Fix Consent Before Your Next Send: UK GDPR Email Marketing

Yes, you can run email marketing in the UK, but only with valid consent or when the strict PECR soft opt-in applies. UK GDPR and the Privacy and Electronic Communications Regulations (PECR) work together to set these rules, and the Information Commissioner’s Office (ICO) enforces both. Get the legal basis wrong, and every email that follows carries risk.

TL;DR:

• A follow up confirmation is not legally required, but it improves consent records and catches mistyped email addresses before they enter your list.
• Soft opt in requires details gathered during a similar sale, an opt out at collection, and an opt out in every marketing email.
• Purchased lists never qualify for the soft opt in, and vendor claims do not prove people consented to your brand’s marketing.
• Every marketing email needs a working unsubscribe link and clear sender identity; quarterly list audits can flag missing consent or expired eligibility.
• PECR treats sole traders and partnerships like individuals, while generic corporate inboxes face fewer limits; UK GDPR still covers personal data about named contacts.

Table of Contents

• How UK GDPR and PECR interact for email marketing
• What valid consent looks like under UK rules
• Soft opt-in (PECR Regulation 22): when it applies and the strict limits
• B2B vs B2C: corporate subscribers, sole traders and personal data in business contacts
• Operational checklist: immediate fixes for signup, unsubscribe, records, and audits
• A short agency workflow for implementing GDPR-compliant email programs
• How to conduct GDPR-compliant email list building strategies
• Managing data subject rights in email marketing
• Impact of GDPR on third-party data and purchased email lists
• Best practices for data protection impact assessments (DPIAs) related to email marketing
• Technical and organizational measures for secure email marketing campaigns
• Handling cross-border data transfers within email marketing under GDPR
• Agency perspective: why investing in consent and list hygiene pays off
• Vertical’s services for compliant email marketing: audit and implementation
• FAQ
• Sources

How UK GDPR and PECR interact for email marketing

UK GDPR gives you several lawful bases for processing personal data, including consent and legitimate interests. PECR sits alongside it and governs the specific act of sending electronic mail for marketing purposes. Where the two overlap, PECR usually wins the argument.

As the ICO explains, you need a valid data protection lawful basis for direct marketing, and PECR can require consent for electronic mail. When PECR mandates consent, legitimate interests stops being an option, no matter how compelling your business case feels.

Picture two scenarios. A business emailing new prospects who have never bought from it needs specific consent under PECR, full stop. A business emailing existing customers about a closely related product, having given them a clear opt-out at the point of sale, may be able to rely on the soft opt-in instead. The legal basis you choose depends entirely on how the contact was collected and what you plan to send.

What valid consent looks like under UK rules

Consent under UK GDPR has to be real, not implied. The ICO’s guidance on electronic and telephone marketing is clear that pre-ticked boxes do not count, and neither does consent buried inside a terms and conditions agreement.

Valid consent needs to be:

• An affirmative action, such as ticking an unticked box or clicking a clearly labeled button.
• Separate from acceptance of your terms and conditions or any other agreement.
• Specific to the channel (email) and the purpose (marketing) you intend to use.
• Documented, with a record of what the person agreed to and when.

Two examples of compliant phrasing: “Tick here to receive offers and product news by email” next to an unticked checkbox, or “Yes, email me styling tips and new arrivals” as a standalone opt-in on a signup form. Neither sentence hides inside a wall of legal text.

Double opt-in, where a subscriber confirms their email address via a follow-up link, is not a legal requirement, but it gives you a cleaner record and weeds out mistyped addresses.

Pro Tip: Store the exact checkbox copy, the date, the source page, and the subscriber’s IP address alongside every consent record, not just a “yes” flag.

Soft opt-in (PECR Regulation 22): when it applies and the strict limits

The soft opt-in, set out in PECR Regulation 22, is the one route that lets you email existing customers without separate marketing consent. It is narrow by design, and all three conditions have to be met together.

1. You collected the contact details during the sale or negotiation of a similar product or service.
2. You gave the person a clear chance to opt out of marketing at the point you collected their details.
3. You offer an opt-out in every marketing message you send afterward.

Miss any one of those steps and the soft opt-in falls away. Bought-in or rented lists never qualify, because you did not collect the details through a direct sale. Promoting a product that has little relation to the original purchase disqualifies it too, and so does a signup form that never offered an opt-out in the first place.

Before you email an existing list under soft opt-in, run a quick audit: confirm how each contact was collected, check whether an opt-out was genuinely offered at that moment, and verify the product you’re promoting is similar enough to the original purchase. If you can’t answer all three with confidence, treat the contact as needing fresh consent.

B2B vs B2C: corporate subscribers, sole traders and personal data in business contacts

PECR’s electronic mail rule only protects “individual subscribers,” and corporate bodies fall outside that definition. According to ICO guidance on business-to-business marketing, emailing a generic inbox like info@company.co.uk is generally less constrained by PECR, though UK GDPR still governs any personal data you hold about the individual you’re contacting.

Sole traders, partnerships, and some unincorporated businesses are treated as individuals under PECR, which means they need the same consent or soft opt-in protection as a consumer.

Practical handling for B2B lists:

• Check whether a contact is a limited company, a sole trader, or a partnership before deciding which rules apply.
• Record objections to marketing from any business contact and suppress them immediately, regardless of PECR status.
• Keep named-individual data (job title, direct email, phone number) governed by UK GDPR even when PECR doesn’t apply.

Operational checklist: immediate fixes for signup, unsubscribe, records, and audits

Most compliance failures happen in the details, not the headline legal basis. The ICO’s guidance on electronic mail marketing lists the practical checklist items regulators actually check.

• Use channel-specific consent: a checkbox for email does not cover SMS or phone.
• Leave opt-in boxes unticked by default, never pre-checked.
• Offer a clear opt-out at the point you collect any contact detail you plan to use for marketing.
• Include a working unsubscribe link in every single marketing email.
• Show a clear sender name and a real contact address in each message.
• Maintain a do-not-contact list and suppress those contacts across every send.
• Date-stamp every consent record so you can prove when and how it was given.

On the technical side, separate your marketing sends from transactional emails in your email service provider, add consent fields to your CRM, and screen any third-party list before it touches your sending platform. A quarterly list audit that flags contacts with no valid consent record or expired soft opt-in eligibility, as described in ICO guidance on choosing a lawful basis, catches problems before a complaint does.

A short agency workflow for implementing GDPR-compliant email programs

Turning a checklist into a live, compliant program takes more than a one-off review. We run new and existing clients through a structured workflow:

• Legal review: map every active list and signup source against PECR and UK GDPR requirements.
• Consent-capture redesign: rebuild signup forms and checkout flows so opt-in language is clear and unticked.
• List audit and segmentation: separate soft opt-in eligible contacts, fully consented contacts, and ineligible contacts.
• Deliverability fixes: clean sending reputation once unengaged or non-compliant contacts are removed.
• Monitoring and reporting: track consent status, unsubscribe rates, and complaint volume over time.

We map every consent source directly to CRM fields, as outlined in our CRM guidance for ecommerce teams, and pair list cleanup with the fixes in our deliverability guide for ecommerce.

Pro Tip: Run your consent-capture redesign before your list audit. A cleaner signup flow going forward matters more than perfecting historic records you can no longer change.

How to conduct GDPR-compliant email list building strategies

Building a list the right way starts with where the signup happens, not with the email tool you use afterward. Every form, whether on a website, at a till, or inside an app, needs a standalone opt-in that names email marketing specifically.

Gated content, such as a downloadable guide or discount code, can sit alongside a marketing checkbox, but the checkbox still needs to be separate and unticked. Bundling “download this” with “and sign me up” into one action is not valid consent.

Events, trade shows, and in-person signups need the same rigor as online forms. A paper signup sheet with no opt-out language offered does not meet PECR’s soft opt-in test, and it doesn’t create valid consent either, since there’s no record of what the person actually agreed to.

Partnering with another brand for a joint competition or co-branded content creates a particular risk: you cannot assume consent given to one brand extends to the other. Each brand needs its own clear, separate opt-in if both plan to email the entrant.

Re-permissioning campaigns, where you ask a dormant list to reconfirm interest, are a practical way to rebuild a list that has drifted into uncertain consent status. We cover sequencing for these in our winback email strategy guide for UK teams, which pairs re-permission messaging with suppression rules for non-responders.

Whatever channel you use, the test stays the same: can you point to a specific, documented, affirmative action that matches the email marketing you’re now sending.

Managing data subject rights in email marketing

UK GDPR gives every subscriber rights over their data that your email program has to respect in practice, not just in a privacy policy. The three that come up most often in email marketing are access, rectification, and erasure.

A subscriber can ask what data you hold on them, including their consent record, email engagement history, and any segments or tags you’ve applied. You need a process to pull that together within statutory timeframes, not a scramble through spreadsheets.

Rectification requests are usually simple: someone wants an incorrect name, email address, or preference corrected. Build a self-serve preference center where possible, since it reduces the volume of manual requests and keeps records more accurate from the start.

Erasure, often called the right to be forgotten, means removing someone from your active marketing lists and underlying database when they ask, not just unsubscribing them from future campaigns while their data sits untouched elsewhere. Unsubscribing stops sends; erasure removes the record. Your CRM and ESP both need a documented process for the difference, and your suppression list needs to persist even after personal data is deleted, so you don’t accidentally re-add someone who already opted out.

Impact of GDPR on third-party data and purchased email lists

Purchased and rented email lists carry a structural problem under UK GDPR and PECR that no amount of list cleaning fully solves: you cannot verify the consent was given for your specific marketing, from your specific brand.

PECR’s soft opt-in exception requires that you collected the contact details yourself during a sale or negotiation. A third-party list fails that test by definition, since you had no direct relationship with the person when their details were gathered.

Even where a list vendor claims the contacts “opted in,” UK GDPR places the burden of proof on you, the sender, to show valid consent exists for your messages specifically. A generic opt-in to “receive offers from selected partners” rarely meets the GDPR standard of specific, informed consent, because the subscriber had no way to know your brand would be among those partners.

Co-registration and lead-generation forms that promise data to multiple advertisers carry the same weakness. If you’re the fifth brand down a list of “partners,” the consent is almost never specific enough to defend.

The safer path is building first-party lists through your own signup forms, checkout flows, and events, where you control the consent language and can document it directly. If you’re evaluating a third-party list, treat it as a lead source for a separate, GDPR-compliant permission campaign rather than as a list you can email immediately.

Best practices for data protection impact assessments (DPIAs) related to email marketing

A Data Protection Impact Assessment (DPIA) isn’t automatically required for every email program, but it becomes relevant when your email marketing involves large-scale profiling, automated decision-making, or special category data, such as health-related purchase history used to personalize content.

Start a DPIA by mapping the data flow: where email addresses come from, what other data points you attach to them (purchase history, browsing behavior, demographic inferences), and where that combined profile gets used to target or segment sends.

Identify the risk to subscribers specifically. Profiling someone’s purchase history to send relevant product recommendations carries a different risk level than inferring sensitive personal circumstances from browsing patterns and emailing accordingly.

Document the safeguards you have in place: access controls on the CRM, retention limits on inactive subscriber data, and a clear process for honoring opt-outs across every system that holds the contact.

Review the DPIA whenever your email program changes meaningfully, such as adding a new data source, a new segmentation method, or a new automated trigger based on behavioral data. A DPIA completed once at launch and never revisited stops reflecting what your program actually does within a year or two.

Technical and organizational measures for secure email marketing campaigns

UK GDPR requires appropriate technical and organizational measures to protect personal data, and your email marketing stack holds plenty of it: names, addresses, purchase history, and behavioral data tied to each subscriber.

On the technical side, restrict access to your CRM and email service provider to the team members who need it, and use role-based permissions rather than giving every marketer full export rights. Encrypt subscriber data both in storage and in transit between your website, CRM, and email platform. Authenticate your sending domain with SPF, DKIM, and DMARC, which protects subscriber trust and sender reputation at the same time. Partner support from a specialist like Digistrat’s email deliverability audit can catch authentication gaps that quietly undermine both security and inbox placement.

On the organizational side, train everyone who touches subscriber data on consent requirements and data handling, not just the marketing team. Set clear retention periods so inactive subscribers don’t sit in your database indefinitely, and build an incident response process so a data breach involving your email list gets reported and handled within the required timeframes.

Handling cross-border data transfers within email marketing under GDPR

Most email service providers and marketing platforms process data outside the UK, which means cross-border transfer rules apply the moment your subscriber data leaves UK servers.

UK GDPR requires that personal data transferred outside the UK goes to a country with an adequacy decision, or is protected by an appropriate safeguard, such as the UK’s International Data Transfer Agreement or a UK Addendum to the EU’s Standard Contractual Clauses.

Before choosing an email service provider, check where it stores and processes data, and confirm what transfer mechanism it has in place for UK customer data specifically. Most major platforms publish this information in their data processing agreements, and it’s worth reviewing before you sign up, not after a subscriber asks where their data lives.

If you use a CRM, an ESP, and a separate analytics tool, each one may process subscriber data in a different location. Map all three rather than assuming your main platform’s compliance covers the whole stack.

Agency perspective: why investing in consent and list hygiene pays off

Clean consent and clean lists do more than reduce legal risk. They improve inbox placement directly, since internet service providers increasingly weight engagement signals, and engaged subscribers only exist when consent was genuine in the first place. The businesses treating compliance as a growth lever, not a cost, consistently see stronger open rates and fewer spam complaints. Prioritize consent capture and a quarterly list audit before you invest further in send volume.

— Alex

Vertical’s services for compliant email marketing: audit and implementation

Getting the legal basis right is only the first step. Translating it into a signup flow that converts, a CRM that tracks consent properly, and a sending program that lands in the inbox takes ongoing attention most internal teams don’t have the capacity for.

We offer email marketing, CRM management, and growth marketing services UK teams can use to move from a legal checklist to a live, compliant program, including signup flow redesign, list segmentation, and deliverability monitoring alongside paid media and creative work. If your current email program needs a compliance audit paired with an execution plan, book a strategy call through our services page and we’ll map out what needs to change first.

FAQ

Is email marketing allowed under the GDPR?

Yes, email marketing is allowed under UK GDPR and PECR, but only with a valid lawful basis, which for most electronic mail means specific prior consent. A narrow soft opt-in exception under PECR Regulation 22 allows marketing to existing customers in limited circumstances without separate consent.

What are the legal requirements for email marketing in the UK?

UK email marketing requires either valid, affirmative, documented consent or a qualifying soft opt-in, plus an unsubscribe option in every message and clear sender identity. Gov confirms you must check that customers want to be contacted and be able to prove you have permission.

Does GDPR apply to the United Kingdom?

Yes, UK GDPR applies to the United Kingdom as the retained version of the EU General Data Protection Regulation, enforced by the ICO alongside PECR. It governs how you collect, store, and use personal data, including email addresses used for marketing.

What is GDPR compliance in email marketing?

GDPR compliance in email marketing means having a valid lawful basis for every send, keeping documented consent records, honoring unsubscribe and data subject requests promptly, and only transferring subscriber data abroad with an appropriate safeguard in place. The ICO’s electronic mail marketing guidance sets out the practical checklist behind that standard.

Sources

• The Privacy and Electronic Communications (EC Directive) Regulations 2003 — Regulation 22
• Sending direct marketing: Choosing your lawful basis | ICO
• Gov

Recommended

• Protect Deliverability: 3 Winback Email Strategy Sequences for UK Teams
• Stop Revenue Swings: 3 Email Deliverability Fixes for Ecommerce
• 3 Email Welcome Series Templates Marketing Teams Can Copy Today