Cold email to UK and EU businesses: the basics

Two sets of rules apply

In the UK, electronic marketing is covered by the Privacy and Electronic Communications Regulations (PECR), while the personal data you use, such as a named person’s email address, is covered by UK GDPR and the Data Protection Act 2018. You need to satisfy both.

In the EU, the ePrivacy Directive sets the rules for electronic marketing, but each country writes them into its own law. GDPR governs the personal data.

Companies versus sole traders

Under PECR, the strict consent rules for marketing email apply to individual subscribers. Corporate subscribers, such as limited companies, limited liability partnerships and government bodies, are treated differently: you can usually email them without prior consent, but you must say who you are and give a valid address where they can opt out.

Sole traders and some partnerships count as individual subscribers, so the consent rules, or the narrow soft opt-in for existing customers, apply to them. This matters for small-business prospecting, because many small businesses are sole traders.

Where GDPR comes in

If you email a named person at a company, you are processing their personal data. In practice that means:

• A lawful basis. Many businesses rely on legitimate interests for B2B prospecting, which means weighing your interest against the person’s and recording that assessment.
• Transparency. Tell people who you are, where you got their details and how you use them, at the latest in your first message to them.
• The right to object. If someone objects to direct marketing, you must stop. There are no exceptions to this one.
• Data minimisation. Collect only what you need, keep it accurate and do not keep it longer than necessary.

EU countries differ

Because each EU country implements the ePrivacy rules separately, the treatment of business email varies. Some countries allow unsolicited email to businesses with an opt-out, while others apply consent requirements even to business recipients; Germany is often cited as a strict example. Check the guidance from the regulator in the recipient’s country before you send.

What this looks like in practice

• Check whether each business is a company or a sole trader before you email it.
• Identify yourself clearly and include a working way to opt out in every email.
• Add a short line on where you found their details, and link to your privacy notice.
• Keep a suppression list and honour objections immediately.
• Keep a record of your lawful basis and the checks you made.