UK Cold Email Rules: PECR, UK GDPR and Company vs Sole Trader Addresses

What does PECR regulation 22 say about cold email?

Two sets of rules apply to a UK cold email. The Privacy and Electronic Communications Regulations 2003 (PECR) decide whether you may send at all. UK GDPR decides what you must do with the person's data. They are separate, and a message can pass one and fail the other.

Regulation 22 covers unsolicited marketing by electronic mail sent to individual subscribers. Paragraph 2 says you may not send, or instigate the sending of, that marketing unless the recipient has told the sender they consent to such emails being sent by, or at the instigation of, that sender. The consent has to be to you. A box ticked on someone else's website does not move across to you.

Paragraph 3 is the so-called soft opt-in. You may email without prior consent if you got the person's contact details in the course of a sale, or negotiations for a sale, of a product or service to them; you are marketing only your similar products and services; and you gave them a simple, free way to refuse at the time you collected the details and in every later message. A cold prospect fails the first condition, because there has been no sale or negotiation.

Who counts as an individual subscriber and who counts as a corporate subscriber?

Regulation 22 applies to individual subscribers. The definitions sit in regulation 2. An "individual" is a living individual and includes an unincorporated body of such individuals. A "corporate subscriber" includes a company, a company incorporated by royal charter or letters patent, a partnership in Scotland, a corporation sole, and any other body corporate or entity that is a legal person separate from its members. A "subscriber" is the party to the contract with the provider of the public electronic communications service.

Two traps follow from the wording. First, the test is who holds the contract for the email service, not what the address looks like. A named employee using the company's mailbox sits on the company's subscription, so the subscriber is the company. A sole trader who writes to you from a personal address is a different case. Second, you often cannot tell from the address alone. If you cannot establish that a recipient is a corporate subscriber, treat them as an individual until you can.

What applies even when the recipient is a company?

Regulation 22's consent rule drops away for corporate subscribers. Regulation 23 does not. It bars direct marketing email where the identity of the sender has been disguised or concealed, or where a valid address to which the recipient can send a request that such communications cease has not been provided. That applies whoever the recipient is.

UK GDPR then applies whenever the address identifies a person, as first.last@company.com does. A role address such as sales@ may identify nobody, but check that it is not in practice one person's inbox. For a person you must have a lawful basis. Consent is one. Article 6(1)(f), legitimate interests, is the usual basis for B2B cold email, and it is a balancing test: the processing must be necessary for your interests, and those interests must not be overridden by the person's rights.

1. Tell them. Where you did not collect the data from the person, Article 14 requires you to give them your identity, the purpose and legal basis, the legitimate interest you rely on, their rights and the source of the data. The timing is the first communication at the latest, where you are using the data to contact them, and within one month in any case. Putting it in the first email, with a link to a privacy notice, is the practical answer.
2. Stop when they object. Article 21(2) and (3) give the person a right to object to direct marketing at any time, and once they do the data must no longer be processed for that purpose. There is no balancing test at that point. Article 21(4) says the right must be brought to their attention clearly and separately at the latest at the first communication.
3. Keep a record. Note where the address came from and when. You will need it to answer the "where did you get my details" reply.

What did the Data (Use and Access) Act 2025 change for cold email?

Less than the headlines suggest, for commercial senders. Section 114 amends regulation 22 only to add a charity route: a charity may send direct marketing email without prior consent where the sole purpose is its charitable purposes, the contact details came from the person showing interest or support, and a simple refusal option was given. It does not change the rules for companies selling products or services. The corporate-subscriber position and the soft opt-in conditions in regulation 22 read the same way as before.

The change that matters is the penalty. Section 115 replaced regulation 31 so that the regulator enforces PECR through provisions of the Data Protection Act 2018. From 30 September 2026 the regulation's wording refers to the Information Commission. Schedule 1, paragraph 18 applies section 157 of that Act to PECR penalties and lists regulations 22 and 23 among the provisions it covers. On our reading, that puts breaches of those regulations under the higher maximum in section 157: £17.5 million or 4% of worldwide annual turnover, whichever is higher. These provisions took effect on 5 February 2026 under S.I. 2026/82, according to the commencement notes on legislation.gov.uk.

Worked example: three prospects, three different answers

A checklist before you send to UK prospects

1. Screen out sole traders and England, Wales and Northern Ireland partnerships unless you hold their consent. Companies House can confirm a limited company or LLP.
2. Write down your legitimate interests assessment for B2B cold email: the interest, why email is necessary, and why the person would reasonably expect it given their role.
3. Put your company name, a real postal or contact address and a one-line reason for contacting them in the first email, with a link to a privacy notice that covers the Article 14 items.
4. Give a reply-to-stop route and a link, and process every objection against all your sending inboxes and campaigns. How to build that list is covered in our guide to cold email unsubscribe law and suppression lists.
5. Keep the source and date of each address.
6. Check your sending setup against Gmail, Yahoo and Microsoft's rules, which can block you whatever the law allows: bulk sender rules explained.

How does this affect what MAJ Leads is building?

We are building cold email into MAJ Leads now, so this page is the rulebook we are working from, not a report on live campaigns. For UK recipients it means a sender-type check before a prospect enters a sequence, a suppression check on every send, and an unsubscribe route in every message. Where the product is today is described on how it works, and plans are on pricing. If you also sell into the UAE, the rules differ; our guide to buying and building compliant B2B lists covers the UK, EU, US and UAE side by side.