Email Marketing and GDPR in the UK: A Small-Business Checklist
A cautious UK email marketing checklist covering PECR, consent, soft opt-in, unsubscribe handling and permission records.
UK email marketing rules depend on the recipient and the context. The ICO explains requirements under PECR and data protection law; some rules differ for individual subscribers and corporate subscribers, and the soft opt-in is limited to specific circumstances. This is a practical pointer to official guidance, not legal advice.
Identify who you are emailing
The ICO distinguishes individual subscribers from corporate subscribers for electronic marketing rules. Sole traders and some partnerships may be treated as individuals. A company address is not automatically a personal subscriber, but personal data rules can still matter when a named person’s details are used.
Before importing a list, understand how each address was obtained, what the person was told and whether their organisation or legal status changes the rules. Do not treat any old contact database as blanket permission.
Consent and the soft opt-in
For marketing to individual subscribers, consent is generally needed unless a valid exception applies. The soft opt-in is not a universal workaround: it has conditions, including how details were collected in the context of a sale or negotiation and offering a clear opt-out at collection and in each message. Consult the ICO’s current explanation for the exact requirements.
Make the sign-up language specific and retain a record of the wording, date and source. An email platform can store subscriber fields, but it cannot decide whether your business’s collection process meets legal requirements.
Build a defensible sending process
- Explain the sender, purpose and expected frequency at the point of collection.
- Keep evidence of consent or the relevant exception and its conditions.
- Provide a clear, working unsubscribe in every marketing email.
- Suppress opt-outs and objections across the systems you use.
- Review privacy information and vendor data arrangements for your actual setup.
Use current official guidance
Rules and regulator guidance can change. Read the ICO’s latest direct marketing guidance or obtain advice tailored to your organisation, especially for bought-in lists, charity campaigns, business-to-business marketing or complex data flows.
MailerLite’s forms can support a sign-up workflow, but see our forms checklist for practical implementation considerations.
Frequently asked questions
Can a UK business email customers without consent?
The answer depends on whether the recipient is an individual or corporate subscriber and whether a specific exception such as the soft opt-in applies. Follow current ICO guidance and seek legal advice where needed.
Does GDPR always require double opt-in?
Double opt-in is not a universal substitute for understanding PECR and data protection requirements. Check current ICO guidance and choose a process that provides appropriate evidence and user clarity.
Can I use MailerLite to make my email marketing GDPR-compliant?
A tool can support data and unsubscribe workflows but cannot ensure that your collection, consent and use are lawful. Your organisation remains responsible for its process.
Sources and further reading
Product details can change. Confirm them on the provider’s current pages before purchasing.
Product details and prices can change; confirm them with the cited provider sources. This guide is general information, not legal, tax or financial advice.