GDPR Rules for Email Marketing: A UK Small Business Guide
This article contains affiliate links. If you purchase through a link on this site, we may earn a commission at no extra cost to you.
Why Email Marketing Compliance Trips People Up
Email marketing is one of the cheapest things a small business can do, and one of the easiest to get legally wrong. Not through recklessness, but because the rules live in two separate pieces of legislation and the guidance is scattered.
If you have wondered whether you can email the list you built at a networking event, whether B2B contacts are treated differently, or what consent actually has to look like, this covers it. It also covers what changed in February 2026, which most published guidance has not caught up with.
The Two Laws
People say GDPR when they mean email marketing law. That is half the picture.
UK GDPR governs how you process and store personal data.
PECR, the Privacy and Electronic Communications Regulations 2003, governs whether you may send the marketing email at all.
PECR is the gatekeeper at the door; UK GDPR is the filing system for what happens inside. You have to comply with both, and a lawful basis under UK GDPR does not get you past PECR.
What Changed in February 2026
The Data (Use and Access) Act 2025 came into force on 5 February 2026 and changed the stakes rather than the rules.
Fines went up sharply. The maximum penalty for breaching PECR’s marketing rules rose from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher, aligning PECR with UK GDPR. Any guidance still quoting a £500,000 ceiling predates the change.
The damage test disappeared. The requirement to show that a breach caused substantial damage or distress has been removed, which lowers the bar for enforcement.
Charities gained a soft opt-in. The exception described below was extended to charities contacting people who have previously supported them, subject to conditions.
Complaints need a process. Organisations are now expected to have a route for handling data protection complaints.
For a small business the realistic exposure remains a complaint and an investigation rather than a headline fine. The point is that sloppy marketing data is no longer a cheap risk.
Consent: What the ICO Actually Requires
The Standard
Under UK GDPR, consent must be:
- Freely given, not bundled into terms or made a condition of service
- Specific, so the person knows what they are agreeing to receive
- Informed, naming your organisation and what you will send
- Unambiguous, given by a clear affirmative action such as ticking an unticked box
Pre-ticked boxes are not consent. Neither is a line buried in small print. The requirement is a positive opt-in.
What a Valid Record Looks Like
Obtaining consent is one thing. Proving it is the thing that fails. The burden of proof sits with you, and you need to be able to show:
- Who consented and when
- What they were told at that moment
- How they consented, meaning which form or mechanism
- That they have not since withdrawn it
A spreadsheet of names and addresses does not do this. You need a timestamped record tied to the specific sign-up, including the wording that was on screen at the time. That is the practical argument for using a proper platform rather than a list in a mail client.
The Soft Opt-In
What It Is
An exception under Regulation 22 of PECR that lets you email existing customers without explicit consent, provided all three of these are true:
- You obtained the details in the course of a sale or negotiations for a sale, not just any business interaction
- You are marketing your own similar products or services
- You gave a clear chance to opt out when you collected the details and in every message since
Miss one and the exception does not apply.
Where It Goes Wrong
The common mistake is treating any warm contact as a customer. Downloading a free guide, following you on LinkedIn or handing over a business card does not create the relationship. There has to have been a genuine transaction or genuine negotiation towards one.
The second mistake is relying on it forever. There is no statutory time limit, but the relationship has to remain meaningfully connected to that original sale. Somebody who bought once three years ago and has heard nothing since is thin ground.
B2B and B2C Are Genuinely Different
This matters for anyone selling to other businesses.
Individual subscribers, which includes consumers, sole traders and unincorporated partnerships, are fully covered by the PECR consent rule. You need consent or a valid soft opt-in.
Corporate subscribers, meaning limited companies, LLPs and public authorities, are not. You can email a corporate address without prior consent. Three obligations remain:
- You must give a clear opt-out and honour it promptly
- UK GDPR still applies to any identifiable individual, so jane.smith@company.co.uk is personal data even in a B2B context
- Your transparency obligations still apply, including telling people how you got their details
In practice, most B2B marketing goes to named individuals, so treat it with the same care as consumer marketing. The PECR concession is narrower than it looks.
The Unsubscribe Requirement
PECR requires that the sender is identified and that a valid address is given for opt-out requests, and the soft opt-in requires an opt-out at collection and in every subsequent message. In practice that means:
- A working unsubscribe mechanism in every marketing email
- Acting on opt-outs promptly, with no further marketing afterwards
- No charge and no obstacle course for unsubscribing
Any competent platform handles this automatically and suppresses opted-out contacts from future sends, which is one more argument against sending from a mail client.
How Long You Can Keep a List
UK GDPR sets no fixed period. The storage limitation principle says you keep personal data only as long as you need it for the purpose you collected it for, and accountability says you should be able to show how you decided that.
For marketing lists that means: subscribers who have not engaged in a long period, commonly taken as 12 to 24 months, are hard to argue are still consenting to hear from you; you should have a written retention position for marketing data; and you should clean or re-confirm cold contacts periodically rather than letting the list accumulate.
The Legacy List Problem, and the Re-Permission Trap
The biggest practical risk is the list nobody can account for: contacts imported from an old system, bought from a third party, or collected by means no one remembers. If you cannot evidence consent, you cannot safely rely on it.
Here is the trap. The obvious fix is a re-permission campaign asking people to opt in again, and for individual subscribers that email is itself direct marketing. If you had no lawful basis to email them, you have no lawful basis to email them asking. The ICO has taken enforcement action against companies for exactly this, on the basis that “are you still happy to hear from us” messages were marketing sent without consent.
That does not make re-permission impossible, but it does mean thinking about the legal basis for that specific send before you do it, and it makes suppression the safer default for contacts you genuinely cannot evidence. Losing contacts is cheaper than defending the list.
Tools That Keep the Record
Compliance depends on evidence, which makes the platform choice a practical matter rather than a convenience.
Transpond is a UK email marketing platform from the same company as Capsule CRM, which is why the two integrate closely. It bills in pounds: Starter at £7.20 a month billed annually or £8 monthly at 250 contacts, Growth at £14.40 or £16, Advanced at £40.50 or £45, and Ultimate at £67.50 or £75. Annual billing saves 10%, and pricing scales with contact volume, so check the tier for your actual list size.
Mailchimp is the familiar option, with a free tier at 250 contacts and 500 sends a month, then Essentials at £10, Standard at £15 and Premium at £262 for 10,000 contacts, all excluding VAT.
Capsule CRM keeps detailed contact histories and pairs natively with Transpond. Its free plan covers two users and 250 contacts with no automations, and paid plans start at £14 per user per month billed annually.
HubSpot logs every form submission and interaction, which makes it strong on audit trail. Note the free tier is capped at two users, and the Starter plan advertised at £7 is a promotional rate against a £18 list price.
Brevo and similar tools also offer consent-focused forms and EU or UK data storage options; confirm current pricing directly.
The question to ask any vendor is simple: can you show me, for any contact, when they subscribed, through which form, and what the opt-in wording said at the time? If the answer is yes, you have your evidence.
FAQ
Do I need consent to email people I met at a networking event?
Not automatically. Exchanging cards creates no consent. For individuals, including sole traders, you need consent or a valid soft opt-in. For a corporate address at a limited company the PECR position is lighter, but UK GDPR transparency still applies.
Can I rely on legitimate interests instead of consent?
Not for the send itself. Legitimate interests can be your UK GDPR lawful basis for processing, but PECR still requires consent or the soft opt-in for electronic marketing to individuals. One does not substitute for the other.
How long does consent last?
No fixed period in law. The ICO’s position is that it should be refreshed when it is no longer specific, informed and unambiguous, and in practice that means reconsidering contacts who have not engaged for 12 to 24 months.
What happens if someone complains?
They can report you to the ICO, which will look at whether you complied with both PECR and UK GDPR. A first complaint against a small business usually produces guidance or an enforcement notice rather than a penalty, but the ceiling for serious or repeated breaches is now £17.5 million or 4% of turnover, and the old requirement to show substantial damage or distress has gone.
Does any of this apply to transactional emails?
No. Order confirmations, invoices and service messages are not direct marketing. The line blurs when you add promotional content to them, at which point the marketing rules apply to the whole message.
GDPR Rules for Email Marketing: The Bottom Line
The requirements are narrower than they feel. Get consent or rely properly on the soft opt-in, record it so you can prove it, say what people are signing up for, and put a working unsubscribe in every message.
The single most useful change most small businesses can make is moving off improvised list management and onto a platform that logs consent automatically, because the evidence is what you will be asked for.
And if you are unsure about an old list, suppress rather than send. Since February 2026 the downside has been considerably larger than the value of a stale contact.
Prices and plan features correct at time of writing and subject to change; confirm current details with the provider. This article is general information about UK data protection law, not legal advice, and it does not take account of your circumstances. Check the current position with the ICO and take professional advice on your own marketing data.