Marketing an EAP Without Breaking GDPR or Losing Trust

September 15, 2026

Two problems stacked on top of each other

You are selling a service that only works if people trust it enough to use it, and you are selling it inside one of the most tightly regulated corners of UK advertising.

Most B2B marketing has one job: convince a buyer you are competent. EAP marketing has two audiences with different needs. The HR director signing the contract wants proof of ROI and risk management. The employee who might actually call your helpline at 11pm wants proof that nobody at their company will ever find out. Get the second part wrong and your utilisation numbers, and your renewal, suffer regardless of how good the first pitch was.

Layered on top of that is the compliance side. Special category health data under UK GDPR, PECR consent rules for email and SMS, the ASA's CAP Code restrictions on health claims and advertising to vulnerable people, safeguarding obligations around any content that touches crisis or self-harm. None of this is optional, and none of it is designed with marketers in mind.

The market itself is not standing still while you work this out. EAPA UK put the market at £118 million in 2023, up from £32 million in 2003, and its 2024 report puts it at £182 million. Growth attracts competitors. Trust and compliance, done well, are how you win the enquiries that growth creates.

The same programme has to answer two very different questions at once: what is the ROI, and will anyone find out.

What is your prospective client actually afraid of?

Not the service. The paper trail.

Employees worry that using an EAP will somehow reach their manager, even when it will not. That fear is one of the documented barriers to EAP use in the UK, alongside stigma and a straightforward fear of career consequences. It shows up in the numbers: UK usage has crept up to 12% in 2022, from 11.4% the year before, and roughly 10% for years before that. Most of the workforce your client pays to cover never picks up the phone.

The buyer and the user are different people with different questions. The employer wants evidence of reduced absence and lower risk. The employee wants a straight answer to one question: can anyone at work see this? Employees frequently fear that their line manager or HR will find out they have used the service at all, regardless of what the contract actually says about confidentiality.

That gap between what the contract promises and what the employee believes is where your marketing has to work hardest, and it is also where the CAP Code and GDPR start applying real pressure.

Four rules that govern what you can say and how you can say it

Rule one: mental health data is special category data. Anything an employee tells you about their mental state, and any note your counsellors keep, is personal data related to a person's physical or mental health, which sits under UK GDPR's stricter rules. For this data, you need both an ordinary lawful basis and one of the Article 9 conditions such as explicit consent or health/social care provision. Note that the ICO's own guidance here is currently marked under review following the Data (Use and Access) Act, so check for updates before you finalise anything.

Rule two: consent governs your email and SMS marketing. Under PECR, marketing to individual employees generally needs prior consent, unless the soft opt-in exemption applies: the contact came from an existing sale, the marketing covers similar services, and every message offers an easy opt-out. This exemption does not apply to corporate subscribers, where the rules differ.

Rule three: health claims need evidence, not confidence. The CAP Code requires documentary evidence for any objective health claim. Say "supports wellbeing" and you're on safe ground. Say "reduces anxiety" or "prevents burnout" and the ASA will expect clinical evidence to back it, with some serious conditions requiring supervision by a qualified professional before you can advertise treatment at all.

Rule four: safeguarding shapes anything crisis-adjacent. Content touching self-harm or crisis support should follow the same principle NHS guidance applies to information sharing: necessary, proportionate, relevant, accurate, timely, secure. That applies to blog posts and social captions just as much as to case files.

Four rules, stamped plainly: know your legal basis, get real consent, prove your claims, and handle crisis content with care.

What to publish when you can't publish testimonials in the usual way

Start with FAQ pages built around the questions employees actually search, not the ones you'd like them to ask. "Will my manager find out I used the EAP?" and "Does HR see what I talk about in counselling?" get real search volume, and answering them plainly does two jobs at once: it ranks, and it addresses the confidentiality fear head-on before anyone books a session. Structure each page as a single question, a direct two-sentence answer, then supporting detail. Skip the marketing preamble.

Case studies need composite construction, not creative writing. Human Givens Institute guidance on writing case histories allows combining several similar cases into one, with names, occupations, locations and other identifying details changed or omitted to reduce re-identification risk. NHS Lothian's guidance on educational case studies takes the same approach: aggregate across patients or use composite information rather than describing one identifiable person. Practically, that means your "Sarah, 34, marketing manager" case study should draw on patterns from a dozen anonymised cases, not one real client, and should say so.

A trustworthy case study is never one person's story, it is a blend of many, drawn so no single patient can be recognised.

Testimonials are riskier than they look. The CAP Code treats a testimonial implying relief from a condition as a health claim, meaning it needs the same evidence standard as any other claim, and the ASA has been clear that testimonials alone don't substantiate efficacy. If you use them, keep language to service quality and experience, not symptom outcomes, and retain written permission on file.

For HR buyers, an educational buyer's guide covering EAP formats, procurement steps and confidentiality safeguards does the SEO and trust-building work simultaneously, following the model used in Spill's EAP buyer guide and the UK EAPA's own buyer's guide.

What happens when your best-converting audience is also your riskiest data set?

Email to HR buyers can usually rely on the corporate-subscriber exemption under PECR: marketing to a named contact at a limited company or LLP doesn't require the same consent as marketing to an individual. Sole traders and some partnerships still need consent or a valid soft opt-in. Either way, every email needs a clear sender identity and a working opt-out, not just a tucked-away unsubscribe link buried in the footer.

Paid search and paid social carry the sharper risk. Meta has been tightening rules on health and wellness advertisers since early 2025, restricting the use of Business Tools that could share medical conditions, health status or provider-patient relationships. In practice: don't build custom audiences from anyone who visited a "burnout support" landing page, and don't write ad copy that implies you know the viewer's mental state. Broader, non-sensitive targeting (job title, industry, company size) is the safer route on Meta.

Google treats physical and mental health as sensitive-interest content for personalised ads, meaning advertiser-built audiences based on inferred health status aren't usable. Generic service promotion and Google's own predefined categories may still work; remarketing based on visits to crisis-adjacent pages generally won't.

Organic social is lower risk but not risk-free. Posts about workplace stress or wellbeing statistics are fine; posts implying a viewer's own condition, or inviting public comments about personal mental health, aren't.

What a compliant funnel is actually worth

This is a hypothetical worked example, not a client result.

Take a mid-market employer with 300 employees. A standard corporate EAP contract runs £8 to £25 per employee per year, averaging around £14. That single contract is worth roughly £4,200 a year, and EAP contracts typically renew annually, so a three-year relationship is worth closer to £12,600.

Now the funnel. A landing page built around clear, non-alarmist content converts visitors to enquiries at 3% to 5%. Professional-services enquiries convert to proposals at 30% to 50%, and proposals close at 40% to 60%. Chain those stages and enquiry-to-contract lands between 12% and 30%.

So 1,000 monthly visitors to a compliant, well-written page might produce 30 to 50 enquiries. At even the low end of conversion, that's 4 to 15 signed contracts a year, worth roughly £17,000 to £63,000 in first-year revenue from one funnel.

A single compliant funnel, run at conservative conversion rates, can still turn a thousand monthly visitors into tens of thousands of pounds in first-year contracts.

A checklist to run before anything goes live

Confirm your lawful basis before collecting any health-related data, and check consent covers marketing, not just service delivery.
Get explicit opt-in for email and SMS marketing under PECR. Soft opt-in only applies to your own existing customers.
Route any treatment or outcome claim past someone who knows the ASA's mental health advertising guidance.
Anonymise case studies properly. Composite details, not just changed names.
Keep ad targeting broad (job title, sector, company size), never inferred mental state.
Write for the HR buyer and the anxious employee in the same piece, separately if needed.

None of this slows growth down. It filters out the competitors who can't be bothered to do it properly.