Compliance Basics for Referral & Affiliate Work

Handling someone else's contact details, even to pass on a single enquiry, means you're processing personal data — so UK GDPR applies from day one. Keep it simple: tell people clearly what you'll do with their details (a short privacy notice), record when and how they agreed to be contacted, and screen phone numbers against the Telephone Preference Service (TPS) or Corporate TPS before calling. Keep your own do-not-contact list and honour opt-outs immediately — this isn't optional. If you're promoting a partner's offer, disclose the relationship honestly (e.g. 'I may earn a commission if you sign up'). Store leads securely, limit who can access them, and don't casually forward customer details over WhatsApp or in an unsecured spreadsheet. When in doubt about whether an activity needs specific authorisation — especially anything insurance, finance or credit-related — get specialist legal or compliance advice rather than guessing.