Is cold email legal in the UK? The B2B rules in plain English
Short answer: yes, if you're emailing companies about something relevant to their work, you say who you are, and you let them opt out. The detail matters, so here it is without the legal fog.
Two sets of rules apply
PECR (the Privacy and Electronic Communications Regulations) decides whether you can send a marketing email without consent. UK GDPR decides how you handle the personal data involved, like a person's name and work address.
PECR: who you can email without consent
- Corporate subscribers: limited companies, LLPs, partnerships in Scotland, and government bodies. You can send them B2B marketing without prior consent.
- Individual subscribers: members of the public, sole traders, and partnerships in England, Wales and Northern Ireland. You generally need consent first.
That second point catches people out. A one-person business trading under its owner's name counts as an individual, even though it's a business. That's why we check company status before anyone goes on a list.
What every email must do
- Say clearly who it's from, with a real name and business.
- Give a simple way to opt out, and honour it straight away.
- Be relevant to the person's job.
UK GDPR: legitimate interest
When you email a named person at a company, you're processing their personal data. For B2B outreach the usual lawful basis is legitimate interest. In practice that means:
- Write a short note of why you're contacting this type of person and why it's reasonable (your legitimate interests assessment).
- Only collect what you need: name, job title, work email, company.
- Have a privacy notice on your website and tell people where you got their details if they ask.
- Keep a do-not-contact list and never email those people again.
What happens if you get it wrong
The ICO can fine businesses for PECR breaches, and the Data (Use and Access) Act 2025 raised the maximum PECR fines to the same level as UK GDPR. Most problems start with a complaint, so the simplest protection is to email relevant people, rarely, and stop the moment anyone asks.
The checklist we use
- Recipient is a limited company, LLP or public body.
- The offer is relevant to their role.
- Sender name, business name and address in every email.
- A plain "reply and I won't contact you again" in every email, honoured the same day.
- One shared do-not-contact list across every campaign.
- No more than three emails to anyone who hasn't replied.
Sources: ICO guidance on electronic mail marketing (PECR regulations 22 and 23) and ICO guidance on legitimate interests under UK GDPR.