A customer who bought from you, a newsletter subscriber and a contact found on LinkedIn may all appear in the same mailing platform, but the rules for emailing them are not necessarily the same. For email marketing and GDPR in the UK, the practical question is not simply whether an address is available. It is how you obtained it, what the recipient was told and whether your next campaign fits that original relationship.
Two sets of rules apply to marketing emails
The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 govern how businesses use personal information. The Privacy and Electronic Communications Regulations (PECR) set specific rules for sending electronic marketing. A lawful basis under UK GDPR does not automatically give you permission to send an email under PECR.
Check both the right to use the contact’s personal data and the right to send the particular marketing message. The Information Commissioner’s Office (ICO) oversees these requirements and publishes guidance for organisations.
When email consent is needed
For unsolicited marketing emails to individual subscribers, including consumers, sole traders and some partnerships, PECR generally requires valid consent unless a relevant exception applies. Consent must be freely given, specific, informed and unambiguous. A pre-ticked box or consent hidden inside general terms will not meet that standard.
A useful signup form explains what emails the person will receive and identifies the business sending them. Someone downloading a free guide should not silently become a subscriber to unrelated promotions. Separate choices help when newsletters, partner offers and product updates serve different purposes.
Keep proof of the decision
Record when and how somebody opted in, the wording they saw and any subsequent change of preference. Double opt-in, where a subscriber confirms their address through a follow-up email, can strengthen your evidence and list quality, although it is not universally required by UK law.
The customer soft opt-in has specific limits
UK rules include a products-and-services soft opt-in. A business may be able to market its own similar products or services to someone whose details it collected directly during a sale or negotiations for a sale, provided it offered a clear chance to refuse marketing when collecting the details and in every subsequent message.
Consider an independent coffee retailer. A customer buys beans online and is clearly offered an opt-out at checkout. If the customer does not opt out, the retailer may be able to email offers for similar coffee products, provided the other conditions are met. That does not create unrestricted permission to promote unrelated insurance or another company’s offers.
Nor can a business apply the customer soft opt-in to a purchased mailing list. The Data (Use and Access) Act 2025 also introduced a separate, conditional charitable-purposes soft opt-in for qualifying charities; it is not a general exemption for commercial senders.
Business-to-business email is different, not rule-free
PECR generally permits unsolicited marketing emails to corporate subscribers, such as limited companies, without prior consent. However, sole traders and certain partnerships receive the protections for individual subscribers. The type of organisation matters more than whether its address looks professional.
Where an address identifies an employee, such as a named person at a company domain, UK GDPR may still apply. You need an appropriate lawful basis, transparency and a way to respect objections. Legitimate interests may be suitable in some business-to-business situations, but this requires an assessment of necessity and the person’s reasonable expectations.
Use subscriber information only in expected ways
Tell people why you collect their address, how you plan to use it and where they can find your privacy information. Collect what you need, protect access to your mailing platform and avoid retaining stale contact details indefinitely.
Segmenting a list by purchases or stated interests can make messages more relevant, but increasingly intrusive profiling may require closer scrutiny. Email-opening pixels and similar tracking technologies raise additional PECR considerations, separate from the rules governing the marketing email itself. Review your provider’s tracking settings rather than assuming every built-in feature is automatically compliant.
If an agency or email platform processes subscriber data for you, clarify responsibilities and appropriate contractual safeguards.
Make unsubscribing straightforward
Every marketing email should identify the sender and provide a valid, simple way to stop future messages. A working unsubscribe link or an appropriate reply method should be easy to find and use. Do not require someone to log in, explain their reasons or navigate confusing screens simply to leave a list.
Under UK GDPR, a person has an absolute right to object to processing for direct marketing. Once they object, stop using their personal data for that purpose. Maintain a limited suppression list so an old contact is not accidentally reimported and emailed again. Deleting every trace of the address without retaining suppression information can create that problem.
A practical campaign check before pressing send
Imagine a small UK software company combining newsletter signups, former customers and conference business cards into one audience. Instead of emailing everyone, the team should classify each source, check the applicable PECR rule and confirm the UK GDPR basis. Conference cards alone do not establish consent for marketing to individuals.
Next, check the signup language and consent records, remove unsubscribed contacts, review the subject line and sender identity, and test the unsubscribe process. The team should also confirm that the campaign’s content fits what recipients were told to expect. This is more reliable than treating list size as a measure of readiness.
Clear email newsletter signup forms, sensible email list segmentation and sound email deliverability practices are useful companion topics, but none replaces lawful permission and careful data handling.
Frequently asked questions
Does UK GDPR mean every marketing email needs consent?
No. PECR determines when consent is required for sending electronic marketing, while UK GDPR requires a lawful basis where personal data is used. A qualifying soft opt-in or marketing to a corporate subscriber may be treated differently, but the remaining obligations still matter.
Can I email people whose addresses are publicly listed?
Public availability does not equal marketing consent. For individual subscribers, you generally need consent or a valid exception. Corporate contacts may be treated differently under PECR, but personal-data obligations and objections still apply.
Can I use legitimate interests for an email newsletter?
Sometimes, but legitimate interests cannot override a PECR requirement for consent. It may be appropriate for qualifying soft opt-in marketing or certain corporate outreach when a documented assessment supports it.
Should I delete an address after someone unsubscribes?
Remove it from active marketing audiences and retain only the minimum suppression information necessary to prevent future unwanted contact. Make sure that preference carries across imported lists and connected tools.
Build compliance into the mailing process
UK GDPR email marketing works best when permissions, expectations and opt-outs are managed at the point of collection rather than repaired after complaints. Identify your audience, apply the correct PECR rule, keep dependable records and give recipients genuine control. Those habits support responsible campaigns and the trust that makes email worthwhile.