Keep the evidence.
Respect the choice.
Keep a retrievable record of the signup action, link it to the wording in use and maintain the latest preference. Use an organised evidence trail so your team can investigate questions and review whether a campaign fits the permission recorded.
What does a consent record need to prove?
A useful record connects a person’s action with the information they saw. The ICO identifies who, when, what they were told, how they agreed and any withdrawal as key evidence. Keep the matching form or script and privacy-information version. A tick against a name or a link to today’s form cannot reconstruct that history. ICO guidance on recording consent.
This guide addresses records where you rely on consent. PECR treatment depends on subscriber type and whether a message was requested. Unsolicited marketing to individual subscribers needs consent or an applicable soft opt-in. Corporate subscriber rules differ, and data protection duties still matter when personal data is used. Record your actual route rather than labelling every contact “consented”. ICO electronic mail marketing rules.
How can you organise the evidence?
Our suggested working structure below is an original administrative example. Adapt it to your systems and have your data-protection adviser check it.
| Field | Example entry |
|---|---|
| Record identifier | TRAIN-0042, linked to the relevant subscriber |
| Capture event | 12 November 2026, 09:12 UTC, training newsletter signup form |
| Request version | Training email request v3, archived alongside privacy notice v5 |
| Recorded action | Optional email checkbox selected and form submitted |
| Evidence location | Restricted consent archive, TRAIN-0042 event record |
| Current status | Review actual events, including any withdrawal, before use |
| Owner | Named marketing operations owner, with backup reviewer |
The identifiers are invented and contain no customer data. In a real implementation, choose identifiers that let authorised colleagues find the evidence without distributing unnecessary personal information. The date and timezone convention should be consistent across the capture form, evidence store and sending workflow.
Keep the words alongside the event
Create an archive entry whenever a signup request changes. For the example company, “training newsletter v3” should resolve to a dated snapshot, not a mutable web page. A colleague investigating a question six months later should be able to retrieve the version without guessing which design was live.
Separate status from history
Our proposed design uses an event history for what happened and a current status for day-to-day use. A single editable “yes” field loses context when someone changes it. Choose a controlled change process and document which system takes priority when records disagree.
What happens when someone withdraws consent?
The ICO says withdrawal should be as easy as giving consent, and consent-based processing should stop as soon as possible. Relevant suppression records may be retained on another appropriate basis to prevent further marketing, with suitable transparency. ICO withdrawal guidance.
For the training-company example, map every route by which a preference can change, including an unsubscribe link and a message to the support team. Assign an owner to carry the update through any separate CRM, exports and campaign tools. Rehearse with a fictional test contact, then check that an old export cannot accidentally restore that contact to the send audience.
What if evidence is missing?
Place an uncertain record into a review queue and ask the owner to locate the original evidence. Treat missing evidence as an unresolved decision. An import date describes an import, so it should not be presented as the signup date. Before contacting anyone to ask for fresh permission, check whether that message itself would be electronic marketing under the applicable rules.
How long should records be kept?
The ICO says retain consent evidence while processing relies on it. Review whether the consent still fits the purpose and context. ICO consent management guidance.
Direct marketing has no single universal retention period. Set justified periods and review them, considering accuracy and whether information is still needed. ICO guidance on planning direct marketing and retention.
In your operating procedure, distinguish active subscriber evidence, withdrawn preferences and obsolete draft forms. Give each record class a purpose, owner and review trigger. Have the reviewer assess how suppression, complaint handling, backups and deletion interact before setting the final policy.
How can Email Blaster fit into the process?
We recommend trying Email Blaster if you want to organise campaigns with UK software and friendly real-person UK support. Explore our email marketing software, subscribe forms and GDPR and email marketing guide, then ask our team how your capture and evidence workflow fits your account. Keep your evidence archive retrievable alongside your campaign process.
Monthly accounts include all software features as standard. Your sending allowance determines the plan and VAT is added where applicable. Check current pricing or open a free account. Email Blaster publishes this guide and supplies the software.