Email Outreach Guide
Cold email into the UK: the PECR rules a small business has to follow
PECR lets you email a UK company without consent but not a sole trader, so the work is sorting your list into the two groups before anything is sent.
01
What are the PECR rules for B2B cold email?
Under the UK's Privacy and Electronic Communications Regulations, known as PECR, you may send a marketing email to a company without its consent, but not to a sole trader or an ordinary partnership. PECR splits recipients into corporate subscribers, such as limited companies and LLPs, and individual subscribers, which include sole traders. The consent rule in regulation 22 covers only the second group. Every marketing email, to either group, must say who it is from and give a working address for opting out, and where the address names a person, UK GDPR applies as well. This guide explains the split and gives a practical method for sorting a real contact list before anything is sent. It is a working summary from someone who runs outreach, not legal advice.
Two regulations do most of the work.
Regulation 22 sets the consent rule for marketing by email, and paragraph (1) says it applies to email sent to individual subscribers. To them, you need consent, unless one of two narrow routes applies:
Regulation 23 applies to every marketing email, whoever receives it. You must not disguise or conceal the identity of the person the email is sent for, and you must give a valid address to which the recipient can send a request that the emails stop.
The Information Commissioner's Office, the UK regulator, puts it in one line on its business to business marketing page: the PECR rule on marketing by electronic mail does not apply to corporate subscribers. The same page carries a notice that the guidance is under review because of the Data (Use and Access) Act, so check it again before a large campaign.
- The soft opt in, in regulation 22(3): you got the person's details yourself, in the course of a sale or negotiations for a sale, you are marketing only your own similar products or services, and they were given a simple, free way to refuse when the details were collected and in every email since.
- A charity route, in regulation 22(3A), added from 5 February 2026 by the Data (Use and Access) Act 2025. It only helps charities furthering their charitable purposes.
02
Who counts as a corporate subscriber and who as an individual?
Regulation 2 of PECR defines a corporate subscriber as a company, a body incorporated by royal charter or letters patent, a partnership in Scotland, a corporation sole, or any other body that is a legal person distinct from its members. The ICO lists companies, limited liability partnerships, Scottish partnerships and some government bodies.
Everyone else is an individual subscriber. Regulation 2 says an individual includes an unincorporated body of individuals, and the ICO confirms that sole traders and other types of partnership are classed as individual subscribers.
In practice:
The legal form decides it, not how the business looks. A sole trader with a polished website and a branded email address is still an individual subscriber, and the consent rule applies to them in full.
- Corporate: a private limited company, a PLC, an LLP, a partnership formed in Scotland.
- Individual: a sole trader, an ordinary partnership in England, Wales or Northern Ireland, a self employed consultant trading under their own name or a trading name.
03
How do you sort a real contact list into the two groups?
This is the part that takes the work. A list from a website, an event or a lead provider rarely says what kind of business each contact belongs to, so add columns and fill them in before anyone is emailed.
Email domain. What to record: whether the address is on the business's own domain or on a free webmail service such as Gmail, Outlook or Yahoo. How it moves the contact: a free webmail address goes to Individual straight away. You cannot tell whose contract it is, and it is very often a personal inbox.
Legal form in the name. What to record: whether the business name ends in Limited, Ltd, PLC or LLP, or carries no legal form at all. How it moves the contact: a legal form is a strong sign of Corporate, but confirm it with the Companies House check. No legal form is a sign of Individual.
Companies House check. What to record: search the business name on the Companies House register and note the company number and the company type shown. How it moves the contact: a match with a company type such as private limited company or limited liability partnership supports Corporate. No match usually means a sole trader or an ordinary partnership, so Individual.
Company status. What to record: whether the register shows the company as active or dissolved. How it moves the contact: a dissolved company is not a company any more. Remove the contact.
Address type. What to record: whether the address names a person, such as a first name, or is a role inbox, such as accounts or sales. How it moves the contact: does not change the PECR group, but a named address brings in UK GDPR, which changes what you send.
Source and date. What to record: where the address came from and when. How it moves the contact: you need it for your UK GDPR records and for the privacy information you give the person.
Group. What to record: Corporate, Individual or Unsure. How it moves the contact: Unsure is treated as Individual.
That last rule is not a shortcut. The ICO says that if you are unsure whether contact details belong to an individual subscriber or a corporate subscriber, you should treat them as belonging to an individual subscriber.
Then act on each group:
Corporate. What you may do: send a marketing email without consent, until the business or the person asks you to stop. What you need in place: your identity, a valid opt out address, a suppression list checked before every send, and for named addresses the UK GDPR steps below.
Individual, including Unsure. What you may do: email only with consent you can show, or where the soft opt in in regulation 22(3) genuinely applies. What you need in place: a record of the consent or of the sale or negotiation that gave you the details, the refusal option given at collection and in every email, and a suppression list.
For most cold lists, the Individual group comes out with no consent and no soft opt in, so it is left out of the email campaign altogether. That is normal, and it usually leaves a smaller, cleaner list that is safer to run.
04
What must every email to a corporate address include?
Regulation 23 applies to corporate subscribers as fully as to anyone else, so every email needs:
Who you are. The identity of the person the email is sent for must not be disguised or concealed. Your name, your business name and your website in the signature cover it.
A valid address for opting out. The recipient must have a valid address to which they can send a request that the emails stop. A reply that reaches you works, and a one line unsubscribe note makes it plain.
Two more habits come from ICO guidance rather than from regulation 23 itself:
Keep refusals. The ICO says that when a business or a business contact objects, you should add their details to your do not contact or suppression list instead of simply deleting all record of them. Without the record, the contact can come back in the next list you import.
Screen before every send. The ICO's checklist for business marketing includes screening against your suppression lists before any direct marketing goes out, including from a new campaign or a new tool.
05
What does UK GDPR add on top of PECR?
PECR decides whether you may send the email at all. UK GDPR decides how you may use the personal data behind it. The ICO's example is simple: an address that names nobody, such as the IT department's inbox, is not personal data, so UK GDPR does not apply to it. An address that identifies a person is personal data, so it does.
For a named contact at a corporate subscriber, that means:
- A lawful basis. Where PECR does not require consent, the ICO says legitimate interests will be the appropriate lawful basis, and you apply its three part test: is there a legitimate interest, is the email necessary for it, and do the person's interests override it. Write the answers down for each campaign.
- Privacy information. Where you collected the details from somewhere other than the person, the ICO says you must give privacy information within a reasonable period, and that you must make a business contact aware if you intend to use their details for direct marketing.
- The right to object, stated in the first email. Article 21(4) of UK GDPR says the right to object must be brought to the person's attention at the latest at the first communication, clearly and separately from other information. Under Article 21(3), once a person objects to direct marketing, their data must no longer be used for it (UK GDPR text on the UK legislation site, read 2026-10-20).
06
How should an Irish sender treat UK recipients?
Plan to follow the UK rules for UK recipients, and do not assume the Irish rules carry across. They are close, but one difference catches people out.
Irish rules contain a narrow exception that lets you email a person at an address used mainly for their work, about that work, without consent. PECR regulation 22 has no work address exception. A UK sole trader is an individual subscriber whatever address they use, so a cold email to them needs consent or the soft opt in, even at a branded business address.
In practice, for a sender in Ireland:
On bought lists, the ICO's guidance gives an example where organisations buying business contact data would breach the law if they sent marketing by email to the individual subscribers on it, because consent has to be given to the sender. Buy a UK list only if you can sort it by the method above and drop the individual subscribers.
- Keep the UK contacts in their own list, so the sort above runs on them before any UK campaign.
- Run the Companies House check on every UK business, because the Irish company register will not show a UK company's legal form.
- Drop the Individual and Unsure groups from cold email, unless you hold consent or a genuine soft opt in.
- Use the UK regulator's guidance for UK recipients. The ICO's business to business marketing page is the place to start, and a UK solicitor is the place to finish if the campaign is large or the list was bought.
07
Common questions about PECR and B2B email
Can I cold email a limited company director at their work address? Under PECR, yes. The subscriber for a company email address is the company, which is a corporate subscriber, so regulation 22 does not apply. The address names a person, though, so UK GDPR applies: you need a lawful basis, usually legitimate interests, you must tell them about the right to object in the first email, and you must stop if they object.
Is a sole trader a business for PECR purposes? No. A sole trader runs a business, but PECR classes them as an individual subscriber, and the ICO says so in its business to business guidance. The consent rule in regulation 22 applies to them as it would to any member of the public, including at a business address.
Do I need a legitimate interests assessment for B2B email? If you email named people at corporate subscribers and rely on legitimate interests, the ICO expects you to apply its three part test, and writing it down is how you show you did. For one campaign, a page is enough: the purpose, why email to these people is necessary for it, where the addresses came from, whether the people would reasonably expect it, and what protects them, such as the opt out and the suppression list.
What records should I keep of opt outs? Keep enough to make sure the contact is never emailed again: the address, the business, the date of the request and how it came in. The ICO says objectors should go on a suppression list rather than be deleted, and the list should be checked before every send, in every tool you use.
08
When a managed service makes sense
If you sell to UK or Irish businesses and want outreach run within these rules, that is what B2B Email Outreach covers. I write the emails, send them from your own mailbox, follow up and report back, with the sending and warm-up tools included, for €450 a month, and Lead Generation supplies verified leads at €0.09 each, with a minimum of 1,000 (the pricing page, read 2026-10-20). Contact lists are separate from the outreach fee, and the list is sorted into the two groups before any UK contact is emailed. Legal advice is not included, and you stay responsible for confirming the rules that apply to your campaign.
To start, send a short written brief through the contact page, and I confirm the scope in writing before any payment.
09
Sources
- Business to business marketing, guidance from the Information Commissioner's Office (opens in a new tab) — checked 2026-10-20
- Regulation 22 of the Privacy and Electronic Communications Regulations 2003, the latest revised text (opens in a new tab) — checked 2026-10-20
- The right to object in the UK GDPR, latest revised text (opens in a new tab) — checked 2026-10-20