Is cold emailing businesses legal in the UK? PECR and UK GDPR explained.

Two sets of rules govern B2B cold email in the UK. The Privacy and Electronic Communications Regulations (PECR) set rules for sending electronic marketing, such as email. UK GDPR and the Data Protection Act 2018 govern how you handle personal data, which includes a named person's work email address. Both are regulated by the Information Commissioner's Office (ICO).

The short version: you can generally send relevant marketing emails to limited companies without their prior consent, as long as you say who you are, give an easy way to opt out and handle people's data fairly. The detail is below.

Corporate and individual subscribers

PECR's email marketing rules depend on who you're sending to. It splits recipients into two groups.

This matters because the strictest consent rule applies only to individual subscribers.

Emailing companies: what PECR requires

PECR does not require prior consent to send marketing emails to corporate subscribers. You can email a limited company or an LLP about your products or services without them having opted in first. This applies whether you write to a generic address like info@ or to a named employee's work address.

Every marketing email you send, to anyone, must still:

• Say who it's from. You mustn't disguise or conceal your identity.
• Give a valid way to opt out. Include a working address or link the recipient can use to ask you to stop.

When someone opts out, stop emailing them. It's good practice, and in most cases a legal requirement under UK GDPR, to honour that promptly and permanently.

Emailing sole traders and partnerships

For individual subscribers, which include sole traders and most partnerships outside Scotland, PECR says you can't send unsolicited marketing email unless:

• they have specifically consented to receive marketing email from you, or
• you can rely on the soft opt-in: you got their details during a sale, or negotiations for a sale, of your products or services; you're marketing similar products or services; and you gave them a simple way to refuse marketing when you collected their details and in every message since.

For cold prospecting, where you have no previous relationship, neither usually applies. So in practice, avoid cold emailing sole traders and non-Scottish partnerships. This is one reason prospecting from the Companies House register is convenient: sole traders and ordinary partnerships aren't on it, while limited companies and LLPs are.

UK GDPR still applies to work emails

PECR is only half the picture. A named person's work email, such as david.hartwell@company.co.uk, is personal data. That means UK GDPR applies when you collect it, store it and use it, even though the person works for a company.

Lawful basis: legitimate interests

For B2B prospecting, most businesses rely on legitimate interests as their lawful basis. UK GDPR recognises that direct marketing may be a legitimate interest, but you need to show your use is necessary and balanced against the person's rights. Do this with a legitimate interests assessment: a short written record of why you're processing the data, why it's necessary and why it's fair to the people involved. Relevance to their role helps; emailing an accountant about accounting software is easier to justify than emailing them about something unrelated to their job.

Transparency

People have a right to know how their data is used. When you collect someone's details from a source other than them, such as a company website, you need to give them privacy information. If you use the data to contact them, this should be no later than your first email. A short line in the email linking to your privacy notice, explaining where you got their details, is a common way to do it.

The right to object

Anyone can object to their data being used for direct marketing, and that right is absolute. If someone asks you to stop, you must stop. Keep their address on a suppression list, holding just enough information to make sure you never contact them again.

Data minimisation and accuracy

Only collect what you need: typically a name, role, company and work email. Don't keep data longer than necessary, and remove details that are out of date.

Recent reform: the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 made changes to UK data protection law and to PECR, with provisions coming into force in stages. The core principles in this guide still apply, but some details, including the ICO's enforcement powers, have changed or are changing. Check the ICO's current guidance on electronic marketing before relying on any specific point.

A practical checklist for compliant B2B cold email

1. Email limited companies, LLPs and other corporate bodies. Avoid sole traders and ordinary partnerships unless you have consent or a genuine soft opt-in.
2. Use contact details the business has published for business purposes.
3. Make each email relevant to the recipient's role and business.
4. Say clearly who you are, and include a privacy notice link explaining where you got their details.
5. Include an easy opt-out in every email, and honour it immediately and permanently.
6. Keep a suppression list, and check it before every send.
7. Write down your legitimate interests assessment, and review it if your approach changes.
8. Send at a sensible pace. Even legal email harms your reputation if it reads like spam; see our deliverability guide.

How Pucky helps

Pucky starts from Companies House, the UK's official register of companies. Every email it sends includes one-click unsubscribe, honoured instantly and permanently, and people who opt out or complain are never emailed again. It never emails the same person twice, even if they're a director of several companies. Read more about how Pucky protects your reputation. You remain responsible for what you send and why, so make sure your own messaging and privacy notice meet the rules above.

Frequently asked questions