You have an email address, a useful offer and a campaign ready to send. The remaining question is a rather important one: are you allowed to send it?
UK GDPR email marketing involves more than putting a privacy notice on your website. You also need to understand the Privacy and Electronic Communications Regulations, usually called PECR. They address different parts of the same activity.
This checklist covers the foundations for ordinary commercial marketing by UK small businesses. It is general guidance, not a ruling on a particular list or a guarantee of compliance.
1. Ask two separate questions
Can we send this marketing email under PECR? For individual subscribers, you will generally need consent or to meet all the conditions of an applicable soft opt-in.
Can we process this person’s data under the UK GDPR? Where you use personal data, you also need a valid lawful basis and must meet the wider data protection requirements.
Calling something a ‘legitimate interest’ does not override a PECR requirement for consent. Keep the two decisions distinct in your records.
2. Know who the subscriber is
PECR treats corporate subscribers, such as limited companies, differently from individual subscribers. Sole traders and some partnerships fall within the individual-subscriber rules.
That means ‘it is a business email address’ is not enough to settle the question. A named work address may also be personal data, bringing UK GDPR responsibilities into the picture.
For corporate marketing, the absence of a PECR consent requirement does not make every campaign appropriate. You must identify the sender and provide a valid way to opt out. Where personal data is involved, respect the individual’s right to object to direct marketing.
A business address is a clue about the recipient, not a complete permission check.
3. Check every condition before relying on the soft opt-in
The commercial soft opt-in is not a general exemption for anyone who has shown an interest in your business. Check that:
- You obtained the contact details directly during a sale or negotiations for a sale.
- You are promoting your own similar products or services.
- You gave a clear, simple opportunity to opt out when you collected the details.
- You provide an easy opt-out in each subsequent marketing message.
A bought-in list does not become eligible for your soft opt-in simply because its contacts might like your products. Nor should you assume a historical contact qualifies when you cannot establish how the details were collected.
4. Make consent understandable and keep evidence
Where you rely on consent, people need a genuine, informed choice. Explain who will send the emails and what they are agreeing to receive. Avoid pre-ticked boxes and wording that hides the marketing choice inside unrelated terms.
Record when and how consent was given, including the wording shown at the time. You need evidence of the choice, not just a column containing ‘yes’ with no explanation of how it got there.
5. Make leaving straightforward
Check your unsubscribe process before sending. It should work without unnecessary hurdles and the request must be reflected in later campaigns.
Keep an appropriate suppression record so someone is not accidentally added back during the next import. An unsubscribe does not necessarily mean deleting every trace of the address immediately; retaining limited information to honour the choice can be necessary. Handle deletion requests as a separate data protection matter where relevant.
6. Keep the information useful and controlled
Collect only what you need, keep records accurate and decide how long different information should be retained. Limit access to people who need it, and understand the role of any service provider handling your data.
Your email data management process should preserve permission and suppression information when lists move between systems. A tidy import is not useful if it loses the reason you were allowed to contact someone.
7. Review the actual signup-to-send journey
Take one real route through your business: the form, the privacy information, the stored record, the campaign selection and the unsubscribe. Check that each step agrees with the previous one.
Your next move: choose one list and establish where its contacts came from and why each group can receive your marketing. Resolve gaps before sending. Software can help you manage the process, but it cannot turn missing permission into permission.
The WizEmail Team
