Can you send that email?

Two conditions, and you have to clear both

Regulation 13(2) reads as one sentence, but it sets two separate tests. Most people who get this wrong cleared the first and never looked at the second.

The address. It has to "reasonably appear to the sender" to be used mainly for the recipient’s commercial or official activity. An address like info@ or sales@ on a company domain is obvious. A named address on that same domain also qualifies — the wording is "used mainly by the subscriber or user", so a person’s own work address is squarely inside it, which is exactly the case that makes people nervous elsewhere.

Where it fails is a private address. Someone running a business does not stop having a private life, and a personal address you found on a club list or a comment thread is not a business address because the person happens to be self-employed. The genuinely grey case is the sole trader using a webmail address for the business: if you saw it on the business’s own website, invoice or van, it reasonably appears to be the business address, and that is a defensible position. If it came out of a bought list, you have no idea what it is — and "reasonably appears to the sender" is not something you can claim about data you never looked at.

The subject. The message must relate "solely to that commercial or official activity", and the activity in question is theirs, not yours. An email about the work they do is inside. A general newsletter is not. Nor is a seasonal offer, an unrelated second product, or a webinar invitation that went to your whole list and happened to include them.

The word is "solely" and not "mainly". One extra paragraph about something else and the exception is gone for that message, which is a more useful thing to know than it sounds: it means the test is applied per email, not per contact.

The question that carries this in practice: would this email still make sense if the recipient did not do this job? If it would, it is not solely about their commercial activity, and you need consent.

Emailing a company is opt-out

Regulation 13(4) deals with subscribers other than a natural person — a limited company, a public body, anything holding the subscription that is not an individual. Email to them is prohibited only where that subscriber "has notified the person that the subscriber or user does not consent to the receipt of such a communication".

That is a plain opt-out, and 13(2) is expressly "subject to paragraph (4)", so the business-address exception never overrides a refusal that has already been given.

The practical consequence is the only one that matters: a refusal has to land somewhere you will actually look again. It can arrive as a reply, a phone call, or a sentence at the end of a meeting, and none of those put themselves on a suppression list. Sending again after it has been said to you is an offence, and the person who said it will remember. More on keeping that list honest is in cleaning up your customer list.

Existing customers, and the twelve-month clock

Where you do need consent — a private address, or a message that is not solely about the recipient’s business — there is one exception, and for most small businesses it is the one that matters. Regulation 13(11) lets you market to an existing customer whose email address you obtained in the context of a sale, on four conditions, all of which apply at once:

1. It is your own product or service. Not an affiliate’s, not a friendly supplier’s, however reciprocal the arrangement.
2. It is "of a kind similar to that supplied to the customer" in that sale. A plumber can offer a service contract; the same plumber cannot offer insurance.
3. They were given an easy, free way to object both when the address was collected and in every message you have sent since. Both halves, not either.
4. There was a sale, and it was recent. The regulation requires that "the sale of the product or service occurred not more than 12 months prior to the sending of the direct marketing communication".

What the twelve months actually does

The twelve-month limit is the part that gets summarised wrongly, and almost always in the same direction — as a deadline after which you may no longer write to a customer at all. Condition (d) has a second half: the sale must have been within twelve months, or "the contact details were used for the sending of electronic mail for the purposes of direct marketing within that 12 month period".

So it is a starting clock, not an expiry date. Send your first marketing email within twelve months of the sale and the channel stays open afterwards. Leave the address untouched for longer than that and the exception is spent — you are back to needing either consent or the business-address route in 13(2). The Commission reads it the same way in its own guidance: the initial direct marketing communication must be sent within twelve months of the date of the original sale.

And there has to have been a sale. The regulation says the sale "occurred"; it does not cover someone who asked for a price and went elsewhere. The Commission is explicit about the online version of that: an organisation must not market to a prospective customer who does not complete a purchase, so an abandoned basket is not an existing customer. Chasing a quote you were asked for is a different matter and a normal part of the job — see following up a quote — and so is staying in touch with people who did buy, which is in keeping in touch with existing customers.

What has to be in every message

None of this depends on which route you used. Regulations 13(10) and 13(12) apply to direct marketing email generally, including email to a company under the opt-out rule, so there is no version of this where you can skip it:

1. A valid contact address. Regulation 13(10)(c) requires "a valid address at which that person may be contacted". Not a no-reply with nothing behind it.
2. A valid address for stop requests. Regulation 13(12)(c) separately requires "a valid address to which the recipient may send a request that such communication shall cease". These are two requirements, and an unsubscribe link that posts to a form nobody reads does not satisfy the second one.
3. Your real identity. Regulation 13(12)(a) prohibits email that "disguises or conceals the identity of the sender on whose behalf the communication was made". Your business name, in the message, in a place a person will find it.
4. And then actually stopping. A stop request you accept and do not process is worse than not offering one: it is a promise, it is on record, and under 13(13) the next message is an offence.

The phone is a different question, and the mobile is different again

This is the other place Ireland does something you will not find in a neighbouring rulebook, and it is the reason "I will just ring them instead" is not a plan you can make in general terms.

The landline is opt-out, with a register. Regulation 13(5) prohibits an unsolicited marketing call where the subscriber has told you not to call, or where their number is recorded in the National Directory Database. The Commission describes the NDD as the opt-out register for landline numbers, placed there through the person’s own phone provider. Regulation 13(9) gives you 28 days of grace after a new registration is recorded, which is a real allowance and also a reason to re-screen a list you have been working for a month.

The mobile is opt-in. Regulation 13(6) prohibits a marketing call to "the mobile telephone of a subscriber or user" unless that person has consented. Note what is missing from that paragraph: the natural-person limitation that 13(1) has, and the business carve-out that 13(2) gives email. So the office line and the mobile of the same contact sit in two different regimes, and the field your CRM stores the number in is doing legal work.

If you are not sure which kind of number you have, treat it as a mobile. On the call itself, Regulation 13(10)(a) requires you to give the name of the person calling and, where it applies, the name of the organisation you are calling for. How to do that part well is in cold outreach.

The GDPR sits on top of all of this

Regulation 13 governs the message. The GDPR and the Data Protection Act 2018 govern the data, and they do not care that the address was a business one. The Data Protection Commission is the regulator for both, which is why a single complaint can arrive on both grounds.

Regulation 13 says so itself, at 13(18): "personal data shall be deemed to include a phone number or an e-mail address of a subscriber or user". And firstname.surname@company.ie identifies a specific person however commercial the context, so you need a lawful basis to hold and use it, and that person keeps their rights — including the right to object to direct marketing, which is not something you get to weigh against your own interest.

A generic info@ or sales@ address is looser, because there is no identifiable individual in it. Do not build a strategy on that difference: it affects the data question and not the message question, and the message question is the one that gets prosecuted. What this means for an ordinary customer list is in customer data and the GDPR.

What happens if you get it wrong

Here the balance reverses. Ireland is more permissive about whether you may send, and harsher about what a breach is: under Regulation 13(13) it is a criminal offence, and the Data Protection Commission prosecutes it in the District Court rather than issuing an administrative fine.

Regulation 13(15) sets the penalty: on summary conviction, a class A fine, which section 3 of the Fines Act 2010 defines as a fine not exceeding 5,000 euro; on conviction on indictment, up to 250,000 euro for a body corporate or 50,000 euro for an individual. And 13(13)(b) matters more than the ceiling: "the sending of each unsolicited communication or electronic mail or the making of each unsolicited call constitutes a separate offence". The five thousand is per message.

In practice the sums have been small and the exposure has not been. In one sitting at the Dublin Metropolitan District Court in September 2023, the Commission brought eight charges against four organisations — in several cases over a single text or a single email to a single person. Three were dealt with under the Probation of Offenders Act 1907 on a 500 euro charitable donation; one was convicted and fined 500 euro, having previous convictions for the same thing. All four paid the Commission’s legal costs, and all four were named in a press release that is still online.

For most small businesses, though, the bigger risk is quieter. Recipients who mark your mail as spam damage the reputation of your sending domain, and at some point your ordinary business email stops arriving too — your quotes, your invoices, your replies to people who asked you a question. You notice that late, and it is hard to undo.

A workable way to do it properly

Record two things against every contact: how you got the address, and whether they have opted out. Two fields. That looks like admin and it is in fact your defence.

Regulation 13(14) is the reason to be specific about it. Where consent is in issue in a prosecution, "the onus of establishing that the subscriber or user concerned unambiguously consented ... lies on the defendant". It is not for anyone to show you lacked consent; it is for you to show you had it.

The business-address route has the same shape. The test in 13(2) is what reasonably appeared to the sender, so the useful note is not "B2B" but where you actually found the address: their website, their invoice, a card they handed you, a list you bought. The first three are an answer. The fourth is not. Where to look instead is in where a small business finds its leads.

And keep one rule that is stricter than the law and far easier to remember: only send something you would be glad to receive yourself. Anyone who sticks to that never comes up against any of these regulations.

This is an explanation, not legal advice

Written by a software supplier with an interest in you not finding this too complicated. Regulation 13 is short and it is published in full, so if you are going to send at volume, work from bought lists, or you are simply unsure where your case falls — read the regulation itself, read the Commission’s own FAQ on consent for electronic direct marketing, or put it to a solicitor.