Is an Email Address Personal Data? info@, UK GDPR and PECR

An email address is personal data when it identifies a living person, as a named work address or a personal Gmail address does. A generic address such as info@ or sales@ at a limited company usually identifies nobody, so UK GDPR does not cover it.

The Privacy and Electronic Communications Regulations (PECR) still apply, because they look at who receives the email. A limited company needs no consent; a sole trader does, and their info@ is personal data too. Every marketing email must name the sender and offer a way to opt out.

When an email address is personal data

UK GDPR defines personal data as information relating to an identified or identifiable natural person (Article 4(1)); the Information Commission's Office (ICO) adds that the person must be living. An address alone can be enough.

The ICO uses [email protected] as its example. It tells you that someone called John Smith works at Example (ICO).

You do not need a name. The test is whether you can single out one person from a group, using any identifier or a mix of them.

Information about a company, or any other legal person, is not personal data (ICO).

ICO guidance on business-to-business marketing offers a simple test. If you do not know the name of the person you are emailing at a business, you are not processing personal data. Its example is [email protected] (ICO).

Does UK GDPR apply to storing generic addresses?

Not to the address on its own. Storage counts as processing under Article 4(2), but the regulation only governs personal data. A spreadsheet of info@ and sales@ addresses at limited companies, with nothing in it that points to a person, falls outside it.

The rest of the row decides. Add a contact's name, a job title held by one person, or a note naming whoever answered the phone, and that row becomes personal data. The address itself has not changed.

Where the details sit counts as well. Business cards left loose in a desk drawer are outside UK GDPR; once someone types them into a contacts database, the regulation applies (ICO).

PECR's email rules say nothing about keeping a list. They start when you send a marketing message, or get someone else to send it for you (regulation 22).

What PECR checks: the recipient, not the address

PECR's consent rule for marketing email protects individual subscribers only. The subscriber is whoever has the contract for the email service, and for a work address the ICO says that is the employer.

So info@ and a named address at the same company are both corporate subscribers (ICO). A name in the address changes your UK GDPR duties, not your PECR ones.

A limited company, a limited liability partnership (LLP) or a Scottish partnership is corporate. Outside Scotland, every partnership except an LLP counts as an individual, the same as sole traders; cold email in the UK shows how to tell them apart.

Two rules cover all marketing email, whoever receives it. The identity of whoever it is sent for must not be concealed, and the email must give a valid address for opting out (regulation 23).

Six addresses from the Kettering list

Each verdict turns on legal form and on what your records hold, never on the address alone. The list below belongs to an invented Kettering business that hires out office plants. The rows follow the legislation and published guidance as they stood on 25 October 2026.

Address on the list	Who holds it	Personal data under UK GDPR?	Consent needed under PECR?
info@	An estate agency trading as a limited company	No	No
accounts@	A chartered surveyors' practice set up as an LLP, read by two staff	No	No
md@	A two-person web agency with one director listed at Companies House	Probably: the role points to one person	No
info@, with the practice manager's first name in the plant firm's notes	A dental practice run as a limited company	Yes: the record names a person	No
hello@	A self-employed hairdresser	Yes: the business is one person	Yes: consent, or a soft opt-in
office@	Two physiotherapists in an ordinary partnership in England	Treat it as yes	Yes

These verdicts are our reading of the published rules, not legal advice on your own list. The ICO is reviewing its guidance after the Data (Use and Access) Act 2025, so a row may change when a linked page does.

Border cases and how we read them

Most generic addresses are easy. The rows that need thought are those where the address looks generic but the business, the role or your own notes point to one person.

A sole trader's info@

UK GDPR applies to sole traders whenever they can be identified (ICO). In law, the hairdresser and the business are the same person, so hello@ is information about one individual.

PECR treats them as individual subscribers too. You need their consent, or a soft opt-in that comes from a past sale or negotiation.

In one ICO example, a building supplies firm expects many of its customers to be sole traders. Its answer is the soft opt-in for everyone: the online checkout explains the offer emails and gives a tick box for opting out (ICO).

For an address you cannot place, the ICO's advice is to assume an individual subscriber.

A role only one person holds

The B2B test above looks for a name. The main guidance on identifiability goes further: you can identify someone without a name if you can pick them out from everyone else.

A public register counts when you are likely to check it (ICO). At a company with one director on Companies House, we treat md@ as that director's personal data. Treat ceo@, owner@ and similar addresses at a very small firm the same way.

A partnership's office@

An ordinary partnership in England is not a legal person apart from its partners, so the ICO's exception for companies does not reach its office@. With two partners, we treat it as personal data, which is the ICO's advice whenever you cannot be sure.

A first name as the address

An address made of a first name at a five-person firm identifies the person who uses it almost as surely as a full name would. A name combined with a place of work is often enough to single someone out (ICO).

A shared mailbox

An accounts@ address read by two or three staff stays outside UK GDPR while you hold nothing that singles out one of them. The person who replies may sign with their name, though, and that reply is personal data once you keep it.

When you cannot tell

For uncertain cases, the ICO advises treating the information as personal data anyway. Keep it secure, protect it from disclosure and be open about how you collected it (ICO).

When info@ asks you to stop

A suppression entry for info@ at a company holds no personal data, so keeping it raises no UK GDPR question. Add the address the day the request arrives, since the ICO expects you to comply even though PECR sets no explicit duty (ICO).

A named entry is personal data. Even so, the regulator says suppression usually beats deletion: it means keeping "just enough information" to respect the objection (ICO).

The reply often brings a name: "Please take us off your list. Sam, office manager." Put the address and the date on the suppression list. The signature does not need to go into your contact records.

The business may ask you to stop emailing anyone there. Then suppress every address you hold at it, named ones included. Once a named person objects for themselves, you have no discretion: Article 21(3) says their data must no longer be used for marketing.

Generic addresses on bought B2B lists

Being generic does not make a bought address safe to email. An info@ that identifies nobody settles the UK GDPR question and nothing else.

PECR still sorts the list by recipient. Every sole trader, and every ordinary or limited partnership outside Scotland, needs consent, which a general list rarely holds in your business's name. In trades full of sole traders, from hairdressing to building work, that can be much of the file.

Many files also pair each info@ with a contact name or job title. Leave those columns out of the import unless you need them.

Shared inboxes carry a sending risk as well. Verification tools flag them as role-based addresses, since they rarely belong to one person who chose to hear from you.

A check like our email verification service shows whether a mailbox can receive mail; it cannot show that you may send to it.

Mark each row: is the holder a sole trader or a partnership outside Scotland, and does the row name a person? The first needs consent before any email; the second brings in UK GDPR.

How MailGraf handles role addresses

MailGraf refuses technical, system and legal addresses such as postmaster@, abuse@, noreply@, admin@ and legal@, and has done since 25 September 2026. That covers file imports, signup forms, contacts added by hand and connected apps.

The import report lists each refused row with the reason "Role or system address (postmaster@, abuse@, noreply@…). High spam complaint risk."

Department addresses like info@, sales@ and support@ are accepted, because for many businesses they are the real contact address.

Like every recipient, they need permission under our sending and list rules, whatever PECR allows. The Acceptable Use Policy also bans bought lists "regardless of how the list provider describes them".

When a campaign goes out, a final check removes any role address still sitting on an older list (email verification report).