How to Create a Mailing List for a Small Business

To create a mailing list for a business, collect email addresses where people already meet you and give them a clear choice about marketing each time. Then note how every person joined. A list that lasts is built one yes at a time; a bought one brings legal and inbox trouble.

A coffee roaster in Malvern, our own invention, carries the examples. It sells beans online, runs a Saturday farmers' market stall and supplies four local cafés. New people reach it in three different ways.

Mailing list in Gmail or Outlook, or a marketing list?

A mailing list, or email list, is a set of addresses that all receive the same emails. A Gmail or Outlook group is a mailing list of people you know. A business that emails its customers needs an email marketing tool.

In Google Contacts, you create a label, add people to it and type the label's name into a new email (Google Contacts Help). New Outlook calls the same thing a contact list, made from the New contact menu in People (Microsoft Support).

That suits a running club or a family. In the UK, marketing email needs a way to opt out in every message and a record of how each person agreed. A contact group offers neither, so the rest of this article is about the second kind of list.

Where subscribers come from and the permission each needs

Every person on a business mailing list should arrive through a permission point. That is a moment where they gave you their address and had a real choice about marketing.

PECR (the Privacy and Electronic Communications Regulations) sets these rules, and the Information Commission's Office (ICO) enforces them. For individuals, they allow two routes: consent, or the soft opt-in.

The soft opt-in reaches past buyers and enquirers, about your similar products, if they could refuse when you took the address (ICO email marketing rules).

Permission point	What lets you email them	What to keep on record
Sign-up form on your website or a landing page	Consent: pressing the button on a form that shows your business name and the emails promised	Date, form and the wording people saw
Online checkout	Soft opt-in, if an opt-out box sits next to the email field; or consent through an unticked box	Order date and the opt-out wording
Quote request, booking or product enquiry	Soft opt-in: the ICO counts asking for a quote or for product details as negotiating a sale	Enquiry date and the opt-out you offered
Market stall, event or tasting	Consent on a sheet, a tablet or out loud; a buyer can instead join under the soft opt-in if offered the opt-out as you take the address	Date, the sentence people agreed to and who took it
Email receipt at the till	Nothing yet: an address given for a receipt does not cover marketing	Offer the opt-out as you take it, or ask separately, and note the answer

The receipt row comes from an ICO example. A shopper gave an address for an e-receipt and got a sale email the next day. The ICO says that second email breaks PECR (ICO direct marketing guidance).

Staff who take an address in person should offer the opt-out out loud, the ICO adds. At the roaster's stall, that sounds like: "We'll email your receipt. We also send a roast list twice a month; shall I leave you off it?"

For form wording at seven placements, see these newsletter signup form examples. A confirmation email on top proves the address belongs to the person who typed it. That helps most on forms anyone can fill in, and single and double opt-in compares the two.

How to record each sign-up

The ICO asks you to record who agreed, when, how and what they were told. For a spoken yes, a note made at the time and the words you used will do (ICO on recording consent).

Online forms keep most of this for you. Paper is where records go missing, so the roaster prints the promise at the top of its market sheet.

Contacts you already have: spreadsheets, customers and business cards

Addresses you already hold can join your mailing list only if you know where each one came from. You also need to know what the person was told then.

What you have	Can you send it marketing?	What to do
Online customers who were offered an opt-out at checkout	Yes, about your similar products, under the soft opt-in	Add them with the order date
Customers whose address was taken with no opt-out offered	No: the soft opt-in needs that chance to refuse at collection	Ask for a yes at their next order or visit
A spreadsheet nobody can explain	No: without a record you cannot show anyone agreed	Leave it out
Business cards from staff at limited companies	Yes under PECR, which treats company addresses as corporate subscribers	Say you will email them about your products and stop if they object
Business cards from sole traders or partnerships outside Scotland	Not from the card alone: PECR treats them as individuals, so you need consent or the soft opt-in	Ask whether they want your emails and note the answer on the card
Addresses copied from websites or social media	Not for individuals: the ICO says publicly available details are not consent; company addresses follow the cold email rules	Leave out individuals' addresses

Named work addresses also bring UK GDPR duties; cold email in the UK covers which businesses count as companies. Both tables follow ICO guidance as we read it in October 2026. They are not legal advice, and unusual cases, such as children's data, need a lawyer's view.

For the roaster, a 2023 spreadsheet of market customers has names and addresses but no note of what anyone agreed to. It stays out.

Three of the cafés are limited companies and can receive the wholesale price list. The fourth belongs to a sole trader, who is asked at the next delivery.

Why a bought mailing list fails

A bought mailing list fails twice. The people on it rarely gave consent that covers you, and inbox providers treat email to strangers as spam.

On the legal side, consent on a bought list must name your organisation and cover email, according to the ICO. The soft opt-in can never apply, because you did not collect the addresses yourself.

The ICO also advises against relying on consent given through a third party more than six months earlier. The exception is marketing people would expect later, such as a seasonal offer (ICO direct marketing guidance). Ask the seller for that date for each address.

Inbox providers agree. Google's email sender guidelines tell senders not to buy email addresses from other companies. Yahoo's sender best practices warn against purchasing mailing lists.

Strangers also press the spam button, and Gmail holds every sender to a spam rate limit that a small list crosses with a handful of reports (what Gmail, Yahoo and Microsoft require from senders).

How to grow a mailing list without losing permission

Four habits grow a small business mailing list steadily. Each one adds people whose permission you can show.

Give people one reason to sign up

Name what arrives and how often. For the roaster, the reason is first word on each new single-origin lot, which tends to sell out within a week. A free download or a first-order discount, often called a lead magnet, is the other common reason.

Put a QR code where people pay

A printed quick response (QR) code on the stall, the counter or a card in each parcel can open your sign-up form. People sign up on their own phone. The form keeps the record, and nobody has to read handwriting later.

Link the list from places you already post

Social profiles, your email signature and your invoices can all point to a sign-up page. Give each place its own link, so you can see later which one brings people in.

Run referrals without asking customers to email friends

If you encourage customers to email their friends about you, the ICO says you are likely to be instigating those emails. You would then need each friend's consent, which the ICO considers unlikely to be possible (ICO email marketing rules).

A referral code that customers share however they like keeps you outside that rule, as long as nothing prompts them to send an email. New people then join through your own form.

The first email after someone joins

The first email should arrive while people still remember signing up. It should also deliver what the permission point promised.

Online sign-ups can get it at once. Paper sign-ups from a weekend market should hear from you within a few days. Open with a line that names the moment: "You signed up at our stall at the farmers' market on Saturday."

People who recognise the sender have less reason to report it as spam. After that, a short welcome series can introduce the rest of what you send.

What to measure in the first 90 days

Three numbers show within 90 days whether a new mailing list is healthy. They are sign-ups by source, the spam complaint rate and unsubscribes from the first email.

Number	Where to read it	What it tells you
New subscribers each week, by source	Your form and import records, one line per permission point	Which sources to keep and which to drop
Spam complaint rate	Google Postmaster Tools for Gmail addresses, plus your sending platform's report	A rise points to a source whose people did not expect you
Unsubscribes from the first email, by source	The first email's report, split by source	A high figure from one source means its promise and your email do not match

We give no target growth rate. We found no independent source for one, and a market stall fills at a very different speed from a website form.

Keeping each subscriber's source in MailGraf

MailGraf records where every contact came from. The Source box at the top of a profile names the route: Added individually, Copy & paste, File import, Copied from list, Form or API (when another system adds them). It also shows the file or form name when known (Read a contact profile).

That makes file names worth choosing. Type up the market sheet, import it as market-stall-2026-10.csv, and each contact from it carries that name. In All contacts, the Source column is hidden by default; turn it on under Columns to see the mix across your list.

Adding people yourself, one by one or from a file, prompts you to confirm permission first. MailGraf records those contacts as single opt-in.

After a file import, MailGraf rates the list's risk. A High risk result puts the account under review before any campaign goes out (Import contacts from a file).

Forms, popups and landing pages each have their own report. A landing page's report splits sign-ups by Email campaign, Social, Direct link, Search and Other site. If someone asks how you got their address, Download consent record in the Contact actions menu saves their record as a PDF.

The market sheets, checkout sign-ups and café contacts can share one MailGraf list and keep their sources. Compare plans by monthly sends on the pricing page, without budgeting for a contact cap.