Is B2B cold email legal in the UK? PECR and UK GDPR explained

Two sets of rules apply

Cold email in the UK is covered by two overlapping sets of rules:

• PECR, the Privacy and Electronic Communications Regulations, which govern electronic marketing such as emails, texts and calls.
• UK GDPR and the Data Protection Act 2018, which govern how you collect and use personal data, including a named person's work email address.

You need to satisfy both. PECR decides whether you may send the email at all; UK GDPR decides how you handle the data behind it. Both are enforced by the Information Commissioner's Office (ICO).

Corporate versus individual subscribers

PECR's consent rule for marketing email protects individual subscribers. It does not apply in the same way to corporate subscribers. This distinction is the heart of UK B2B cold email.

So emailing jane@yourprospect.co.uk about your services is treated differently from emailing a self-employed plumber at their personal Gmail. If you cannot tell whether a business is incorporated, check Companies House or leave it out of the list.

What every cold email must do

Whatever the subscriber type, PECR requires that you do not hide who you are and that you give a valid address for opt-out requests. In practice, every message should:

• Clearly show the sender's real name and the business it comes from.
• Include a simple way to opt out, such as "reply 'no thanks' and I won't email again".
• Be honoured quickly: once someone opts out, stop and add them to a suppression list so they are never contacted again, by you or by a campaign you run for anyone else.

The ICO's guidance on PECR is the primary source and is worth reading in full.

Where UK GDPR comes in

A named person's work email is personal data, so you need a lawful basis for processing it. For B2B outreach this is usually legitimate interests. To rely on it, you should carry out and record a legitimate interests assessment (LIA), which the ICO describes as a three-part test:

1. Purpose: is there a legitimate interest? Telling relevant businesses about a service that could help them usually qualifies.
2. Necessity: is the processing necessary for that purpose, or could you achieve it in a less intrusive way?
3. Balance: do the person's interests override yours? Contacting someone about something relevant to their job role, a few times, with an easy opt-out, tends to balance well. Emailing everyone at a company about something irrelevant does not.

The ICO's legitimate interests guidance includes a template you can adapt.

Transparency: telling people where you got their data

When you collect someone's details from a source other than them, such as a B2B database or a company website, UK GDPR expects you to give them privacy information within a reasonable time and at the latest at first contact. A short line in the email linking to a privacy notice written for prospects is a practical way to do this. That notice should explain who you are, where the data came from, why you are using it, how long you keep it and how to object. You can see our own prospect notice as an example.

Good practice that keeps you safe

• Target by role and relevance, not by scraping every address at a company.
• Keep sequences short and stop when someone says no.
• Avoid generic role addresses unless you are confident the business is a corporate subscriber and the message is relevant.
• Keep a suppression list and check every new list against it.
• Delete data you no longer need on a set schedule.
• Be ready to answer access and deletion requests within one month.

Penalties for breaching PECR are increasing: the Data (Use and Access) Act 2025 brings PECR fines up to UK GDPR levels. The reputational cost of a careless campaign is often worse, though: complaints also damage deliverability, which is covered in our deliverability checklist.

Emailing US companies from the UK

US commercial email is governed mainly by the CAN-SPAM Act, which permits unsolicited commercial email but requires accurate headers, a non-deceptive subject line, a physical postal address and a working opt-out honoured within ten business days. Your UK GDPR obligations still apply to how you handle the data.

How we apply this at Warmpipe

We only contact people at limited companies, LLPs and other corporate bodies, at their work address. Every email identifies the sender and offers a one-line opt-out, and every opt-out goes on a permanent suppression list. We document our legitimate interests assessment and link to a prospect privacy notice. Read how this fits into our cold email service.