If you’re thinking about sending out a direct mail campaign, then you must understand the postal regulations surrounding direct mail before you send anything out. As a form of marketing, there are strong laws and regulations in place that must be adhered to, especially when it comes to opting out and data protection. We’ve pulled together everything you need to know to understand the postal regulations for direct mail campaigns.
Why are Postal Regulations in Place?
In the UK, postal regulations for direct mail campaigns are in place to protect people’s privacy and to allow them to choose how they wish their data to be used and stored. This isn’t just subject to direct mail, but the entire marketing industry. These regulations give individuals control of their data rather than the companies that hold it, which may seem frustrating for businesses that may hold customer data that cannot be used for direct mail.
However, some laws can work in a company’s favour, by identifying interested prospects from uninterested prospects and sending out their direct mail accordingly, which should result in higher engagement and overall campaign success. By adhering to the rules, you demonstrate respect for customer preferences, which can build trust and ultimately lead to a more positive brand association.
What Happens if You Don’t Comply with Postal Regulations?
If a company doesn’t comply with the postal regulations for direct mail campaigns then they could come under serious implications with the law. Not adhering to privacy laws is a serious offence and companies could induce legal action and heavy fines. Beyond the financial penalties, non-compliance can cause significant and long-lasting reputational damage and the loss of consumer trust, which is often far more costly to a business in the long term.
What Regulations are in Place?
There are several postal regulations in the UK in place for direct mail campaigns, mainly surrounding customer privacy and data protection. We’ll run you through them and how you can make sure you’re compliant.
General Data Protection Regulation (GDPR) - The Legal Basis for Processing
GDPR is a strict privacy law enforced by the European Parliament and the Council of the European Union. It applies to anyone across the globe who deals with the personal data of people residing in the EU or EEA countries. Although it primarily refers to electronic communications such as email marketing, there are rules for direct mail marketing too.
What are the requirements?
GDPR states that all recipients must have a legal basis for processing their data to receive marketing materials. For direct mail, this is most commonly satisfied by demonstrating a ‘legitimate interest’ in the brand. This means marketers do not need to obtain explicit consent from their intended audiences before sending them mail, provided they meet the 'legitimate interest' test. Legitimate interest translates as an individual who has:
- inquired about a product or service in some way
- shown interest via your social media platforms, or
- their buyer persona matches your customer profile
Crucially, the legitimate interest must be balanced against the individual's rights and freedoms. A Legitimate Interest Assessment (LIA) is recommended to justify the mailing.
What is the penalty?
If you violate GDPR or do not follow it correctly, you could incur fines of up to €20 million or 4% of annual global turnover (whichever is higher) for the most serious infringements.
Data Protection Act (DPA), 2018 - The UK's Framework
The DPA is often used alongside GDPR and the UK government refers to the DPA, 2018 as the UK’s implementation of the GDPR. The act outlines all data privacy and protection laws in the UK and under it, everyone responsible for using personal data must follow the strict rules outlined as the ‘data protection principles’. These are strict rules that ensure any data being processed is handled with care and compliance.
What are the requirements?
The data protection principles are:
- Used fairly, legally and transparently
- Only used for specified, explicit purposes
- Used in a relevant way and limited to only what is required (Data Minimisation)
- Is accurate and kept up-to-date (Accuracy)
- Not kept for longer than is necessary (Storage Limitation)
- Handled in a legal and secure way (Integrity and Confidentiality)
For more sensitive information, such as race, ethnic background, religious beliefs, health, political opinions, sex life or orientation, biometrics used for identification, genetics and trade union status, there are stricter laws in place to provide stronger protection. This is known as Special Category Data, and its processing for marketing purposes is exceptionally difficult to justify.
What is the penalty?
If the DPA, 2018 has been seen as breached then fines of up to £17.5 million or up to 4% of an organisation's global turnover (whichever is higher) will be issued.
What about Third Parties?
It’s important to know which third parties you are sharing your customer data with and to ensure they too are adhering to the DPA, 2018 and GDPR in relation to direct mail campaigns. Any data sharing must be covered by a Data Processing Agreement (DPA) that clearly defines the roles (Controller and Processor) and responsibilities of each party. The original data controller remains accountable for the security and compliance of the data, even when it is in the hands of a processor like a mailing house.
Mail Preference Service (MPS) - The Opt-Out Register
The MPS is a free service, first set up in 1983 and funded by the direct mail industry. Its purpose is to enable individuals to have their names and addresses in the UK removed from lists used by the marketing industry. It is therefore a large data file that includes all customers that do not wish to receive unsolicited marketing mail.
Although the DPA, 2018 doesn’t legally require marketers to check their customer or prospect lists against the MPS, the Information Commissioner's Office (ICO) strongly recommends it for best practice. It is always recommended to do so before sending any direct marketing campaigns to avoid sending them to someone who has requested not to receive such mail. If they do receive it, they run the risk of receiving a complaint and facing legal action. Although it may seem frustrating to see your targeted list decrease in size, there is no real point in sending it to someone who has no interest in what you’re sending, as they are not likely to convert or take action.
Best Practice: It is widely accepted within the industry that a mailing list should be screened against the MPS at least every 28 days prior to mailing to ensure compliance and avoid wasted print and postage costs.
Unaddressed Mail
The MPS can prevent the sending of personally addressed direct mail from member companies of the Data & Marketing Association (DMA) as well as reputable companies that send direct mail campaigns, however, they cannot prevent unaddressed mailings which are addressed to ‘The Homeowner’ or ‘The Occupier’. The only way a customer can stop receiving this type of mail is if they contact the sending company directly, so make sure you check your opted-out lists before sending any direct marketing campaign. The opt-out for unaddressed mail is managed separately by the Royal Mail's Door-to-Door Opt-Out Scheme.
Sending unaddressed mail to a household or occupier allows you to adhere to the postal regulations for direct mail campaigns whilst targeting your mailing lists. This is a common strategy for mass reach while remaining compliant with name-based preference services.
How to Ensure You Follow Postal Regulations for Direct Mail Campaigns?
Here are some more ways in which companies can ensure to follow and adhere to the postal regulations for direct mail campaigns.
Allow Recipient to Opt-Out (The Right to Object)
Allowing your recipients to opt out of direct mail communications is advisable to remain compliant, as it is a specific right under GDPR (Article 21). An opt-out process or system should be in place and clearly included in every send-out. Some companies require recipients to send a text message or scan a QR code. The right to object to direct marketing is absolute and must be honoured immediately and free of charge.
Verify Addresses (Data Accuracy)
Before sending out any direct mail campaign, make sure to verify your addresses, especially if you are sending out personal or sensitive information. Data cleansing and PAF (Postcode Address File) validation are essential to maintain data accuracy, as required by the DPA principles. This reduces waste and ensures the mail reaches the intended recipient, which is a key factor in proving responsible data management.
Obtain Consent
Although the postal regulations for direct mail campaigns do not require a company to obtain explicit consent to receive direct mail communications (if Legitimate Interest is used), it is often recommended to still do so to avoid any legal issues or customer complaints. Consent provides the strongest legal basis for processing data. If you collect consent, it must be freely given, specific, informed, and unambiguous.
Follow the Laws Carefully
It’s important to take the postal regulations for direct mail campaigns seriously and properly follow the GDPR and DPA, 2018 laws, taking the necessary data security measures to avoid any legal issues, heavy fines and a damaged brand image. Don’t forget about your third parties! The Information Commissioner’s Office (ICO) provides comprehensive guidance and resources specifically for marketers.
Consider Your Customer’s Preferences (Frequency and Relevancy)
It’s always important to consider your customer’s preferences before sending them any direct mail. The quality of your customer relationship is vital for the success of your organisation and therefore it's important to always consider the nature of the mailers and their frequency. Too frequent a mailing can erode the ‘legitimate interest’ argument and lead to increased opt-outs and complaints.
Creating Compliant Direct Mail Campaigns with DMS
At DMS, we can support you in sending compliant direct mail campaigns that are in line with postal regulations and privacy laws. We specialise in unaddressed and personalised mail and have a range of services to ensure your data is compliant and accurate, such as our Data Processing Service.
We are experts in our field and are trusted by some of the UK's leading brands across multiple industries. Get in touch to get started or for a free quote.