Cold Email in the UK: PECR, GDPR and the Corporate Subscriber Rule

You can send B2B cold email in the UK without prior consent — but only to corporate subscribers, and a large share of the local businesses you'd want to contact are not corporate subscribers. That single distinction is where most UK outreach quietly goes wrong.

Not legal advice. A practical explanation of how the rules fit together, so you can build a process with low risk. For anything consequential, take advice.

Two rules, not one

UK GDPR governs whether you may process someone's data. PECR — the Privacy and Electronic Communications Regulations — governs whether you may send them a marketing message. You need to satisfy both, and they ask different questions.

Most confusion comes from people answering the GDPR question and assuming they're done.

The corporate subscriber rule

PECR's consent requirement for unsolicited marketing email applies to individual subscribers. It does not apply in the same way to corporate subscribers.

Type	Category	Consent needed for email?
Limited company (Ltd, PLC)	Corporate subscriber	No
Limited liability partnership (LLP)	Corporate subscriber	No
Public body, school, NHS trust	Corporate subscriber	No
Sole trader	Treated as an individual	Yes
Unincorporated partnership (in most of the UK)	Treated as an individual	Yes
Anyone at a personal address (@gmail.com)	Individual	Yes

Here's the part that catches people out: a very large share of local service businesses are sole traders. The plumber, the mobile hairdresser, the one-person gardening business, the independent photographer. Exactly the businesses a local agency wants to reach are exactly the ones PECR treats as individuals.

Scotland has a wrinkle: partnerships there have separate legal personality, which affects the analysis. Take advice if that's your market.

How to check before you send

The check is free and takes seconds. Companies House (find-and-update.company-information.service.gov.uk) is a public register. If the business appears as a live limited company or LLP, it's a corporate subscriber.

If you can't find it, assume sole trader and assume you need consent.

A practical shortcut when you're working from Google Maps data: business names ending in "Ltd", "Limited", "LLP" are almost certainly corporate. Names that are just a person's name — "Dave Wilson Plumbing" — are usually not. It's a heuristic, not a substitute for checking, but it's a sensible first filter on a list.

Even for corporate subscribers, you still must

The exemption is from the consent requirement, not from everything else:

1. Identify yourself. Company name, and an address where you can be contacted. No disguised or concealed sender.
2. No misleading subject lines.
3. Provide a way to opt out in every message, and honour it promptly.
4. Keep a suppression list — a durable record, not a note in your inbox.
5. Satisfy UK GDPR separately. For a named person at a company (sarah@firm.co.uk) you're processing personal data and need a lawful basis. Legitimate interest usually works, but you should be able to show you thought about it.
6. Be ready to answer "where did you get this?" Source, purpose, basis, right to object.

The ICO's practical posture

The Information Commissioner's Office publishes direct marketing guidance and has historically focused enforcement on high-volume, low-relevance senders — the ones generating complaints — rather than small businesses sending targeted, relevant messages.

That is a description of enforcement priorities, not a safe harbour. It means relevance is your best protection: a message that clearly relates to the recipient's business generates fewer complaints, and complaints are what drives enforcement.

A workable UK policy

1. Build your list, then split it: limited companies and LLPs in one bucket, everything else in another.
2. Email only the first bucket.
3. Reach sole traders another way — phone (subject to TPS/CTPS screening), LinkedIn, physical mail, or content.
4. Write to generic addresses where you can.
5. Every message: clear identity, easy opt-out, permanent suppression list.
6. Keep the message relevant enough that nobody wants to complain.

This is more work than sending to everyone. It's also the difference between a channel you can run for years and one that generates complaints.

For the rest of Europe the rules diverge sharply — Germany is far stricter, France and the Netherlands more permissive. See is cold email legal in Europe for the country-by-country picture, and why Germany is the outlier.

Summary

• PECR exempts corporate subscribers — limited companies, LLPs, public bodies.
• Sole traders and unincorporated partnerships count as individuals and need consent.
• Many local service businesses are sole traders. Check Companies House and split your list.
• The exemption covers consent only. Identity, opt-out and suppression still apply.
• Relevance is your best protection, because complaints drive enforcement.