First-party data strategy for UK marketers: where to start

What to take away

First-party data is data you collect directly from your own audience. Choose the lawful basis before collection, not after.
The UK GDPR sets six lawful bases. Consent and legitimate interests carry most marketing measurement work, and each choice needs a written reason.
Zero-party data, given deliberately by a customer, often gives the cleanest link between a person and a measurement signal.
A customer data platform is a tool. The strategy is the decision list, the data map and the retention rules behind it.
Keep permission logic outside the arithmetic, so no report claims consent it does not hold.

Start with the lawful basis, not the tool

Every processing activity needs a lawful basis, and the ICO expects you to name it and explain why it fits. The six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. The ICO's UK GDPR guidance sets out how to choose and record one.

Six lawful bases compared

Lawful basis

Consent: Cookies, non-essential storage
Contract: Order fulfilment, service delivery
Legal obligation: Tax, fraud, retention duties
Vital interests: Emergency, life-or-death only
Public task: Public authority functions
Legitimate interests: Some direct marketing, soft opt-in

Typical marketing use

Consent
Contract
Legal obligation
Vital interests
Public task
Legitimate interests

Marketing email, cookies and similar storage on a device sit under PECR as well. Most non-essential storage needs consent, whatever basis covers the wider processing. The ICO's direct marketing guidance covers both regimes, including the soft opt-in for existing customers.

The Data Protection Act 2018 supplements the UK GDPR, so the duties apply to server-side collection as well as browser tags.

Collection points are where strategies quietly fail. The checklist on server-side tracking under UK GDPR lists the points to review before a tag goes live.

What counts as first-party data

First-party data is anything you collect through your own channels and hold under your own control. Website and app events, purchase history, email engagement and support records are the usual examples.

Four data types and their fit

Data type

First-party: Your site, app, CRM
Zero-party: The customer, knowingly
Second-party: A named partner
Third-party: A broker or vendor

Collected by

First-party: Consent or legitimate interests
Zero-party: Consent, sometimes contract
Second-party: Inherited from first collection
Third-party: Hard to justify

Lawful basis

First-party: Strong, if record matches
Zero-party: Strong, with refresh date
Second-party: Only with written agreement
Third-party: Avoid

Fit for measurement

First-party
Zero-party
Second-party
Third-party

It differs from second-party data shared by a named partner, and from third-party data bought from a vendor. The collection route decides who answers for the notice, the basis and the deletion.

Data type	Collected by	Typical lawful basis	Fit for measurement
First-party	Your site, app, CRM or email	Consent or legitimate interests	Strong, if the record matches
Zero-party	The customer, knowingly	Consent, sometimes contract	Strong, with a refresh date
Second-party	A named partner	Inherited from the first collection	Only with a written agreement
Third-party	A broker or data vendor	Hard to justify	Avoid

Accountability stays with you even when a vendor holds the records. Your privacy notice has to describe each purpose in plain terms.

Zero-party data earns its place in measurement

Zero-party data is declared on purpose: a preference centre, a post-purchase survey, a sizing quiz, a field a customer fills in because it earns them something.

It works well for measurement because the purpose is explicit and the join key is usually an email address the person chose to give. It also ages quickly, so set a review date.

Do not make a discount conditional on handing over more data than the offer needs. That is where complaints start.

Six steps from a decision list to a tested report

Write the strategy down. This sequence keeps it short enough to finish.

List the decisions the business must make this quarter, and the measurement that would change each one.
Map every source to a purpose and a lawful basis in a single document.
Cut any source you cannot justify keeping.
Pick a join key, usually a hashed customer identifier, and keep raw identifiers out of analytics tools.
Set retention and deletion per source, then check what the systems actually do.
Test one report against that record before adding a second.

Where a CDP fits, and where it does not

A customer data platform can hold identities, apply permission states and push audiences to channels. It cannot choose your lawful basis, and it will not repair a data map nobody wrote.

Budget for the mapping work first. The exercise of building a measurement data flow record turns a flow into something a reviewer can follow, and it usually surfaces gaps before a contract is signed. Ask any shortlisted vendor which fields it joins on, and how it stores permission states.

Common questions

Do I need consent for first-party analytics?

Not always. Consent is one of six bases, and legitimate interests can cover some analytics if you complete and record a balancing test. Cookies and similar device storage still need consent under PECR unless an exception applies.

What is zero-party data?

It is information a person gives you deliberately, such as a stated preference or a survey answer. It differs from first-party data you observe, like page views or purchases.

Can legitimate interests cover marketing email?

Not for new contacts. PECR requires consent for unsolicited electronic marketing to individuals, with a limited soft opt-in for your own existing customers. Keep the two records separate.

How long can we keep first-party data?

Long enough to serve the stated purpose, and no longer. Set a retention period per source, document the deletion method and check that live systems match the policy.