Cold Email in the UK: What PECR Allows

Yes, a cold email to a business in the UK can be legal. Under PECR, you can email a limited company, an LLP, a Scottish partnership or a public body with its own legal status, such as a council, without consent. Each email must name the sender and give a valid address for opting out.

Sole traders and most other partnerships count as individuals, so they need consent or a soft opt-in. Once an address names a person, UK GDPR applies too.

An invented example runs through this article: a small signage company in Dundee that wants to email 60 local businesses about shop signs.

What counts as a cold email under PECR

A cold email is a sales email sent to someone who has not asked for it and has no relationship with you. The Privacy and Electronic Communications Regulations 2003 (PECR) call this unsolicited direct marketing by electronic mail.

The purpose decides, not the wording. The Information Commission's Office (ICO) says in its B2B marketing guidance that direct marketing covers all advertising, marketing or promotional material. An email that introduces your service and offers a free site visit is still marketing.

Texts and social media direct messages are covered too. PECR's "electronic mail" means any message stored until the recipient collects it (ICO).

If the person asked you to send it, the email is solicited. You need no consent for it, but the identity and opt-out rules below still apply (ICO).

Who you can cold email: recipient types

PECR's consent rule for marketing email protects individual subscribers only (regulation 22). A corporate subscriber is a legal person separate from its members, for example a company (regulation 2). The recipient's legal form, not its size, decides whether a cold email is allowed.

The Dundee company's list holds every type below.

Recipient type	Example on the Dundee list	Cold email without consent?
Limited company or public limited company (PLC)	A café group trading as a limited company	Yes
Limited liability partnership (LLP)	A firm of solicitors registered as an LLP	Yes
Scottish partnership, including a Scottish limited partnership	A two-partner accountancy practice in Dundee	Yes
Public body with its own legal status	The council's events team	Yes
Sole trader	A self-employed electrician	No: consent needed
Ordinary or limited partnership in England, Wales or Northern Ireland	A similar accountancy practice based in Newcastle	No
Unincorporated club or association	A traders' association run by volunteers	No
Personal address used for work	A café owner who gave a Gmail address	No

Unsure which type you are dealing with? The ICO advises assuming an individual subscriber.

For individual subscribers you have never dealt with, the soft opt-in does not help. It covers only people who bought, or negotiated to buy, from you. ICO guidance rules out prospective customers.

On 25 October 2026, Google's AI Overview for "is cold emailing legal uk" said the pitch must be "genuinely relevant to the recipient's job role". Neither PECR nor the ICO's guidance for B2B marketing sets that test. Relevance helps under UK GDPR instead, where a message that fits the reader's role is easier to justify.

None of this is legal advice. It reflects the PECR text and the ICO's pages as they stood on that date. If a business on your list fits no row of the table, take that one contact to a data protection adviser.

How to check if a business is a corporate subscriber

Public records settle most cases. The Dundee company runs four checks before an address goes on its list:

1. Read the website footer or legal page. A limited company must show its registered number and registered office on its website (gov.uk).
2. Search the name or number on Companies House's free Find and update company information service, which shows each entity's type.
3. Check where a partnership is based. Scottish partnerships are legal persons, so they count as corporate. An ordinary Scottish partnership has no Companies House record, so look for a Scottish address in its site footer; if you are unsure, treat it as an individual. Outside Scotland, even a limited partnership is not legally separate from its partners (gov.uk).
4. If nothing points to a corporate form, or the business trades under a person's own name, handle it as a sole trader.

The signage firm writes the date and the result next to each contact. If anyone later asks why their business received a cold email, the note answers.

Generic and named business addresses

PECR treats info@ and a named address at the same limited company alike; data protection law does not. An address that identifies nobody is not personal data, so UK GDPR has nothing to cover.

An address such as j.smith@ identifies a person, which brings in a lawful basis, privacy information and an absolute right to object (ICO).

What every cold email must include

Every marketing email must show who it is from and offer a working opt-out address, whoever receives it (regulation 23). Regulation 23 also requires the email to meet regulation 7 of the Electronic Commerce Regulations 2002.

Open tracking needs its own check. The same B2B guidance says PECR's rules on cookies and similar technologies apply to a tracking pixel when it stores or reads information on the reader's device, for every type of subscriber. If your email tool adds a pixel, find out what it reads before the first send.

What to do when someone opts out

Stop emailing anyone who asks, whatever type of address it is. The legal basis for that duty differs by recipient, according to the ICO's B2B guidance:

• Sole trader or partnership outside Scotland: once they opt out, you cannot start or continue emailing them.
• Named address at a company: the UK GDPR right to object to direct marketing is absolute.
• Generic address at a company: PECR does not say you must comply. The ICO expects you to anyway, because PECR requires an opt-out address for a reason.

The same guidance asks you to keep the address on a suppression list instead of deleting every record of it, and to screen each new list against it. A deleted address can return with the next list you build; a suppressed one cannot.

Legitimate interests for named business contacts

For a named business contact, legitimate interests is the likely lawful basis. The ICO marks it as likely to suit emails to business contacts, though not automatically (ICO).

You must pass three tests: a real interest, a need to email to serve it, and a balance in your favour once the person's interests are weighed. The ICO notes that business contacts are more likely to expect their details to be used in a business context.

No article of the UK GDPR demands a written assessment. The ICO recommends one anyway, done before you start, and publishes a sample template (ICO). For the Dundee firm, one page covers it: why these businesses, why each recipient would expect an email about signs, where each address came from, how many emails, and how people stop them.

Bought, scraped and public lists

A bought list puts the legal risk on you, the sender. The corporate addresses on it can still be emailed cold. For a sole trader on the list, only consent naming your business will do; consent given to "trusted partners" fails that test (ICO).

For named contacts, UK GDPR makes you the controller from the day you buy. In one ICO example, people who gave their details to attend a conference would not expect them to be sold, so the sale was likely unfair. If the seller cannot show that people were told, that problem becomes yours.

Publicly available does not mean agreed, but context counts. The regulator accepts that someone whose work details sit on their employer's website "may well expect" contact from other businesses; UK GDPR still applies.

On professional networking sites, many people act in a personal capacity, and a sales message to them then falls outside B2B marketing (ICO).

Legal emails can still be reported, and each "report spam" click counts against the sender. A list of strangers gives more people a reason to click it.

What the Data (Use and Access) Act 2025 changed

The Act left the corporate subscriber rule as it was, so cold email to a limited company needs no consent now either. The changes below started on 5 February 2026, apart from the regulator's new form on 30 September 2026.

Change	What it means for cold email
Higher PECR fines: up to £17.5 million or 4% of global turnover (ICO statement)	A breach now costs far more; ignore the £500,000 cap on older ICO pages such as What are PECR?
A message counts once transmitted, even if it is never received (ICO)	An email to a dead address still counts as sent
UK GDPR Article 6(11)(a) names direct marketing as an example of a legitimate interest	The ICO reads it as "may", so the three tests still apply
A soft opt-in for charities, in regulation 22(3A)	Businesses cannot use it
From 30 September 2026, the ICO is the Information Commission, overseen by a board (ICO)	Guidance and enforcement continue under the ICO name

The ICO's PECR email pages still carry a note that they are under review because of the Act. Check them again before a large send.

Where MailGraf fits

MailGraf does not send cold email, and our rules are stricter than PECR. Our sending and list rules answer "Can I send cold emails?" with "No."

They go on: "Recipients must have given permission to receive your marketing emails. Do not send to bought, rented or scraped addresses."

Each file import asks you to tick "I confirm these contacts gave me permission to email them." before it starts (Import contacts from a file). Under our Acceptable Use Policy, sending is held for review when spam complaints reach 0.1% of an account's sends over seven days, once it has at least 200. That is one complaint per 1,000 emails.

MailGraf starts where the cold conversation ends. When a prospect replies and asks for your updates, keep that reply as the record of their permission. Once they unsubscribe, MailGraf leaves them out of every later campaign.

If a named contact asks you to erase their data, Permanently forget does it without lifting their suppression (read a contact profile).

Not sure whether a list of business contacts meets our permission rule? Ask us before you import it.