Who you can cold email in the UK.
Companies, yes. Sole traders, only with consent. And every email needs your name and a way to opt out.
On this page
The short answer
The UK splits business email in two. The rules depend on what kind of business you are emailing, not on how big it is.
| Who | Without consent? | What you must do |
|---|---|---|
| Limited companies, PLCs, LLPs and Scottish partnerships | Yes | Say who you are, and give a valid way to opt out. The ICO says to honour opt-outs too. |
| Sole traders and other partnerships | No | Get their consent, or meet every soft opt-in condition. |
| A named person at any of these | As above | UK GDPR applies as well: have a lawful basis, say where you got their details, and stop if they object. |
Company or sole trader? How to tell
PECR, the law for marketing emails, counts companies, LLPs, Scottish partnerships and some government bodies as corporate subscribers. Sole traders and other partnerships count as individuals, so they get the same protection as consumers.
The email address won’t tell you which one you have. Search the business on Companies House. If the record says private limited company, public limited company or limited liability partnership, it counts as a company.
Still not sure? The ICO says to treat the address as an individual’s. That is the safe side.
What every cold email needs
These apply to every marketing email you send, to companies and to people.
- Your real name or company name. Never hide who is sending.
- A valid way to opt out, like a reply address or an unsubscribe link.
- Emailing a named person? Where you got their details.
- A suppression list, so anyone who opts out never hears from you again.
Two lines to copy
Put these at the end of your email. Replace the yellow fields.
You’re getting this because {{reason}}. We found your details on {{source}}.
Not for you? Reply “no” and we won’t email you again. Our privacy notice: {{privacy_link}}
UK GDPR in plain English
UK GDPR is the data protection law. It sits on top of PECR whenever you can identify a person, even in their work role.
- A named work email counts. priya@clinic.co.uk is personal data. A general inbox with no name on it is not.
- You need a lawful basis. Most B2B senders use legitimate interests. First check three things: your reason is real, emailing them is needed for it, and it doesn’t override their interests.
- Tell them where you got their details. If you email them, do it in that first email at the latest.
- They can always object. When someone asks you to stop, you must stop. Keep them on a suppression list instead of deleting them, so they don’t come back in a new list.
- Bought lists are your responsibility. You need a lawful basis to use them, and you must tell people you have their data. For sole traders, the consent must have been given to your business.
What changed in 2025
The Data (Use and Access) Act 2025 got Royal Assent on 19 June 2025. The ICO says all of its changes to PECR are now in force.
- Bigger fines. The maximum PECR fine went up from £500,000 to £17.5 million or 4% of global turnover.
- The same rules for who. The split between companies and sole traders did not change.
Before you send
- You know if it’s a company or a sole trader
- Your name and a working opt-out are in every email
- You can say where you got each named contact
- Your suppression list is up to date
This page is a plain-English summary of ICO guidance, not legal advice. If you are unsure about your own list, get advice from a qualified professional.
Sources
Checked on 30 October 2026.
- ICO: Business-to-business marketingCompanies, sole traders, UK GDPR, objections and bought lists
- ICO: Electronic mail marketingThe PECR email rules and the soft opt-in
- ICO: Data (Use and Access) Act 2025, changes to PECRNew fines and what is in force
- UK GDPR, Article 14What to tell people when you didn’t get their details from them
