Audience research
Leeds and Sheffield customer data platform work in finance, health and manufacturing
Customer data platform work in Leeds and Sheffield spans building societies, NHS trusts and manufacturers, all constrained by UK consent rules.
What to take away
- Consent design, not platform choice, sets the shape of customer data platform work in Leeds and Sheffield.
- Building societies need consent state per person, because joint holders and broker leads rarely match.
- NHS trusts may segment for care messages; promotion needs its own basis and the national data opt-out.
- Sheffield manufacturers still handle personal data for named contacts; only true corporate subscribers fall outside PECR email consent.
- Controller and processor roles decide who may build segments when an agency or platform supplier does the work.
Consent state is the first design decision
In both cities the pattern is alike. A customer data platform records what each person agreed to, for which purpose, and when permission lapses.
The privacy review mapping shows how that consent record feeds a review without fixing a lawful basis early.
The ICO's consent guidance sets the bar: consent must be freely given, specific, informed and unambiguous.
Local teams inherit a patchwork: paper branch consent, app consent from a later redesign, broker records. Flattening those into one flag loses the distinction that matters.
Segments are queries over consent state, behaviour and product holding. The platform must enforce consent at send time, not at build time.
When an agency builds segments for a Leeds lender, the lender is controller and the agency processor. The ICO's controllers and processors guidance explains the contract that limits the agency's own use of the data.
Example: three consent states on one joint mortgage account
A joint mortgage account shows why account-level flags fail. This illustrative model is not a named firm's practice.
Three consent states on one joint mortgage account
- Hold consent per person, not per account, so one holder's opt-in does not carry the other.
- Record the source of each permissionbranch form, mobile app or broker lead.
- Label service messages separately from promotion, with a basis for each.
- Check consent state at send time, so a withdrawal stops the next message.
A savings maturity or fixed-rate ending justifies a service contact; promoting a different product off it needs its own basis.
Teams can compare platform options against these duties using financial services considerations for UK lenders.
NHS trusts: care purposes and the opt-out
Leeds Teaching Hospitals NHS Trust and Sheffield Teaching Hospitals NHS Foundation Trust run patient records and appointment systems at scale. A platform here is a patient engagement tool, not a marketing one.
Care rests on public task, with consent reserved for optional messages. The duty of confidence means information given for treatment cannot be reused without a lawful route.
The national data opt-out lets patients refuse secondary uses for research and planning. Segments must honour those flags before any list is built.
B2B marketing rules for Sheffield manufacturers
Sheffield's manufacturing base, from Sheffield Forgemasters to small precision firms, sells to businesses rather than consumers. Data protection still applies, but the rules change.
The ICO's business-to-business marketing guidance sets out the split. Corporate subscribers get some PECR email exemption, while sole traders and some partnerships count as individuals under UK GDPR.
Each contact needs a basis: consent, legitimate interests with a documented test, or an existing customer relationship. A bought list rarely survives, because the original basis is unknown.
The soft opt-in for email to individuals is narrow, so named contacts usually need consent or a documented assessment.
Named employers and the basis in play
Leeds employers include Leeds Building Society, Leeds Teaching Hospitals NHS Trust, First Direct and Asda; Sheffield's include Sheffield Teaching Hospitals NHS Foundation Trust, Sheffield Forgemasters and AESSEAL.
| Employer | Location | Sector | Basis commonly relied on |
|---|---|---|---|
| Leeds Building Society | Leeds | Finance | Consent for marketing; contract for servicing |
| Leeds Teaching Hospitals NHS Trust | Leeds | Health | Public task for care; consent for optional messages |
| Sheffield Teaching Hospitals NHS Foundation Trust | Sheffield | Health | Public task for care; opt-out respected |
| Sheffield Forgemasters | Sheffield | Manufacturing | Legitimate interests on named contacts |
| Gripple | Sheffield | Manufacturing | Legitimate interests; consent for some email |
The basis column describes sector practice, not a published statement by the employer named.
For Leeds and Sheffield buyers, named CDP platform options in these sectors include Salesforce Data Cloud, Adobe Real-Time CDP, Twilio Segment, Tealium AudienceStream, Microsoft Dynamics 365 Customer Insights and Treasure Data. Typical UK annual licence ranges are £60,000 to £250,000, implementation £25,000 to £120,000 and rollout 8 to 16 weeks.
In finance, consent-aware segmentation projects typically run 12 to 20 weeks. In health, NHS trusts assess platforms against the Digital Technology Assessment Criteria (DTAC). In manufacturing, B2B contact platforms typically start with 10,000 to 50,000 named records.
The functions that need an owner differ across financial services, health and manufacturing, so one template rarely transfers.
Local evidence on outcomes is thin: few employers publish what consent-aware segmentation changed for response rates or complaint volumes.
Common questions
Can one consent flag cover a joint account?
Consent belongs to the person, not the account, so the non-consenting holder must be excluded from promotional contact.
Can a manufacturer email a named engineer without consent?
Usually only under the narrow soft opt-in, or with a documented legitimate-interests assessment.
Who is controller when an agency builds the segments?
The client is normally controller and the agency processor, under a written contract.
Is there local benchmark data on segmentation performance?
Not in the public domain at useful granularity; employers describe consent practice more readily than campaign outcomes.
