UK SMS and Email Consent in GoHighLevel: GDPR and PECR Workflow Design

The short answer

UK direct-marketing workflows must apply PECR channel rules together with UK GDPR principles and lawful processing. Record the organization’s approved basis and evidence, distinguish individuals from corporate subscribers where relevant, validate any soft-opt-in conditions, identify the sender, offer simple withdrawal, and maintain suppression across every connected system.

Rules the workflow must represent

Translate the organization’s approved legal position into explicit system behavior.

• Define controller, processors, purpose, recipients, retention, and lawful processing.
• Assess PECR requirements for each channel and recipient type.
• Use specific, informed, freely given consent where consent is relied upon.
• Apply the soft opt-in only when every condition is documented and current.
• Identify the sender and provide an easy unsubscribe or opt-out.
• Honor objection and withdrawal across imports, workflows, and integrations.

Consent ledger

Store channel, status, source, timestamp, disclosure or form version, purpose or list, proof reference, and withdrawal event. Do not overwrite history with one ambiguous yes/no field.

Enrollment gate

Before every communication program, evaluate identity, recipient location where relevant, channel, purpose, relationship, permission, suppression, frequency, and any special category. A tag added by a user is not sufficient proof.

Message controls

Use accurate sender identity, truthful content, required information, an effective withdrawal path, and frequency consistent with the permission and context. Do not treat legitimate interests under data protection law as an automatic permission to send electronic marketing under PECR.

Reply and withdrawal handling

Process automated keywords where relevant but also recognize plain-language withdrawal. Suppress promptly across connected systems and preserve evidence of the request and completion.

Data-subject and customer requests

Create an owned procedure to locate records, verify identity, export, correct, restrict, or delete where required, including connected systems and retained backups. Do not let a marketing user improvise the response.

Audit and monitoring

Sample messages and enrollment evidence, reconcile suppression across systems, monitor complaints and delivery, inspect manual imports, and retain approval and change history. Pause any segment whose evidence cannot be established.

When to obtain legal review

Seek local counsel for bought or old data, inferred permission, sensitive information, automated decision-making, cross-border transfers, minors, regulated services, ambiguous relationship exemptions, or materially changed purposes.