PECR and cold email in the UK: a guide for web agencies

Two sets of rules

PECR (the Privacy and Electronic Communications Regulations 2003) covers marketing by phone, email and text (legislation.gov.uk).

UK GDPR covers what you do with personal data, including a business contact's name and work email.

You need to comply with both.

Corporate subscribers vs individual subscribers

PECR talks about "subscribers". The ICO explains the split (ICO, business-to-business marketing):

• Corporate subscribers are bodies with separate legal status: companies, limited liability partnerships, Scottish partnerships and some government bodies. An employee's work email at a limited company counts as a corporate subscriber, because the subscriber is the employer.
• Individual subscribers include sole traders, non-limited partnerships in England, Wales and Northern Ireland, and other unincorporated bodies. PECR treats them like members of the public.

The key difference: the PECR consent rule for marketing by email does not apply to corporate subscribers. The ICO says that emailing a generic address such as info@business.co.uk about your products or services would usually be marketing to a corporate subscriber, and you don't need consent under PECR (ICO, marketing and data protection in detail).

For sole traders and individual-subscriber partnerships, you need consent, unless the soft opt-in applies (an existing customer, details collected during a sale, similar products, and a chance to opt out each time).

What every marketing email must include

Whoever you write to, the ICO says that every marketing email must:

• say who you are — don't hide your identity;
• give a valid address where people can opt out.

And if someone objects, stop. Businesses and business contacts can object to your marketing at any time.

UK GDPR: the part people forget

Corporate does not mean "no data protection". If you email jane.smith@company.co.uk, you are processing Jane's personal data. The ICO's guidance says that when you collect someone's details in their business capacity and plan to market to them, you must:

• have a lawful basis (for B2B prospecting, usually legitimate interests, backed by a balancing test);
• tell them what you are doing, at the latest in your first message when you got their details elsewhere;
• respect their right to object to direct marketing, which is absolute.

Using publicly available personal data, for example from a company website, does not take you outside UK GDPR.

The 2026 change to fines

The Data (Use and Access) Act 2025 aligned PECR enforcement with UK GDPR. According to the ICO's summary of the changes, PECR penalties now follow the UK GDPR levels (ICO, DUAA summary — PECR). The higher maximum under the Data Protection Act 2018 is £17.5 million or 4% of worldwide annual turnover, whichever is higher. Note that the ICO marks some of its B2B guidance as under review following the Act, so check the latest version before you rely on it.

A practical checklist for UK prospecting

1. Check the company type on Companies House. "Ltd", "PLC" or "LLP" means a corporate subscriber.
2. Prefer the company's published address, or a role address, over hunting down a personal one.
3. Skip cold email to sole traders unless they have opted in. Use a phone call, an event or a referral instead.
4. Write about their business: their website, their bookings, their visibility.
5. Identify yourself and add an opt-out in every message. Process opt-outs straight away.
6. Keep a suppression list and never re-import someone who has opted out.
7. Document your legitimate interests assessment once and keep it on file.

How Closamo handles this

Closamo applies rules per country. For UK contacts, it records the type of business and the legal basis for each contact, and blocks sending when the basis is missing, for example a sole trader without consent. Every email carries an unsubscribe link, a STOP reply ends the sequence, and opted-out contacts are never contacted again. Details are on our compliance page.

Frequently asked questions

More guides

• How to find clients for a web design agency
• CAN-SPAM: cold email rules for US web agencies