Old EU SCCs as modified by the ICO, they’ve done the work on that: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/sccs-after-transition-period/

The new thing will be called an International Data Transfer Agreement (IDTA) and the consultation just closed.

I must unfortunately dissent from the view of DPOandCyber.

If you are the *receiver* of the personal data, then *you* are responsible for providing privacy information under Art. 14.

Depending on what it’s for, you may need to provide this information as soon as you use the data, or within one month of receipt.

The warranty from the *sender* of the data subjects’ consent is of more relevance in the due diligence stage than operationally.

Rule of thumb – whenever you get personal data other than as a processor, you need to provide a privacy notice. The way you do this can be quite creative and depends on the circumstances. I find many examples of professionals getting this wrong.

OP – I would argue you are in fact engaged in a controller-to-controller transfer, as you are not determining the purposes and means of processing prior to the leads being given to you.

The marketing co are sharing data with you, but from that point, is it yours to do as you please with? As in, once you get a lead you’re paying a fee for it, and it’s up to you to convert that into a sale? If so, there’s a clear line in the sand between their and your responsibilities. Theirs end when they transfer data to you, yours begin when you receive it. This is very ordinary in a controller-to-controller transfer.

While I’m grateful for DP-Pro’s willingness to post an answer, I don’t feel they have satisfied the OP’s query: what is the difference between soft opt-in and legitimate interest?
Under the [UK] GDPR, processing must be lawful, which is to say, it must be covered by one of the lawful bases in Article 6. The legitimate interests of the controller or a third party is the sixth such basis (Art. 6(1)(f)). Consent is the first.
When an organisation’s (or a third party’s) interests, often commercial, are both legitimate (not unlawful, false or deceptive) and compatible with individuals’ rights and freedoms, and where processing personal data by the controller is necessary to further those interests, they may rely on this basis.
The ePrivacy Directive, implemented in the UK by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) requires consent for direct marketing by email or SMS in Regulation 22.
(Continued…)

…

88. Whereas the terms “personal data”, “data subject”, “controller” and “processor” are defined in the Regulation, the concept of “persons who, under the direct authority of the controller or processor, are authorised to process personal data” is not. It is, however, generally understood as referring to persons that belong to the legal entity of the controller or processor (an employee or a role highly comparable to that of employees, e.g. interim staff provided via a temporary employment agency) but only insofar as they are authorized to process personal data. An employee etc. who obtains access to data that he or she is not authorised to access and for other purposes than that of the employer does not fall within this category. Instead, this employee should be considered as a third party vis-à-vis the processing undertaken by the employer. Insofar as the employee processes personal data for his or her own purposes, distinct from those of his or her employer, he or she will then be considered a controller and take on all the resulting consequences and liabilities in terms of personal data processing.