Two sets of rules govern UK marketing emails: the Privacy and Electronic Communications Regulations (PECR), which control when you may send, and UK GDPR, which controls how you handle the personal data involved. This is general information, not legal advice. The Information Commissioner's Office (ico.org.uk) is the authority, and its guidance is updated, so verify the current position there before you act.
When you can send marketing email
Under PECR, marketing emails to individual subscribers generally need their consent, unless the soft opt-in exception applies. The ICO treats the soft opt-in as narrow, so apply it carefully.
| Situation | Usual position (check ICO guidance) |
|---|---|
| Private individual who has not dealt with you | Consent needed before marketing email |
| Existing customer, you collected their details during a sale or negotiation, marketing your own similar products, and they were offered an opt-out when details were collected and in every message | Soft opt-in may apply |
| Sole trader or some partnerships | Generally treated like individuals |
| Limited company or other corporate subscriber | PECR consent rule differs, but UK GDPR and the duty to offer an opt-out still apply |
| Bought or rented list | Risky: you must be able to show the people consented to your type of marketing, and a vendor's promise is not enough |
Consent under UK GDPR must be freely given, specific, informed and unambiguous, given by a clear positive action. Pre-ticked boxes and bundling consent into terms and conditions do not meet that standard. Silence or inactivity is not consent.
Records, wording and sign-up forms
- Say what people are signing up for. Name your business, the type of content and how often, in plain words next to the box.
- Keep a consent record: who, when, how, what they were told, and the page or form used. Choose a platform that stores this and exports it.
- Use double opt-in if you want stronger evidence, where a confirmation email must be clicked. It is not a legal requirement in itself.
- Keep separate consents separate. Agreement to a newsletter does not cover third-party offers.
- Do not add people who only downloaded a free resource to your newsletter unless the sign-up form made clear they were also subscribing.
Every email you send
Each marketing email should identify the sender, not disguise who it is from, and include a working way to opt out that is free to use. Honour unsubscribes promptly and add the address to a suppression list so it is not re-imported later. Under UK GDPR, people have a right to object to direct marketing, and where they do, you must stop. Do not require someone to log in or pay to unsubscribe.
If you cannot see the original consent wording, date and source for each person, and it does not name your kind of business, do not use the list. 'GDPR-compliant' on a sales page is not evidence. The ICO says you remain responsible as sender.
Choosing tools with compliance in mind
A platform will not make you compliant by itself, but good ones help. Look for hosted sign-up forms with consent fields, stored consent history, automatic unsubscribe handling, suppression lists, a data processing agreement, clear information on where data is stored and international transfers, and the ability to delete or export one person's data. Selection criteria for the platform itself are in choosing an email marketing tool.
Your CRM and any other tool holding subscriber data need the same scrutiny. See how to choose a CRM.
Points to verify on ico.org.uk
- The current PECR electronic mail marketing guidance, including the soft opt-in conditions.
- Guidance on consent and on legitimate interests for direct marketing.
- Rules on tracking pixels and cookies in emails and on your website.
- Your obligations as a data controller, including any registration and fee requirement.
- Any changes arising from recent data protection legislation, which the ICO publishes updates on.
If you market to subscribers in the EU or elsewhere, their national rules may differ. Get professional advice for large lists, sensitive data or regulated sectors.
Practical example: a small shop's newsletter
A shop adds a newsletter box at checkout. If the box is unticked and the text says the customer will get a monthly email about offers, a tick is consent. A customer who buys but does not tick may still be eligible for the soft opt-in for similar products, provided they were given a clear chance to refuse at checkout and every email has an unsubscribe link. Someone who only browsed and never bought cannot be added without consent. Someone who unsubscribes goes on a suppression list. If the shop buys a list from a third party, none of this protects it unless the original consent covered the shop's emails.
Mistakes that cause complaints
The common ones are simple: emailing people who never agreed, hiding the unsubscribe link, ignoring opt-outs, copying everyone in the To or CC field so addresses are exposed, and re-adding unsubscribed contacts when importing an old list. Each is avoidable with a platform that handles suppression lists and with a routine of reviewing your sign-up forms every quarter. If you receive a complaint or a subject access request, respond promptly and keep a record of what you did.
Frequently asked questions
Do I always need consent to send marketing email?
Often, for individuals, but a soft opt-in can apply to existing customers in narrow conditions. Check the ICO's current guidance.
Are business emails treated differently?
Corporate subscribers are treated differently under PECR, but sole traders are generally treated as individuals and data protection duties still apply.
Can I use a bought email list?
It is risky. You must be able to show the people agreed to your kind of marketing, and a seller's assurance is not proof.
What must every marketing email include?
Your identity and a simple, free way to opt out, honoured promptly.