Where a company joins a public market without the issue of any new shares or any marketing of existing shares. Generally this would suit a company which has already raised capital through other means and has a wide shareholder base. Also known as an introduction.

Direct marketing is the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals, such as by email, post, SMS or telephone.

This Practice Note analyses legal and commercial issues arising out of direct marketing activities. It covers the relevant provisions of Assimilated Regulation (EU) 2016/679, the United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426 and the Data (Use and Access) Act 2025 (DUAA 2025), as they apply to direct marketing (including the soft opt-in) such as live and automated telephone calls, unsolicited email marketing, text message marketing and the use of marketing lists. As well as the UK GDPR, PECR 2003 and DUAA 2025, it considers other regulator and sector rules relevant to direct marketing. These include the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code), the Data & Marketing Association’s Code (DMA Code), the Information Commissioner’s Office’s (ICO) detailed guidance on direct marketing and the International Chamber of Commerce’s Advertising and Marketing Communications Code (ICC Code). In relation to the data protection aspects of direct marketing, this Practice Note is based on the law under the UK GDPR, which became applicable

This Practice Note provides practical guidance on direct marketing, in particular how to comply with the United Kingdom General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003). It covers telephone marketing, postal marketing, email marketing and other electronic mail direct marketing. It also explains when you need to screen against the Mailing Preference Service (MPS) or Telephone Preference Service (TPS). This Practice Note reflects ICO direct marketing guidance on service messages, refer-a-friend campaigns, regulatory communications, market research including selling under the guise of research (sugging), tracking pixels, marketing lists, suppression lists and preference centres. The main challenge with direct marketing is piecing together what is permitted under the UK GDPR and PECR 2003. This will vary depending on your marketing activity and target audience. For a quick guide on whether your proposed marketing activities need consent, see: • Direct marketing decision tree—email and other electronic mail marketing—data protection • Direct marketing decision tree—live telephone calls—data protection • Direct marketing decision tree—postal—data protection This Practice Note reflects: • ICO

This Checklist is intended for private sector commercial organisations in the UK. It is intended as a mini self-assessment of your direct marketing systems from a data protection perspective. It reflects the Information Commissioner’s Office (ICO’s) Direct marketing checklist for medium businesses. For each item on the Checklist, further ICO guidance is provided, together with links to relevant LexisNexis® tools and materials. This Checklist is not intended for organisations that make live direct marketing calls about claims management services or pension schemes. ICO expectation Additional ICO guidance and LexisNexis® materials ☐  Define and allocate responsibility for compliance with data protection legislation and Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426 when carrying out direct marketing activities or roles You should clearly allocate responsibility for the oversight of data protection when carrying out direct marketing activities.Where appropriate you should have steering groups to monitor performance in data protection and discuss relevant issues.You should have reporting lines and effective links between key roles to ensure a coordinated approach.You need a targeted programme

This decision tree provides a logical process for determining whether you can engage in email marketing and, if so, to whom. It is equally relevant to text and SMS marketing. There are separate decision trees in relation to postal and live telephone direct marketing—see: Direct marketing decision tree—postal—data protection and Direct marketing decision tree—live telephone calls—data protection. Electronic marketing presents the most complex regulatory challenge of all forms of marketing. You have to comply with the UK General Data Protection Regulation (UK GDPR) plus the Privacy and Electronic Communication Regulations 2003 (PECR 2003). PECR 2003 takes a different approach for different electronic marketing activities, depending on your target audience and the type of goods/services you are promoting. You also have to comply with the applicable requirements of the UK GDPR. For more guidance, see Practice Notes: • Direct marketing compliance—Electronic mail • How to handle personal data for direct marketing, and • Direct marketing—UK GDPR and PECR 2003 interplay What is electronic mail direct marketing? Direct marketing means

This decision tree provides a logical process for determining whether you can engage in live telephone marketing and, if so, to whom. For other types of marketing, see: Direct marketing decision tree—postal—data protection and Direct marketing decision tree—email and other electronic mail marketing—data protection. Direct marketing means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals. Live or automated telephone calls? This decision tree is not suitable for automated calls because the rules on automated calls are far stricter than those relating to live calls. You must not make automated telephone marketing calls to an individual unless they have specifically consented to receive this type of call from you. General consent for marketing, or even consent for live calls, is not enough—it must specifically cover automated calls. There is therefore little point in having a decision tree for automated marketing calls—this decision tree relates exclusively to live marketing calls. See Practice Note: Direct marketing compliance—Automated calls. Claims management services Unsolicited phone calls advertising

This decision tree provides a logical process for determining whether you can engage in postal direct marketing and, if so, to whom. For other types of marketing, see: Direct marketing decision tree—email and other electronic mail marketing—data protection and Direct marketing decision tree—live telephone calls—data protection. Direct marketing means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals. Note 1—personal data and corporate targets Postal marketing to named individuals identified from your customer database will involve processing personal data. The definition of personal data is sufficiently wide to cover business-to-business marketing activities, in particular postal marketing to named individuals in their work capacity: ‘Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural

1 Introduction 1.1 This direct marketing policy is intended for members of staff who are involved in direct marketing activities. It provides high-level guidance on data protection law relating to direct marketing and describes the internal processes we have implemented to ensure we comply with the law. 1.2 Direct marketing is important. It is an essential part of our business activities and can help to grow our business. Direct marketing can also add value to the customer experience, by making people aware of new products and services they may benefit from or giving them opportunities to take part in events or offers. 1.3 However, direct marketing has the potential to cause nuisance to people and in some cases, it can even cause distress. 1.4 We run our business with integrity and in an ethical manner. We are committed to ensuring that our direct marketing activities comply with the data protection regime and are responsible. As well as helping to grow our business, engaging in ethical direct marketing activities will increase trust and confidence in our brand. 2 Responsibility for direct marketing

Like most organisations, you are likely to invest substantial time and effort in your marketing activities, but you must also allocate sufficient resources to ensure compliance with the rules. In short, this involves consideration of the following: • data protection and privacy law, eg the UK General Data Protection Regulation (UK GDPR) and Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003) • consumer protection legislation—see Practice Note: Consumer protection from unfair trading under the Digital Markets, Competition and Consumers Act 2024 • codes of practice, eg Code of Non-broadcast Advertising, Sales Promotion and Direct Marketing (CAP) Code and Direct Marketing Association Code (DMA Code) • other advertising and direct marketing law, where relevant—see Practice Note: Advertising law and regulation Failing to comply with the rules could have serious consequences. As well as exposing your organisation to adverse publicity and reputational damage, you risk regulatory referral by customers and competitors. This, in turn, could result in action being taken by the Information Commissioner’s Office (ICO), Advertising Standards Authority (ASA), the Direct Marketing

This Practice Note provides a high-level summary of the data protection regime applicable to direct marketing activities, in particular how marketing activities may trigger compliance requirements under the Assimilated Regulation (EU) 2016/679, United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426. It is intended for commercial organisations in the UK. More detailed guidance is signposted for each scenario. The main challenge with direct marketing is piecing together what is permitted under the UK GDPR and PECR 2003 and whether you need consent. This will vary depending on your marketing activity and target audience. This Practice Note reflects the following ICO guidance: • Direct marketing guidance • Direct marketing using live calls • Making live marketing calls about claims management services • Making live marketing calls about pension schemes • Direct marketing using electronic mail • Guide to PECR, cookies and similar technologies • Guide to PECR, what counts as consent? This

This Practice Note is intended for private-sector commercial organisations in the UK. It gathers together direct marketing examples provided by the Information Commissioner’s Office (ICO). The sources for these examples include the ICO’s: • Direct marketing guidance • Guidance on direct marketing using live calls • Guidance on direct marketing using electronic mail • Guidance on business-to-business marketing • Guidance on Direct marketing and regulatory communications • Guidance on Lawful basis—Consent The practical examples of direct marketing have been grouped together by theme, such as what constitutes direct marketing, soft opt-in, refer-a-friend campaigns and consent. They cover common direct marketing scenarios. If your proposed direct marketing activity corresponds with one of the examples, you will be able to quickly assess whether your direct marketing is likely to comply with the UK General Data Protection Regulation (UK GDPR), Assimilated Regulation (EU) 2016/679 and Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426. The UK GDPR is the main source of data protection law in the UK—see Practice Note: UK GDPR—the basics.