Is your lead score profiling? UK rules for small teams

Short answer: Under UK GDPR a lead score is profiling. That is lawful if you have a lawful basis, score fairly and explain it in your privacy notice. The hard rule is that anyone who objects to direct marketing must be taken out of marketing processing, score included, with no exceptions. Ranking who you call back first is, in our reading, unlikely to be a “significant decision”, so the new automated decision rules rarely bite, but keep a person looking at the list.

A lot of lead scoring advice starts with which tool to buy. In the UK we think the first question is different: what are you allowed to do with the data, and what do you owe the people in it? This guide sits under our wider UK guide to AI lead generation, and it is for small teams who want to rank enquiries without creating a compliance problem. It is not legal advice, so check anything specific to you with a qualified adviser.

Why a UK lead score counts as profiling

The ICO defines profiling as analysing, evaluating or predicting aspects of someone’s personality, behaviour, characteristics, interests and habits. Its guidance on automated decision-making and profiling (draft, updated 31 March 2026 for the Data (Use and Access) Act) also says organisations may use people’s online and offline buying habits as input.

A lead score does that. You take what you know about an enquirer, weigh it, and produce a prediction: this one is likely to buy, that one is not. It makes no difference whether the weighing is done by a machine learning model or by a column of points in a spreadsheet. If the output is a prediction about a person, it is profiling.

The ICO’s direct marketing guidance on generating leads adds three points that matter for a small team. Profiling often involves predictions or assumptions about people. You must make sure it is fair. And you must have a data protection reason, a lawful basis, for doing it.

None of this means you should stop scoring. It means a score is something you can justify, not something you bolt on and forget.

Your lawful basis, and what the 2025 Act changed

You need a lawful basis for profiling, as the ICO’s lead generation guidance puts it. For a small firm scoring its own enquiries, our view is that legitimate interests is the usual route. Consent is awkward here, because it has to be freely given and can be withdrawn, and you would be asking people to agree to being ranked.

The Data (Use and Access) Act 2025 made a change that is worth knowing. Section 70, in force from 5 February 2026, adds to Article 6 UK GDPR that examples of processing which “may be” necessary for a legitimate interest include processing necessary for the purposes of direct marketing. The Act also created a separate category called “recognised legitimate interests” (Article 6(1)(ea)), which applies only where a listed condition is met.

Read that wording carefully. It says “may be”, and it is an example, not an exemption. In our reading, direct marketing is now named as something that can count as a legitimate interest, but the balancing test is still there: you weigh your interest against the effect on the person, and you need to be able to show your working. Scoring is part of that exercise, so write down in a sentence or two why your scoring is proportionate.

Special category data is different. The ICO says that if you profile using it, you are likely to need explicit consent. For a lead score the easiest answer is to keep that data out of it completely, which we come back to below.

This section and the next are general information, not legal advice.

One objection takes a lead out of the score

This is the rule to build your process around. The ICO’s guidance on the right to object says that for direct marketing, “This is an absolute right and there are no exemptions or grounds for you to refuse.” It includes any profiling of data that is related to direct marketing.

So if someone tells you to stop marketing to them, the score has to go too, and you cannot argue that the score is internal or harmless. You have to stop processing for that purpose without undue delay and at the latest within one month of receiving the objection. The page also notes the guidance is under review because of the Data (Use and Access) Act, so check it periodically.

The ICO says this does not automatically mean erasure, and that suppression is usually preferable. That matters in practice, because if you delete the record entirely, nothing stops the same person being re-imported next month from a form or a list and scored again.

Here is a simple way to do it in a CRM:

• Add a field called something like “Marketing objection” with a date.
• When it is set, a rule zeroes or removes the score and sets the lead’s stage to a suppressed status.
• The same flag blocks every marketing automation, so nothing sends and nothing is ranked.
• Keep the record with the flag. You are keeping a note that says do not process for marketing, not their interest in your services.
• Make one person responsible for checking replies and unsubscribe requests daily, so the one-month limit is an outer boundary and not your target.

If an objection reaches you by phone or in a reply to a quote, someone has to type it into the flag. The system only works if the human step happens.

What your privacy notice has to say before you score

The ICO’s lead generation guidance says you must tell people about your profiling and clearly explain what you will be doing. That includes the case where you use third parties or public sources to expand the profile. A notice that says nothing about scoring, or buries it in a general line about “improving our services”, will not meet that.

In our view, the sentence does not need to be long. Here is an example a small firm could adapt. It is an illustration of plain wording, not legal wording, and you should have your own notice checked:

“When you send us an enquiry, we may rank it using information you give us and how you interact with us, such as whether you reply to a quote or ask for a visit, so that we can respond to the enquiries we are most able to help first. You can object to this, and to our marketing, at any time by contacting us, and we will stop.”

Three habits make the notice work. Put it where people actually see it, such as near the enquiry form, as well as in the full notice. Describe what the score is used for, in ordinary words. And if you add an input later, such as enriched company data, update the notice before you start using it, not after.

The follow-up email or SMS you send once someone is scored is covered by a separate set of rules, PECR, which we cover in our guide to PECR compliance for email and SMS marketing.

Points worth giving a UK enquiry

Here is our view on a starting score for a small service firm. It uses only things the firm already holds from the enquiry itself, so it is easy to explain to the person scored. The points are illustrative. Change them to match what actually predicts a sale in your own records.

Signal	Points	Why
Replied to the quote	20	Replying is the clearest sign of interest you will get
Asked for a site visit	20	Costs them time, so it signals intent
Rang or replied within two days	10	A quick response suggests an active project
Job is within the area you serve	15	Out-of-area work usually costs more than it earns
Job size meets your minimum	15	Saves quoting for work you would turn down
Gave a phone number as well as an email	5	Easier to reach, so easier to help
Enquiry mentions a timeframe	5	A date suggests a real project
No reply to the quote after a week	-10	Interest has probably moved on

Add the points, set a line, and call everything above it first. That is the whole system, and it runs in a spreadsheet or in any CRM that lets you set rules.

Keep the signals about the job and the person’s actions, not about the person. Every row above is something the enquirer did or something about the work.

Signals that make a score unfair

The ICO says profiling must be fair. In our view, a score becomes unfair when it uses a signal the person would not expect, or one that stands in for who they are.

• Special category data. Anything that reveals ethnicity, health, religion and similar matters. The ICO says you are likely to need explicit consent to use it for profiling, so the practical answer is to leave it out.
• Proxies for it. A first or last name used as a stand-in for ethnicity. A health mention in an enquiry turned into a lower score. In our view these can amount to special category data by another route, and we would treat them the same way.
• Data from third parties or public sources the person would not expect. The ICO says people are unlikely to anticipate you seeking to learn more about them, and that any such use has to be explained in your notice. If you cannot say it plainly in the notice, do not do it.
• Scraping social profiles. Looking someone up on social media to adjust their score fails the expectation test, in our view. They gave you an enquiry, not their feed.
• Age. In our view, age works as a shortcut for assumptions about what someone can afford or wants, and it is hard to defend as a fair signal.

A good test is whether you could explain the signal to the person being scored without them being surprised. If the answer is no, leave it out.

Is ranking your call list a significant decision?

This is where the new law comes in. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 UK GDPR with Articles 22A to 22D. They came into force on 5 February 2026 under SI 2026/82, regulation 2(j).

The structure is as follows:

• Article 22A sets the definitions. A decision is based solely on automated processing where there is “no meaningful human involvement”, and in judging that, you must consider the extent to which the decision is reached by profiling. A significant decision is one that produces a legal effect or a similarly significant effect for the person.
• Article 22B restricts the use of special category data. A significant decision based entirely or partly on it cannot be solely automated unless it rests on explicit consent, or it is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) is also met. It also bars any solely automated significant decision from relying on the new “recognised legitimate interests” basis in Article 6(1)(ea).
• Article 22C says that where a significant decision is solely automated, the controller must have safeguards: (a) give the person information about such decisions, (b) let them make representations, (c) let them obtain human intervention, and (d) let them contest the decision.

The ICO’s own example of the clear case is an insurer that turns a driver classification into a risk score and bases the premium on it with no meaningful human involvement. That is automated decision-making. By contrast, the ICO says using generative AI to summarise a meeting is unlikely to have a legal or similarly significant effect.

Our reading is that deciding which enquiry to ring first sits much nearer the meeting summary than the insurance premium. Nobody is refused a service because they were fifth on a list. So we think the Article 22A to 22D rules rarely bite on call order.

The picture changes if the score does more than order a list. If it silently refuses service, for example by auto-rejecting enquiries below a threshold with no human looking at them, it moves closer to a significant decision, and the 22C safeguards would then apply. Our advice is to avoid building that. Use the score to decide who is called first, and keep a person reviewing the list, including the ones below the line. That is both the safest design and the one that works best commercially, because low scorers sometimes turn out to be good jobs.

This is general information, not legal advice.

A hypothetical: a three-person kitchen fitter in Leeds

To make this concrete, here is a hypothetical, not a real client. A kitchen fitting firm in Leeds has three people and receives roughly 30 enquiries a week. That figure belongs to the example.

The owner sets up the points table above in the CRM. Each Monday the new enquiries are scored from what is already in the record: whether the job is in the area the firm covers, whether it meets the minimum job size, and whether the person has replied to the quote or asked for a site visit. The owner calls everyone above the line first, then reads through the list underneath, so no enquiry is turned away by the score alone.

One enquirer replies to a quote email saying they do not want any more marketing. The owner ticks the “Marketing objection” field. A rule zeroes the score and stops the follow-up automations. The record stays, with the flag, so the firm does not message them again by accident. The owner checks that this was done the same day, well inside the one-month limit.

The firm also adds a sentence to the enquiry form and its privacy notice, along the lines of the example earlier, saying that enquiries are ranked using what people tell the firm and how they respond to it, and that people can object at any time.

That is the whole build. It uses data the firm already holds, and in our estimate it is an afternoon’s work. We report no outcomes, because this is an illustration, not a client.

When the AI version is worth paying for

Start with points. Move to AI scoring only when you have enough closed and lost enquiries for a model to learn from. Before that, it has nothing reliable to find.

The tools show where the line sits. HubSpot’s knowledge base on understanding the lead scoring tool (updated 2 September 2026) says lead scoring is available with Marketing Hub or Sales Hub Professional or Enterprise. Contact scores are Marketing Hub only and deal scores are Sales Hub only, and scores can combine engagement (what someone did) with fit (who they are). Its page on building lead scores with AI says AI-built scores need Marketing Hub Enterprise and a sample of at least 50 contacts, 25 converted and 25 not converted.

Other CRMs cap you differently. Zoho’s developer documentation on scoring rules says the Standard edition allows one active rule per module with up to 10 criteria, while the Ultimate edition allows 40 rules with up to 50 criteria each.

Our view is that most small teams will get what they need from the rules their CRM already offers. A model is only worth paying for once you can name the 50 or so past enquiries it would learn from and trust that they were recorded consistently. Plans and limits change, so check each vendor’s pricing page before you commit. If you do move to AI scoring, everything above still applies: the objection flag, the privacy notice, and the human review of the list. For tool options, see our comparison of the best AI lead generation tools for UK businesses, and if enquiries arrive through a chat widget, our guide to AI chatbots for lead capture covers what to watch there. If you want help wiring a points score and a suppression rule into your CRM, that is the sort of build our AI automation service covers.

Not sure where your enquiry process stands? Request a free audit and we will look at how your leads are captured, ranked and followed up.

Frequently asked questions

Is lead scoring profiling under UK GDPR?

Yes. The ICO describes profiling as analysing, evaluating or predicting aspects of someone’s behaviour, characteristics, interests and habits. A score that predicts how likely an enquiry is to buy does exactly that, even if it is only a few points in a spreadsheet. It is allowed, but it needs a lawful basis, fairness and a clear explanation to the people scored. This is general information, not legal advice.

Do I need consent to score leads in the UK?

Not necessarily. The ICO says you must have a lawful basis for profiling, and the 2025 Act names direct marketing as an example of processing that may be necessary for a legitimate interest. In our view, a small firm will usually rely on legitimate interests, with a balancing test. The ICO says special category data is likely to need explicit consent. This is general information, not legal advice.

What happens to a lead’s score if they object to marketing?

They come out of it. The ICO calls the right to object to direct marketing absolute, with no exemptions, and says it includes any profiling related to direct marketing. You must stop that processing without undue delay and within one month at the latest. Suppression is usually better than deleting the record, because it lets you remember not to contact them. This is general information, not legal advice.

Does UK GDPR stop me from automating lead scoring?

Not in itself. The automated decision rules, Articles 22A to 22D, apply to solely automated decisions with a legal or similarly significant effect. In our reading, deciding whom to call first rarely reaches that bar, but automatically rejecting enquiries with no human look moves closer to it. Keeping a person reviewing the list is the simple safeguard. This is general information, not legal advice.

Do I have to mention lead scoring in my privacy notice?

Yes, in our reading of the ICO’s direct marketing guidance. It says you must tell people about your profiling and explain clearly what you will do, including where you use third parties or public sources to expand the profile. A short, plain sentence in the notice that says you rank enquiries using how people interact with you is a sensible start. This is general information, not legal advice.

Can I use bought or enriched data in a UK lead score?

You can, but it is the riskiest input. The ICO says people are unlikely to anticipate you seeking to learn more about them, and that using third parties or public sources has to be explained to them. In our view, a small team is safer scoring only what the enquirer told it or did with it. This is general information, not legal advice.