UK GDPR and Email Marketing: The Plain-English Guide
What UK GDPR and PECR mean for email marketing - consent, soft opt-in, records and rights, explained without jargon.
This is general information about UK GDPR and PECR as they apply to email marketing - not legal advice. It explains the practical rules that shape how UK businesses can and should email.
Two main laws to know
- UK GDPR (UK General Data Protection Regulation): the data protection law that governs how you collect, store and use people's personal data - including email addresses.
- PECR (Privacy and Electronic Communications Regulations): the law that governs electronic marketing, including who you can email and what consent is needed.
Consent and electronic marketing
PECR generally requires consent to send marketing emails to individuals. The ICO's current guidance is that the soft opt-in is no longer available for email/text marketing - so for individuals, you normally need proper consent, not a 'soft opt-in' loophole. For B2B, the rules around corporate subscribers and legitimate interests are nuanced; take specific advice and check the ICO's latest guidance.
What counts as valid consent
- Genuine and freely given - not required to get a service.
- Unambiguous and specific about what they're signing up for.
- Given by a clear, positive action (no pre-ticked boxes).
- Recorded - keep evidence of when and how consent was given.
- Easy to withdraw - clear unsubscribe, processed promptly.
Data protection basics
- Only collect data you need, for a clear purpose.
- Tell people what you do with their data (privacy notice).
- Keep data accurate and secure.
- Honour rights: access, erasure, data portability.
- Only keep data as long as you need it.
Practical habits
Use double opt-in to evidence consent, keep unsubscribe links clear and working, maintain a compliant privacy policy, and document your lawful bases. When in doubt, seek professional advice - getting this wrong carries real penalties.