Is cold email legal in the UK? GDPR and PECR for B2B outreach in 2026
The short answer Yes. B2B cold email is legal in the UK when you do it properly. PECR lets you email people at limited companies and LLPs without asking first, as long as you say who you are and make it easy to opt out. UK GDPR still applies to named contacts, so you need a lawful basis (usually legitimate interests), a relevant reason to get in touch, and a fast, permanent way to stop. Sole traders are different: you need their consent (or a soft opt-in) first.
People often question whether cold email is still a viable route to market. Usually they've been told it's "basically illegal now", and they've quietly given up on outbound because of it.
It isn't illegal, and giving up on it means handing your pipeline to whoever is willing to do it properly. The rules aren't there to stop you picking up the phone or sending an email. They're there to stop lazy, careless, spray-and-pray outreach. Done right, compliant outreach and good outreach are the same thing.
This is general information from a team that runs cold email campaigns every day, not legal advice. If you're unsure about your situation, speak to a solicitor.
Which laws cover cold email in the UK?
Two sets of rules work together:
- PECR (the Privacy and Electronic Communications Regulations) covers who you can send marketing emails to and what those emails must include.
- UK GDPR (with the Data Protection Act 2018) covers how you handle personal data, including a named person's work email address.
You need to get both right. PECR decides whether you can send the email at all. UK GDPR decides whether you're handling the person's details fairly.
Who can you cold email under PECR?
This is where most of the confusion comes from. PECR splits recipients into two groups, and the rules for email are very different.
| Corporate subscribers | Individual subscribers | |
|---|---|---|
| Who they are | Limited companies, LLPs, Scottish partnerships, some government bodies | Sole traders, most other partnerships, unincorporated groups, and consumers |
| Can you cold email them? | Yes, without prior consent | Only with consent or a soft opt-in |
| Must you identify yourself? | Yes | Yes |
| Must you offer an opt-out? | Yes | Yes |
The ICO's guidance on business-to-business marketing sets this out plainly: the PECR rule on marketing by email doesn't apply to corporate subscribers. So an email to jane@acme-ltd.co.uk is fine under PECR. An email to a sole trader's inbox isn't, unless they've agreed to hear from you.
That one distinction is why we check the legal form of every business before it goes into a campaign. If it's a sole trader, it comes out. No exceptions.
Does UK GDPR stop B2B cold email?
No, but it does set the standard you have to meet.
A named person's work email is personal data. So you need a lawful basis for using it, and for B2B outreach that's almost always legitimate interests. To rely on it properly:
- Do a legitimate interests assessment. Write down why you're contacting these businesses, why email is a reasonable way to do it, and why it doesn't override the person's interests.
- Only email people the message is genuinely relevant to. Offering bookkeeping software to a finance director passes the test. Sending the same email to everyone at the company doesn't.
- Be open about it. Tell people who you are and how you found them, and have a privacy notice that explains it.
- Honour every objection immediately and permanently. The right to object to direct marketing is absolute. Once someone says no, that's it.
Notice what these have in common. Every one of them also makes your campaign work better. Relevance gets replies. Respecting a no protects your sender reputation. The law and the results point the same way.
What changed in 2026?
The rules on who you can email stayed the same. The cost of getting it wrong didn't.
From 5 February 2026, the Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of annual global turnover, whichever is higher, bringing it in line with UK GDPR. The ICO has also said its B2B marketing guidance is under review because of the Act, so it's worth checking back.
If anyone was treating the old cap as a cost of doing business, that's over. The upside is that it pushes the market towards careful, targeted outreach, which is the only kind that builds lasting pipeline anyway.
How do you run compliant cold email that actually builds pipeline?
This is where it stops being a legal checklist and starts being a craft. At Apolac, cold email is an integral part of how we generate leads for clients in the B2B markets we work in, and we're the very best at it. Here's how we run it, and what each step does for the results.
Targeting on purpose. We start from your ideal customer profile and look for live buying signals: a business hiring for the role you replace, new investment, M&A news or fast headcount growth. Emailing a company the week it starts hiring is a relevant message. That's good for legitimate interests and far better for reply rates.
Checking the business, not just the address. Every company is checked for its legal form so sole traders and non-limited partnerships are removed before anything is sent. Every signal is checked against its source, such as the live job ad, the press release or Companies House, before we mention it in an email.
Enrichment and verification. We find the right decision-maker for the message, not the whole org chart, then verify every address before it's used. Bounces damage your domain, and emailing the wrong person weakens your legitimate interests case. The right person means real conversations, not polite redirects.
A clean, honest email. Every email comes from a real person, says plainly why we're getting in touch, ends with a friendly way to say no ("If it's not for you, no problem, just let me know and I won't email again") and carries full company details. Honest, human emails get honest replies, and those are the conversations that turn into leads.
A do-not-contact list that never forgets. Any negative reply, whether that's "not interested", "remove me" or "wrong person", goes straight onto our blocklist. Every new list is checked against it before it's loaded. Nobody who has said no hears from us again, which keeps every campaign focused on the people who might say yes.
Deliverability that respects the inbox. We cap how much each sending inbox sends per day and keep every inbox on a single campaign. Fewer, better emails protect sender reputation, so more of them land in the inbox, and they stop outreach tipping into the spammy volumes the rules exist to prevent.
Is it worth the effort?
Yes. Doing it properly takes more work up front, and that's exactly why it works. It's how we keep ambitious B2B companies in the UK and overseas supplied with qualified conversations.
The businesses that win at outbound aren't the ones sending the most email. They're the ones who keep showing up with the right message for the right person at the right time, and keep following up when the first email gets no reply. Compliance is the floor, not the ceiling.
Frequently asked questions
Is cold email legal in the UK?
Yes, for B2B outreach to companies. Under PECR you can send unsolicited marketing emails to corporate subscribers, such as limited companies and LLPs, without prior consent, as long as you say who you are and give a working way to opt out. UK GDPR still applies to named business contacts, so you need a lawful basis, usually legitimate interests.
Can I cold email sole traders in the UK?
Not without consent or a soft opt-in. PECR treats sole traders and some partnerships as individual subscribers, which gives them the same protection as consumers.
Do I need consent under GDPR to send B2B cold emails?
Usually not. Most B2B senders rely on legitimate interests. That means doing a legitimate interests assessment, emailing people whose role makes the message relevant, telling them where you got their details and honouring every objection straight away.
What changed for cold email in 2026?
From 5 February 2026, the Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of annual global turnover, whichever is higher. The core rules on who you can email didn't change.
What should every B2B cold email include?
Your real identity, a relevant reason for getting in touch, a simple way to opt out, and your company details. Anyone who says no should go on a do-not-contact list and never be emailed again.
Want more of the right leads?
If you'd like a steady flow of qualified leads from outbound that's done properly, let's talk it through.
Apolac is a UK Outbound Growth Partner for B2B companies. Many of our clients work with us on a pay-per-lead basis, so they pay for results.