The rules for cold email, PECR and UK GDPR
Plain-words guidance on emailing businesses and sole traders in the UK, and what Adapt does and does not do for you.
This is guidance, not legal advice. You are the sender, so you are responsible for who you email and what you say. If you are unsure, ask a solicitor or read the ICO's guidance on direct marketing.
Two laws
- PECR (the Privacy and Electronic Communications Regulations) controls marketing emails.
- UK GDPR controls using personal data, which includes a work email address with a person's name in it.
Companies versus sole traders
PECR treats two kinds of recipient differently.
| Recipient | Usually means | Cold email |
|---|---|---|
| Corporate subscriber | A limited company, an LLP, a public limited company, a Scottish partnership or a public body | You may email without prior consent if you clearly say who you are and give an easy way to opt out |
| Individual subscriber | A sole trader, and most partnerships in England, Wales and Northern Ireland | You generally need their consent, or you must meet the narrow "soft opt-in" rules for existing customers |
Be careful. The type depends on the organisation, not on the address. An address like helen@marshkeel.example at a limited company is a corporate address. The same style of address at a sole trader is not. Check the legal form of each business before you email it. If you cannot tell, treat it as an individual subscriber.
What every email needs
- Say who you are, with your business name, and give a valid way to reach you.
- Give a simple, free way to opt out in the email itself.
- Honour any opt-out straight away, and keep a list of those who asked.
- Do not hide who is sending or use a false address.
UK GDPR in plain words
You need a lawful reason to use someone's details. Many B2B senders rely on legitimate interests, which means you have weighed your interest against theirs and recorded it. You must tell people how you got their data and what you do with it, and stop when they object. Data from a bought or scraped list is not clean because it was bought.
What Adapt does and does not do
- Adapt does not screen anyone against any register. It does not check TPS or CTPS. Those cover phone calls, not email.
- Adapt does not work out for you whether a person is a corporate or an individual subscriber.
- Adapt does not add an unsubscribe link, your name or your address to an email. You write them: Unsubscribes and the do-not-email list.
- Adapt does skip anyone on your do-not-email list, requires a person to approve each campaign, and keeps an approval tied to the exact content.
- The spam check does not test for any of the legal points above.
Before you launch
Check the list, check the opt-out line, check your identity is in the email, and keep your reason for emailing in writing.