries are deleted on a schedule
- You know how to answer an access or deletion request
- You have checked whether you need to pay the ICO fee
Which lawful basis fits which use?
What you do with the details | Usual lawful basis | Do you need consent?
Reply to an enquiry they sent | Legitimate interests or steps before a contract | No
Book them in for an appointment | Contract | No
Send marketing emails | Consent (PECR rules apply too) | Yes
Keep records for tax or accounts | Legal obligation | No
The ICO's guide to lawful bases explains each one in full.
Read next: What to put on a digital business card and Six ways to share a digital business card, and when each one works best. You can also browse all our guides, or see how an online business card that collects reviews and leads works.
Frequently asked questions
Do I need consent to reply to someone who filled in my enquiry form?
Generally not. Replying to a request someone has made is normally covered by legitimate interests, because they expect a reply. You do need consent for most marketing emails sent to them afterwards.
Can I add everyone who scans my QR code to my mailing list?
No. Scanning your code or viewing your profile is not consent to marketing. Only add people who have actively agreed to receive marketing, or who fall within the soft opt-in.
Does UK GDPR apply to sole traders?
Yes. UK GDPR applies to anyone handling personal data for business purposes, including sole traders and freelancers. Purely personal or household use is exempt, but business contacts are not.
Where can I get reliable guidance?
The Information Commissioner's Office (ico.org.uk) publishes free guidance for small businesses, including privacy notice templates and a helpline. For advice on your specific situation, speak to a qualified adviser.
Do I need consent to reply to an enquiry?
Usually not. Replying to someone who asked you a question is normally covered by legitimate interests or steps before a contract. You do need separate consent before adding them to marketing emails.