Cold email in the UK: PECR and UK GDPR

Corporate subscribers vs individual subscribers

PECR’s email marketing rule depends on the type of subscriber (ICO):

• Corporate subscribers, such as companies, limited liability partnerships, Scottish partnerships and some government bodies: you don’t need their consent under PECR to send marketing email. You must not disguise who you are, and you must give a valid address for opting out. The ICO says you should honour corporate opt-outs even though PECR doesn’t explicitly require it.
• Individual subscribers, including sole traders and some partnerships: you can only email them marketing if they specifically consented, or the soft opt-in applies (details obtained during a sale or negotiation, similar products, a clear chance to opt out when collected and in every message).
• Not sure? The ICO says to treat the address as an individual subscriber’s and follow the stricter rule.

The UK GDPR still applies to named people

Emailing a named person at a company means processing their personal data, so the UK GDPR applies, including the right to object to direct marketing. Where PECR doesn’t require consent, the ICO says legitimate interests will be the appropriate lawful basis, subject to its three-part test (purpose, necessity, balancing). The right to object to direct marketing is absolute: when someone objects, stop using their data for B2B marketing.

A generic address that doesn’t identify a person (for example info@ or “the IT department”) isn’t personal data, so the UK GDPR doesn’t apply to it, but PECR still does.

In practice

Cold email to named people at limited companies is possible under PECR with legitimate interests as the basis, if you identify yourself, offer an opt-out in every email, honour objections, and tell people about the processing. Cold email to sole traders and most partnerships needs consent first.

What every email needs

• Your identity, not disguised or concealed
• A valid address where the recipient can opt out
• Information about how you use their data, or a link to your privacy notice

What Inboxed does automatically

• Adds your company name and postal address to the footer of every campaign email, and blocks a campaign from launching until they’re set (Settings → Compliance, or per campaign).
• Adds a visible unsubscribe line and one-click unsubscribe headers (RFC 8058) to every campaign email. A click takes effect straight away, for everything your workspace sends, with no login or extra details asked.
• Treats replies such as “unsubscribe”, “remove me” or “stop emailing” as an unsubscribe.
• Keeps a suppression list that every campaign checks before each send. Unsubscribes and spam complaints can’t be removed by your team; you can also block whole companies by domain.
• Erase a person (Settings → Compliance) deletes what the workspace holds about an email address and keeps only a one-way hash, so the address is never emailed again.
• Offers a data processing agreement and a public list of sub-processors.

What you must do

Inboxed can’t decide who you may lawfully email. These parts are your responsibility:

• Work out whether each lead is a corporate subscriber or an individual subscriber, and don’t email individual subscribers (sole traders, most partnerships) without consent.
• Record a legitimate interests assessment for emailing named people at companies.
• Tell recipients who you are and how you use their data, with a link to your privacy notice.
• Stop on objection, including objections made by reply or phone (add them to the suppression list).

Penalties

The ICO enforces PECR and the UK GDPR and can issue enforcement notices and fines. Check the ICO’s website for current penalty levels.

Common questions