GDPR Compliant Email Marketing: A UK SME Guide
Table of Contents
Most email compliance guides written for UK businesses are quiet about the wrong law. UK GDPR governs the personal data sitting behind your subscriber list. PECR governs whether you are allowed to press send at all.
That single distinction decides almost everything practical. Whether you need a tick box. Whether you can email a customer who bought from you last month. Whether the sole trader on your B2B list counts as a business or as an individual with full consumer protections.
This guide covers the UK GDPR and PECR split, the three lawful routes into a subscriber’s inbox, the B2B rules that catch most SMEs out, how to build sign-up and unsubscribe processes that survive a complaint, and what to do with a list built before May 2018. Changes introduced by the Data (Use and Access) Act 2025 run throughout.
UK GDPR and PECR: Which Law Governs Your Marketing Emails?
Two regulations apply to every marketing email sent from a UK business, and they do different jobs. Knowing which is which is the first requirement of GDPR compliant email marketing, and confusing the two is the root cause of most compliance failures in small businesses. The sections below separate what each one controls, what changed in 2025, and how the picture shifts for firms trading across the Irish border. Both sit inside the wider obligations covered in this guide to data protection for online businesses.
What UK GDPR Actually Covers
UK GDPR sets the rules for how you collect, store, process and protect personal data. For GDPR email marketing, that means it governs your subscriber records rather than the sends themselves.
It dictates how you record consent, how long you keep contact details, how you answer a subject access or deletion request, and how you demonstrate any of it after the fact. Following Brexit, EU regulations were brought into UK domestic law, with EU GDPR continuing to apply separately to processing that involves EU residents. How those records are held matters as much as how they were gathered, which is where the encryption and access control practices in this piece on protecting user data and secure storage techniques become part of the compliance position rather than a separate IT concern.
The penalty framework sits at up to £17.5 million or 4% of global annual turnover under UK GDPR, and up to €20 million or 4% of global annual turnover under EU GDPR, whichever figure is higher in each case.
What PECR Controls
The Privacy and Electronic Communications Regulations govern the act of sending. PECR sits alongside UK GDPR and applies specifically to electronic marketing directed at individuals, which puts it at the centre of email marketing compliance in the UK.
Under PECR, you generally need prior consent before sending unsolicited direct marketing emails to individual subscribers. The soft opt-in exemption for existing customers is the main route around that requirement, and it is covered in full below. PECR is one strand of a wider set of obligations, and the broader picture of the ethics and legalities of digital marketing shows how advertising standards, consumer protection and data rules stack on top of each other.
The practical summary is short. GDPR tells you how to handle the data. PECR tells you whether the message is lawful in the first place. Any GDPR compliant email marketing programme has to satisfy both.
What the Data (Use and Access) Act 2025 Changed
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends PECR in several places relevant to GDPR compliant email marketing. According to the Data (Use and Access) Act 2025 PECR factsheet published by the Department for Science, Innovation and Technology, the Act comes into force in stages.
Three changes matter most for anyone running a mailing list. The definitions of “call” and “communication” now cover all messages sent, whether or not they reach the recipient, so an infringement can occur even when the email never lands. UK charities gain a soft opt-in route for people who have shown interest in their charitable purposes, widening it beyond those who have already bought something. Trade associations and other sectoral bodies can now write PECR codes of conduct and submit them to the ICO for approval, with adherence usable as evidence of compliance.
The Act also rewrites the cookie rules, adding exceptions such as collecting statistical information about how an online service is used with the aim of improving it. That has consequences for the tracking pixels embedded in marketing emails and for the consent banners on the pages your campaigns drive traffic to, which is where this sits alongside the wider UK digital compliance requirements for websites.
The Post-Brexit Position for UK and Irish Businesses
Since 1 January 2021, the UK has operated its own data protection regime. The EU granted the UK an adequacy decision in June 2021, allowing personal data to flow between the two without additional legal mechanisms, subject to periodic review.
For businesses marketing on both sides of the border, two regimes apply at once. EU GDPR covers data on EU residents regardless of where the business is based. UK GDPR covers UK residents. The ICO regulates in the UK, the Data Protection Commission regulates in Ireland, and a Newry retailer selling into Dundalk deals with both. Anyone shipping as well as emailing across the border should read this alongside the guidance on data privacy laws in e-commerce, since order records and marketing lists sit under the same framework.
Northern Irish businesses felt this shift more sharply than most, and many have never revisited their processes since. The obligation attaches to the person whose data you hold, not to the office you send from.
Choosing Your Lawful Basis: Consent, Legitimate Interest and Soft Opt-In
Every piece of personal data you process needs a lawful basis under UK GDPR, and every marketing send needs a lawful route under PECR. For GDPR compliant email marketing to individuals, three options do almost all the work. Picking the wrong basis at the design stage costs far more than choosing it correctly at the start, which is why this decision belongs at the front of the process rather than the end. The commercial case for getting it right is set out in this piece on customer data privacy in digital marketing.
When Consent Is the Right Choice
Consent is the cleanest option for most B2C GDPR compliant email marketing. Valid consent must be freely given, specific, informed and unambiguous, and it requires a positive opt-in. A pre-ticked box does not qualify.
Consent also has to be granular. Promotional emails, service updates and third-party offers each need their own tick. Bundling them into one checkbox is a common shortcut that fails on inspection. Writing a consent statement that says plainly what will land in someone’s inbox is the same discipline described in this guide to content creation ethics: say what you mean, and do only what you said.
Once given, consent must be recorded: who gave it, when, what exactly they agreed to, and how it was captured. Without that record you effectively hold no consent at all. Consumer publishers face this in its purest form, because nobody has bought anything.
Where Legitimate Interest Genuinely Applies
Legitimate interest allows processing without explicit consent where you can show the processing serves a real business purpose, is proportionate, and does not override the individual’s rights.
For email marketing, it is weaker than most guides imply. The ICO’s position is that marketing to individuals generally requires consent under PECR, whatever GDPR might otherwise permit. Legitimate interest under GDPR does not rescue a send that PECR prohibits.
Where it does carry weight is in B2B communication to corporate entities, in re-engagement with existing subscribers who have not opted out, and in the record-keeping and suppression processes behind a marketing programme. Regulated sectors add another layer on top, which is covered in this companion piece on email marketing compliance for finance.
How the Soft Opt-In Works in Practice
The soft opt-in is the most misread provision in GDPR compliant email marketing law and the one that gives SMEs the most room to move. Under PECR, you can email an existing customer without a fresh consent tick when four conditions are all met.
The person gave you their contact details in the context of a sale or the negotiation of a sale. You are marketing only your own similar products or services. You gave them a clear chance to opt out at the point of collection. Every subsequent email carries a working unsubscribe mechanism.
In practice, that first condition is usually satisfied at checkout, which makes the checkout itself a compliance surface as much as a payment one. The same is true of the wider work on compliance and security in online payments: the moment you capture the address is the moment the opt-out has to appear.
On “similar products or services” the ICO offers no precise definition. A customer who bought web design and later receives an email about SEO or content services is defensible, because a reasonable person would expect that. An unrelated product category is not. Where the judgement is close, take a fresh consent tick at the point of sale instead.
| Basis | When to use it | What it requires | Example |
|---|---|---|---|
| Consent | Cold contacts, new sign-ups, B2C lists | Positive opt-in, specific, recorded, withdrawable | Newsletter sign-up form on your website |
| Legitimate interest | Existing B2B relationships, service communication | Assessment completed, proportionate, opt-out provided | Service updates to a corporate client |
| Soft opt-in | Existing customers, similar products or services | Prior sale or negotiation, relevant content, opt-out in every send | Emailing a customer who bought last month |
Where the Soft Opt-In Fails
Two errors recur across SME email programmes, and both are avoidable at the process level.
The first is applying the soft opt-in to enquiries. Someone who requested a quote and never bought is not covered, because the exemption requires an actual sale or a genuine negotiation of one. A downloaded guide is not a negotiation either.
The second is dropping the opt-out somewhere inside an automated sequence. If any email in the chain lacks a working unsubscribe, the exemption collapses for that send, and this is exactly where platform-level automated email workflows tend to catch people out, because a welcome series built once is rarely audited again.
B2B Email Rules: Corporate Subscribers, Sole Traders and Cold Outreach
For GDPR compliant email marketing in a B2B setting, the distinction PECR draws is not between business and consumer, but between corporate and individual subscribers. That difference is where most B2B lists develop a compliance problem, and it rarely shows up until someone complains. It surfaces fastest on lists built by bulk import, which is worth reading about alongside this walkthrough of importing and exporting contacts between Wix and Mailchimp, because a CSV rarely records what type of entity each address belongs to.
Corporate Subscribers Versus Individual Subscribers
GDPR compliant email marketing in B2B starts with a definition. PECR’s strict opt-in requirement applies to individual subscribers, meaning natural persons. Emails sent to a corporate subscriber, such as a limited company, a PLC or a public authority, do not attract the same opt-in rule.
You can therefore contact corporate email addresses without prior consent under PECR, provided every message carries an opt-out. UK GDPR still applies to any personal data in that email, including a named individual’s work address, so the data handling obligations remain in place even where the send itself is permitted.
The distinction often comes down to how the address itself is structured. A departmental address of the kind described in this guide to setting up and using email sits more comfortably in corporate territory than a named individual’s inbox, though neither test is absolute on its own.
The Sole Trader Trap
This is where B2B programmes most often fail. A sole trader’s business email address is personal data relating to an individual, and under PECR, sole traders and most partnerships are treated as individual subscribers rather than corporate ones.
The consequence is direct: the strict opt-in rules apply to them exactly as they apply to consumers. If your prospect list includes tradespeople, consultants, freelancers or small partnerships, those contacts need consent or a valid soft opt-in.
Fixing this is a list hygiene job before it is a legal one. Entity type has to be a field you can filter on, which is the same discipline described in this walkthrough of organising a contact list in Wix: labels and segments applied consistently, so a single send never mixes corporate and individual subscribers under one rule.
| Entity type | PECR opt-in required? | Opt-out required? | Key rule |
|---|---|---|---|
| Limited company (Ltd, PLC) | No | Yes | Corporate subscriber |
| Sole trader | Yes | Yes | Treated as an individual subscriber |
| Partnership (most) | Yes | Yes | Unless an LLP or incorporated, apply individual rules |
| Public authority or charity | No for the corporate address | Yes | Corporate subscriber rules apply to the entity address |
Is Cold Emailing Legal Under UK Law?
GDPR compliant email marketing does allow cold outreach, within limits. A cold email to a named limited company address is lawful under PECR, provided the message carries an opt-out, and you meet UK GDPR obligations on the personal data involved. That is a narrower permission than “cold email is fine”.
Three things make cold outreach fail in practice. Scraped lists frequently contain sole trader and personal addresses that were never sorted out. Purchased lists rarely carry consent that names your business specifically, which is what PECR requires. Sending volumes built for consumer marketing attract complaints that trigger scrutiny of the whole programme.
Anyone prospecting across the Atlantic should note the rules invert. CAN-SPAM operates on an opt-out model rather than an opt-in one, and the differences are set out in this guide to US marketing compliance. A single list sent under one policy will breach one jurisdiction or the other.
Building a GDPR Compliant Email Marketing Programme From Sign-Up to Send
Compliance is not a setting you switch on. It lives in how the sign-up form is built, how consent is stored, how unsubscribes are processed, and how long records are kept. Get those four right and GDPR compliant email marketing largely takes care of itself, because it is a process question far more than a legal one. Most of it is decided at build time, which is why it belongs in the scope of a website development project rather than in a later clean-up.
Designing a Sign-Up Form That Records Valid Consent
The sign-up form is where consent is created, which makes it the highest-value thing to fix. The consent statement belongs above the submit button, not below it, and it needs to say what the subscriber will actually receive.
The opt-in must be a positive action: an unticked checkbox, a deliberate button click, or similar. Pre-ticked boxes and implied consent through form submission alone both fail. The form should link to a privacy policy that states what you collect, how long you keep it, and how someone withdraws consent or requests deletion. The technical detail is set out in this guide to designing GDPR-compliant web forms.
Consent architecture belongs in the project brief rather than the final review, and ProfileTree builds it that way for SME clients across Northern Ireland, Ireland and the UK.
Double Opt-In: Required or Recommended?
No, double opt-in is not a legal requirement under UK GDPR or PECR. A single, clearly recorded opt-in meets the legal standard on its own.
It remains the strongest evidence of consent available, and it improves list quality by filtering out mistyped and abandoned addresses. If a complaint reaches the ICO, a confirmation click with a timestamp is considerably easier to defend than a single checkbox log.
There is a commercial argument alongside the legal one. Confirmed lists tend to report stronger open and click rates, and the sector figures in this breakdown of email statistics by industry give a useful benchmark for judging whether your own numbers suggest a list quality problem.
Unsubscribes, Suppression and Data Retention
Every marketing email needs an unsubscribe that works immediately and without conditions. Requiring a login, adding a processing delay, or asking for a reason before removing someone are all non-compliant.
Behind the unsubscribe sits the suppression list, and it is the piece most often neglected. If an unsubscribed contact can be re-added by the next CSV import, the mechanism has failed. Suppression must persist across imports, platform migrations and list merges.
The usual culprit is a connected app writing contacts back into the list. Anyone who has followed a guide on connecting marketing apps to a website will recognise the field-mapping step, and that is exactly where an unsubscribed contact quietly reappears if subscription status is not mapped across.
Retention needs a stated period. An inactivity window of 12 to 24 months is a common standard, after which contacts are re-permissioned or deleted. Document it in your records of processing activities so the decision is evidenced rather than assumed.
Your GDPR Email Compliance Checklist
Run this GDPR email compliance checklist before launching a new programme or reviewing an existing one. It covers sign-up, records and ongoing sends.
- The sign-up form uses an unticked consent checkbox with a specific consent statement
- The consent statement sits separately from the terms and conditions
- The privacy policy is linked from the sign-up form
- Consent records capture who, when, what and how
- Every email includes a functioning unsubscribe link
- Unsubscribe requests are processed immediately
- The suppression list survives imports and platform changes
- A retention period is defined and documented
- A data processing agreement is in place with your email platform
- Sole traders and partnerships are flagged separately in the B2B list
Working through that list usually surfaces a skills gap rather than a legal one, which is what ProfileTree’s digital training programmes are built to close for marketing teams and business owners.
As Ciaran Connolly, founder of ProfileTree, puts it: “The businesses that treat consent as a form field rather than a process are the ones that get caught out. The tick box is the easy part. Proving two years later what someone agreed to, and showing they were never quietly re-added after unsubscribing, is where most SME lists fall down.”
“The businesses that treat consent as a form field rather than a process are the ones that get caught out. The tick box is the easy part. Proving two years later what someone agreed to, and showing they were never quietly re-added after unsubscribing, is where most SME lists fall down.” Ciaran Connolly, Founder of ProfileTree
Cleaning Legacy Lists and Proving Compliance
Plenty of UK businesses still send to lists assembled before May 2018, often through methods that would not pass now. Whether those contacts can lawfully be emailed is one of the most common questions SMEs bring to GDPR compliant email marketing reviews, and the answer depends entirely on what you can evidence. Treat it as an audit exercise, in the way these examples of a marketing audit set out, rather than a judgment call made segment by segment.
Assessing a Pre-2018 List
Start with evidence rather than intent. For each segment, ask three questions. Is there a record of how the contact was added? Was there any opt-in at the time? Is there a purchase relationship that could support a soft opt-in argument?
Contacts with no consent record and no purchase history sit in the highest risk band and should generally be removed. Contacts with a documented sale and similar-product relevance are considerably safer.
Segment before you decide, because treating a legacy list as a single block usually means either deleting valuable contacts or keeping indefensible ones. The scoring approach in this content audit framework adapts neatly to the job: assess each segment against fixed criteria and decide whether to keep, re-permission or drop it.
Running a Re-Permission Campaign Without Repeating the Classic Mistake
Where contacts signed up through an older form or have a purchase history, a re-permission campaign can recover the legitimate subscribers and clear the rest.
There is a trap here worth naming. An email asking for marketing consent is itself a marketing email under PECR, which means you need a lawful basis to send it. The ICO has previously fined organisations for exactly this, so re-permission works for contacts where a defensible basis already exists, not as a way to legitimise a list you had no right to email.
Keep it to one send, two at most. The email should explain plainly that you are updating records, state what the subscriber is signing up for, and include a single opt-in link. Being direct about why the message has arrived is the same principle that underpins transparency in content marketing, and it performs better than a vague reactivation subject line. Anyone who stays silent should be removed, because silence is not consent.
Records That Hold Up to an ICO Enquiry
Accountability is the part of GDPR compliant email marketing that trips businesses up longest after the fact. It means demonstrating compliance, not merely achieving it. If the ICO asks, the burden of proof sits with you.
Keep consent logs that tie each subscriber to a source, a timestamp and the exact wording they agreed to. Keep a copy of every version of the sign-up form, since wording changes over time and the version in force at the moment of capture is what matters. Keep suppression records showing that opt-outs were honoured and never reversed.
Migrating a list to a new platform does not reset any of this. The legal basis follows the data, not the system holding it. The gap is usually knowledge rather than intent, which is the case for why a business needs digital training in the first place, and this breakdown of GDPR training topics for your team sets out what a useful session should include.
Putting It Into Practice
GDPR compliant email marketing is achievable for any SME willing to work through it methodically. Identify the lawful basis for each segment, build consent capture properly into your website, keep records that prove what happened, and address legacy data honestly rather than hoping it never surfaces. If your email programme needs a structural review covering form design, platform configuration and content strategy, contact ProfileTree to talk it through.
FAQs
Does GDPR apply to small businesses sending marketing emails?
Yes. There is no minimum size threshold under UK GDPR or PECR for GDPR compliant email marketing. The ICO factors proportionality into penalties, so a micro-business acting in good faith is treated differently from a large organisation acting recklessly, but the obligations themselves apply equally.
What is the difference between UK GDPR and PECR for email marketing?
UK GDPR governs how you collect, store and protect subscriber data. PECR governs whether you can lawfully send the message. Both apply to every campaign, and PECR is usually the more immediately relevant of the two.
Can I email existing customers without new consent?
Yes, if the soft opt-in conditions are met: details obtained during a sale or its negotiation, marketing of similar products or services only, a clear opt-out at collection, and a working unsubscribe in every email. Enquiries that never became sales are not covered.
Is cold emailing legal under GDPR in the UK?
Cold email to corporate addresses at limited companies is permitted under PECR provided an opt-out is included. Sole traders and most partnerships count as individual subscribers, so they need consent or a valid soft opt-in.
Is double opt-in a legal requirement?
No. A single recorded opt-in satisfies UK GDPR and PECR. Double opt-in is the stronger evidence if consent is ever challenged, and it improves list quality, but it is best practice rather than law.