Email marketing rules in the UK: PECR and GDPR in plain English
The UK’s email marketing rules come from PECR (the Privacy and Electronic Communications Regulations) and UK GDPR. Here are the essentials in plain English, who you can email, and what you must do.
Updated 29 September 2026
Businesses: companies versus sole traders
PECR treats organisations differently depending on what they are. “Corporate subscribers” (limited companies, LLPs and government bodies) can be sent marketing emails without prior consent. “Individual subscribers” (sole traders, some partnerships and consumers) generally need to have agreed, unless the soft opt-in applies.
Even for companies, a named person’s work email is personal data under UK GDPR, so you need a lawful reason to use it (usually legitimate interests) and must tell them how you got it.
The soft opt-in for existing customers
You can email people without fresh consent if you got their details when they bought (or asked about buying) from you, you’re marketing your own similar products or services, and you gave them a chance to opt out when you collected their details, and in every email since.
What every marketing email needs
- Who it’s from, your business name
- A valid way to contact you
- An easy, free way to unsubscribe
- Honest subject lines
- For cold emails to companies: how you got their details
Keep records
Record who agreed to hear from you, when, and how, and keep a list of people who’ve unsubscribed so they never receive marketing from you again, even if they turn up in a new list.
Rules change
The Data (Use and Access) Act 2025 made changes to UK data protection and PECR, including for charities. Check the Information Commissioner’s Office (ICO) for the latest guidance before a campaign.
Official sources
This guide is general information, not legal advice.