Cold Email in the UK: Is It Legal? PECR, UK GDPR & How to Do It Right

The Two Laws That Govern UK Cold Email

UK cold email sits under two overlapping regimes. PECR (Privacy and Electronic Communications Regulations 2003) governs the act of sending electronic marketing. UK GDPR (with the Data Protection Act 2018) governs your processing of personal data, and a named work email address is personal data. You must comply with both at once: PECR decides whether you may send, UK GDPR decides how you may handle their data.

PECR's Crucial Distinction: Corporate vs. Individual Subscribers

This is the rule most senders, including UK natives, have never heard of. PECR's consent requirement for marketing email applies to individual subscribers: consumers, sole traders, and non-LLP partnerships. It does not apply to corporate subscribers: limited companies, LLPs, PLCs, and public bodies.

• •[email protected] → corporate subscriber → cold email permitted without prior consent (PECR), subject to identification and opt-out rules.
• •[email protected] where Bob is a sole trader → individual subscriber → consent required first. Practically off-limits for cold email.
• •[email protected] / @hotmail.co.uk → individual subscriber → consent required. Never cold email personal addresses in the UK.

UK GDPR: Legitimate Interest Done Properly

Even for corporate subscribers, emailing jane.smith by name means processing her personal data, which needs a lawful basis. For B2B outreach that basis is legitimate interest, and the ICO expects you to have actually thought it through, not just typed the words. The three-part test:

• •Purpose: a genuine business interest (selling something relevant to her role).
• •Necessity: direct email is a proportionate way to reach that interest.
• •Balancing: her rights don't override yours, which in practice means tight targeting (her role plausibly cares about your offer), transparency (say where you got the data if asked, respond to requests promptly), and frictionless objection (opt-outs honored immediately and permanently).

Document the assessment once per campaign type, suppress opt-outs forever, and keep records of data sources. The broader EU-flavored version of this analysis is in our GDPR compliance guide, post-Brexit UK GDPR is nearly identical for outreach purposes.

What Every UK Cold Email Must Contain

• •Real identity: your name and company, no concealed or misleading sender information.
• •A valid contact address in the footer, generate a compliant one with our Unsubscribe Generator.
• •A working opt-out ("reply 'no thanks'" counts, a link is cleaner), honored immediately, suppressed permanently.
• •Truthful subject lines, deceptive subjects breach both regimes.

Enforcement Reality: What the ICO Actually Pursues

The ICO publishes every enforcement action, and the pattern is consistent: fines go to bulk unconsented spam aimed at individuals, millions of texts/emails to consumer lists, lead-gen firms trading consent-washed data, claims-management spam. Targeted, relevant, low-volume B2B outreach to corporate subscribers with clean opt-out handling is not where enforcement lands. That's not a licence for sloppiness, complaints are what trigger investigations, and complaint-worthy email is bad business anyway, but UK B2B senders following this guide operate comfortably inside both the law and the ICO's demonstrated priorities.

The Compliant UK Setup, Step by Step

• •1. List: UK Ltds/LLPs only, sole traders screened out, roles matched to your offer. Clean it with the CSV Cleaner.
• •2. Infrastructure: separate sending domains with SPF/DKIM/DMARC, UK mailbox providers enforce the same 2024+ authentication rules as everyone. Grade yours with the Deliverability Checker.
• •3. Copy: relevant, truthful, personal, the writing playbook applies unchanged; UK prospects just punish hype slightly faster.
• •4. Footer: identity + address + opt-out in every send, including follow-ups.
• •5. Process: LIA documented, opt-outs suppressed within 24h, data-source records kept, complaint rate watched.

The usual disclaimer: this guide is practitioner experience, not legal advice, for high-stakes campaigns, an hour with a UK data-protection solicitor is cheap insurance.