Is cold email legal in the UK for B2B?
Often, yes. The ICO's guidance on PECR (the Privacy and Electronic Communications Regulations) says the rule requiring consent for marketing emails applies to individual subscribers, not corporate ones. So a well-targeted email to someone at a limited company can be lawful without their prior consent.
But lawful isn't the same as anything goes. Every marketing email still has to say who it's from and give a valid way to opt out. And because a named work address is personal data, UK GDPR applies too.
Who counts as a corporate subscriber and who counts as an individual?
This is where most cold email goes wrong. The ICO's guidance says corporate subscribers include companies, limited liability partnerships, Scottish partnerships and government bodies.
Individual subscribers include consumers, and also sole traders and some partnerships. So emailing a self-employed plumber or a small partnership is treated like emailing a member of the public: you generally need their consent first, unless the soft opt-in applies to an existing customer.
If you can't tell what kind of business is on your list, leave it out or check before you send.
What does UK GDPR add?
UK GDPR applies whenever you process personal data, and an email address like firstname.lastname@company.co.uk identifies a person. Generic addresses like info@ are less likely to.
You need a lawful basis. For B2B marketing, that's usually legitimate interests, and the ICO describes a three-part test: is there a legitimate purpose, is the processing necessary for it, and do the person's interests override yours? Write that test down. You also need to tell people how you got their details and what you do with them, which in practice means a short line and a link to your privacy notice in the first email.
And if someone objects to direct marketing, you must stop. UK GDPR makes that right absolute.
How do you send cold email that stays within the rules?
Run every campaign through these eight steps. Keep a record of each one.
- Build the list from companies, not people. Remove sole traders and partnerships that count as individual subscribers.
- Target by role: only contact people whose job makes your offer relevant to them.
- Write a legitimate interests assessment: your purpose, why email is necessary, and why it's fair to the person.
- Say clearly who you are in every email: your name, your company and a real contact address.
- Give an easy opt-out in every email, and honour it straight away across every list and tool.
- Link to a privacy notice that explains where you got their details and how to object.
- If you're a limited company, include your registered company details as Companies House requires for business emails.
- Keep a suppression list so people who opted out are never emailed again, by anyone on your team.
What changed with the Data (Use and Access) Act 2025?
The Act amends PECR. Among other changes, it brings the maximum fines for PECR breaches up to UK GDPR levels, which makes getting this wrong far more expensive than it used to be. It also extends the soft opt-in to charities.
Its changes are being brought in in stages through commencement regulations. Rather than rely on any summary, including this one, check the ICO's current guidance for what applies on the day you send.
Does legal mean it'll work?
No. The rules set the floor. A short, relevant email to the right person at the right company gets replies; a generic blast to a bought list gets spam complaints, which damage your sending domain long before a regulator ever hears about it. See our guide to cold email deliverability.