Cold email laws
UK GDPR and PECR: What They Mean for Cold Email
Yes for companies. PECR lets you email corporate subscribers such as limited companies and LLPs without consent if you identify yourself and give a valid opt-out address. Sole traders and some partnerships need consent. Fines for breaches since February 5, 2026 reach GBP 17.5 million or 4% of turnover.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under UK GDPR and PECR?
In short Yes, to companies and LLPs without consent, if you identify yourself and give a valid opt-out address; sole traders and some partnerships need consent, and the UK GDPR still covers the named person.
PECR regulation 22, the consent rule for marketing email, applies only to individual subscribers. Corporate subscribers, meaning companies, LLPs, Scottish partnerships and other bodies that are legal persons, can receive marketing email without consent. Regulation 23 still covers every marketing email: you may not hide who you are, and you must give a valid address where the recipient can ask you to stop.
Sole traders and other partnerships count as individuals. They need consent or the soft opt-in, which covers only people whose details you got in a sale or negotiation, for your own similar products. The ICO's guidance says to treat a contact as an individual subscriber when you are unsure.
The UK GDPR covers the named employee's data. You need a lawful basis, usually legitimate interest, and since February 5, 2026 the UK GDPR lists direct marketing as an example of one (Article 6(11)). You also owe a privacy notice (Article 14) and must stop when the person objects (Article 21). The Information Commission replaced the ICO as the regulator on September 30, 2026.
What Do You Need to Do Under UK GDPR and PECR?
In short 7 rules apply to a cold email program under UK GDPR and PECR.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Know who is a corporate subscriber | No PECR consent is needed to email corporate subscribers. Sole traders and partnerships that are not legal persons count as individuals. | Tag each contact by legal form (Ltd, PLC, LLP or sole trader and partnership). When you are unsure, treat the contact as an individual. | PECR reg. 2(1) and 22(1); ICO B2B guidance |
| Consent or soft opt-in for individuals | Individual subscribers need consent, or the soft opt-in: details from a sale or negotiation, your own similar products, and a free way to refuse at collection and in every message. | Do not cold email sole traders or non-LLP partnerships without consent. | PECR reg. 22(2) and 22(3) |
| Identify the sender | A marketing email may not disguise or conceal who sent it. | Send from a real person, with a real company name and domain. | PECR reg. 23(a) |
| Valid opt-out address | Every marketing email needs a valid address where the recipient can ask you to stop. The ICO says you should comply with a corporate subscriber's opt-out request. | Add a working unsubscribe link or reply-to-stop line, and screen new lists against your do-not-email list. | PECR reg. 23(b); ICO B2B guidance |
| Lawful basis for the named contact | Legitimate interest usually fits B2B email where PECR needs no consent, if it passes the purpose, necessity and balancing test. | Document a legitimate interest assessment for each campaign. | UK GDPR Art. 6(1)(f) and 6(11) |
| Privacy notice | When the data came from public sources or a third party, give privacy information within one month, or at the latest in your first message. | Put a short notice, the data source and a privacy link in the first email. | UK GDPR Art. 14(3) |
| Right to object | The right to object to direct marketing is absolute, and you must flag it at the latest in the first message. | Suppress the person permanently, across every tool and mailbox. | UK GDPR Art. 21(2) to 21(4) |
What Are the Penalties Under UK GDPR and PECR?
In short Maximum penalty: GBP 17.5 million or 4% of worldwide turnover, whichever is higher.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Fine for breaking PECR regulations 22 or 23, for breaches from February 5, 2026 | GBP 17,500,000 or, for a company, 4% of total annual worldwide turnover, whichever is higher | about USD 23.3 million | PECR Sch. 1 para. 18; Data Protection Act 2018 s.157(5) |
| Fine for PECR breaches before February 5, 2026 | GBP 500,000 | about USD 666,800 | Data Protection Act 1998 s.55A; SI 2010/31 reg. 2 |
| UK GDPR fine for breaking the lawful basis, notice or objection rules | GBP 17,500,000 or, for a company, 4% of total worldwide annual turnover, whichever is higher | about USD 23.3 million | UK GDPR Art. 83(5) |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
The Information Commission enforces PECR and the UK GDPR (PECR reg. 31). Anyone who suffers damage from a PECR breach can sue the sender for compensation, and the sender has a defense if it took reasonable care (PECR reg. 30).
What Enforcement Has There Been Under UK GDPR and PECR?
In short 2 cases from regulator and court records, newest first.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2026-01-20 | ZMLUK Limited (formerly Zuru Media) | Sent 67,772,285 marketing emails in 2023 using third-party data, where sign-ups were shown 361 partner companies with no way to choose. | GBP 105,000 fine from the ICO | ICO news release |
| 2024-01-12 | Grocery Delivery E-Services UK Limited (HelloFresh) | Sent 79 million marketing emails and 1 million texts on an opt-in that did not mention texts and was bundled into an age confirmation. | GBP 140,000 fine from the ICO | ICO monetary penalty |
Cold Email Checklist for UK GDPR and PECR
- Check each company's legal form and email only corporate subscribers without consent.
- Treat sole traders, non-LLP partnerships and unclear contacts as individuals who need consent.
- Send from a real person, with your company name and domain.
- Include a working unsubscribe link or reply-to-stop line in every email.
- Honor every opt-out, including requests from companies, and keep a do-not-email list.
- Document a legitimate interest assessment for the named contacts.
- Put a short privacy notice with the data source in the first email.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under UK GDPR and PECR, that includes checking each contact's legal form and getting consent from sole traders.
FAQ
Do I need consent to cold email UK businesses?
Not under PECR, if the business is a corporate subscriber such as a company, LLP or Scottish partnership. You must still identify yourself and give a valid opt-out address (reg. 23), and the UK GDPR still applies to the named person's data.
What about sole traders and partnerships?
PECR treats them as individuals. You need their consent or the soft opt-in, which covers only people whose details you got in a sale or negotiation, for your own similar products (reg. 22(2) and 22(3)).
Do I have to honor an unsubscribe from a company?
PECR does not say so expressly for corporate subscribers, but the ICO says you should. When a named person objects, the UK GDPR right to object is absolute (Art. 21(3)).
What is the maximum PECR fine now?
For breaches from February 5, 2026: GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher. For breaches before that date the old GBP 500,000 cap applies.
Who is the UK regulator for cold email?
The Information Commission, which took over from the Information Commissioner's Office (ICO) on September 30, 2026. It enforces both PECR and the UK GDPR.
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- GDPR: What It Means for Cold Email
Legitimate interest; consent rule varies by country
- CAN-SPAM Act: What It Means for Cold Email
Allowed, opt-out
- CASL (Canada): What It Means for Cold Email
Consent first; implied consent for published work addresses
- Ken anti-spam policy
Sources
Changelog
- Page published.