nermio
Try it free

Privacy and the law

Can you send that email?

When you may email someone unprompted, why a limited company and a sole trader are treated differently, the exception for existing customers, and what has to be in every message.

About 7 minutes to read

Illustration: an email with a tick and a cross

The rule, and who it applies to

Marketing email in the UK is governed by PECR — the Privacy and Electronic Communications Regulations — with the ICO as the regulator. The headline rule is that you must not send marketing email to individuals unless they have specifically consented, or they're an existing customer.

And then the part that surprises people: that rule does not apply to corporate subscribers. A limited company, an LLP, a Scottish partnership or a government body you may email cold, with no prior consent. The ICO says so plainly.

Consent, where you do need it, is only consent if someone actively chose it. A pre-ticked box doesn't count. A line buried in your terms doesn't count. And consent you obtain because someone wanted something else — a download, a discount — only counts if they also understood they were signing up to your mailing list.

The trap: who counts as a company

This is where it goes wrong, and the distinction isn't visible from an email address.

Sole traders and ordinary partnerships are individual subscribers under PECR. The ICO is explicit: they're treated as individuals, so you can only email or text them if they've specifically consented or bought something similar from you before. Corporate subscribers are the ones with separate legal status — companies, LLPs, Scottish partnerships.

Of the 5.7 million UK businesses at the start of 2025, 3.2 million were sole proprietorships and 368,000 ordinary partnerships, against 2.1 million actively trading companies. So the stricter rule covers rather more than half the market, and *info@joebloggsplumbing.co.uk* tells you nothing about which side of the line it's on. Companies House will, for free, if you want to check — see where a small business finds its leads.

The exception most small businesses need

For individual subscribers there's one exception, and it's broad enough for most real situations: the soft opt-in. You may email an existing customer about similar products or services even without a sign-up.

Three conditions come with it. They must have bought — or negotiated to buy — something from you in the past. It has to be about comparable work: a plumber can offer his service contract, not a holiday cottage. And you must have given them a simple way to opt out, both when you first collected their details and in every message since.

That last clause is the one people miss. The opt-out isn't only a line at the bottom of the mailing; it had to be there at the moment the address was captured.

What has to be in every message

This applies to corporate subscribers too, so there's no version of this where you can skip it:

  1. Who you are. You must not disguise or conceal your identity. Your business name, and no no-reply address without an alternative.
  2. A valid contact address, so the recipient can opt out or unsubscribe. That's a requirement, not a courtesy.
  3. Why they're getting it. One sentence does it: "you're receiving this because you're a customer of ours" or "because you signed up". Not strictly required, and it prevents more spam reports than anything else on this list.
  4. And then actually stopping. An unsubscribe that doesn't get processed is worse than no unsubscribe link: you've made a promise and broken it.

Calling is stricter than emailing, not looser

This is the opposite of what people assume, and it's the opposite of how it works in several other countries.

You must not make unsolicited live marketing calls to any number registered with the TPS or the CTPS unless that person has specifically consented to calls from you. The TPS covers individuals — and under PECR that includes sole traders and most partnerships. The CTPS is the corporate version, for companies, LLPs, Scottish partnerships and some government bodies. So a business calling list has to be screened against both, plus your own record of people who've asked you not to ring.

On the call itself: say who's calling, let your number or an alternative contact number be displayed, and give a contact address or freephone number if you're asked. More on doing that well is in cold outreach.

UK GDPR applies on top of all of this

PECR governs the message. UK GDPR governs the data, and it doesn't care whether the subscriber is corporate.

*firstname.surname@company.co.uk* identifies a specific person, so it's personal data even though they're acting in a business capacity. That means you need a lawful basis for holding and using it, and the person retains their rights — including an absolute right to object to direct marketing. A generic *info@* or *sales@* address is looser, because there's no identifiable individual in it, but don't build a strategy on that distinction: the PECR rules are about the message, not only about the personal data.

What that looks like for an ordinary customer list is in customer data and UK GDPR.

What happens if you get it wrong

The ICO can issue fines under PECR, and it does — it publishes the enforcement actions, mostly against firms running volume campaigns on bought lists. That's the formal risk, and for most small businesses it isn't the biggest one.

The practical risk is your own email. Recipients who hit "spam" damage the reputation of your sending domain, and at some point your ordinary business email stops arriving too — your quotes, your invoices, your replies to questions. You notice that late and it's hard to undo.

A workable way to do it properly

Record two things per contact: how you got their address, and whether they've opted out. Two fields, nothing more — how acquired and opted out yes/no.

That looks like admin and it's your only evidence. If a complaint ever arrives, the question isn't whether you meant well but whether you can show where the consent came from, or on what basis you were relying.

And keep one rule that's stricter than the law and easiest to remember: only send something you'd be glad to receive yourself. Anyone who sticks to that never comes up against any of these regulations.

This is an explanation, not legal advice

Written by a software supplier with an interest in you not finding this too complicated. If you're going to send at volume, if you're working from bought lists, or if you're genuinely unsure — read the ICO's own guide to PECR, or put it to a solicitor.

Sources