UK GDPR & the Data Protection Act
These govern how you use personal information: your lawful basis, transparency, security and people’s rights. A named work email address can be personal data too.
Email people who want to hear from you
Good email marketing begins with a clear invitation and a willing audience. The law sets requirements for sending marketing and handling personal information. Your email provider can set a stricter permission policy.
This guide explains general UK requirements and our platform policy. It is not legal advice or a guarantee of compliance. For complex campaigns or overseas recipients, obtain advice appropriate to your circumstances.
GDPR and PECR work together
Privacy and Electronic Communications Regulations
PECR sets specific rules for electronic marketing. Whether consent is legally required depends on the subscriber and any applicable exception.
Meeting one set of rules does not automatically satisfy the other. “Legitimate interests” is a UK GDPR lawful basis, not permission to bypass PECR consent requirements or Email Blaster’s positive opt-in policy.
Can businesses send unsolicited marketing emails?
In some circumstances, yes. Under PECR, unsolicited marketing emails can be sent to corporate subscribers, such as limited companies and limited liability partnerships, without prior consent. You must identify the sender and provide a valid way to opt out. UK GDPR obligations still apply where personal data is used.
Sole traders and some partnerships are individual subscribers, so they normally need consent or a valid soft opt-in. A business-looking email address alone does not establish the subscriber type.
The legal position
Rules depend on the recipient
For named corporate contacts, assess and document your lawful basis, provide privacy information and respect objections. Public availability does not remove these duties.
Our platform policy
Positive opt-in is required
We do not recommend unsolicited cold outreach and do not permit it through Email Blaster. Unwanted campaigns can attract complaints and damage sender reputation. Get a clear opt-in before adding someone to your campaigns.
What does a positive opt-in look like?
Ask people to actively choose your email marketing. Tell them who will email them and what they will receive. Keep the choice separate from accepting terms, placing an order or making a donation.
Illustrative signup wording
Yes, I’d like Example Company to email me its monthly newsletter and product offers. I can unsubscribe at any time.
Use your own business name, content and expected frequency, with a nearby link to your privacy notice. The box starts unticked.- Use plain language and a genuine choice to say no.
- Avoid pre-ticked boxes, silence or consent bundled into another action.
- Do not treat a purchase, business card, social follow or enquiry as an email marketing opt-in.
Double opt-in adds a confirmation step and can help verify the address and evidence the request. It is useful practice, rather than a universal UK GDPR requirement. The underlying consent still needs to be valid.
ICO: consent for electronic marketing ↗ · Explore our subscribe forms →
Keep the evidence behind each opt-in
A “consent: yes” field by itself is not enough to explain how permission was obtained. Keep an audit trail that connects the subscriber’s action with the information presented at the time.
The subscriber’s identifier and the date and time they opted in.
The wording and form or script version, the action taken and what the permission covers.
Updates to preferences and when consent was withdrawn.
Retain appropriate evidence while relying on the consent. Review older records when the purpose or subscribers’ expectations change; consent is not a licence to email indefinitely.
Make leaving simple respect the decision
Include an easy, working unsubscribe route in every marketing email. Do not make people log in to stop messages. Act on withdrawals and objections promptly, including requests received by reply or through your support team.
The right to object to use of personal data for direct marketing is absolute. Stop that marketing use, including related profiling; do not override the objection with a legitimate interests argument.
Do not re-import unsubscribed contacts or send a campaign asking them to opt back in. Preserve their choice across lists and connected systems.
ICO: preferences and suppression lists ↗ · The right to object ↗
Two 2026 changes worth knowing
The Data (Use and Access) Act 2025 amended parts of the UK framework. These changes do not remove your responsibility to handle information fairly or follow our permission policy.
A limited charity soft opt-in
Charities may use a new exception for electronic marketing that furthers their charitable purposes, subject to strict conditions. These include obtaining details through an expression of interest or support, and offering an opt-out both at collection and in each message. It does not retrospectively make every old supporter list eligible.
Data protection complaints handling
Organisations must provide a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome. Build this into your privacy and customer-service processes.
Look after the information behind the email
Know your responsibilities
You usually act as controller for your subscriber data: deciding why and how it is used. Your platform processes it on your instructions. Review the data-processing contract, security commitments and subprocessors.
Check where data goes
UK storage can support your governance choices, but does not guarantee compliance. Consider support access, subprocessors and any restricted international transfers; overseas processing is not automatically prohibited.
Review tracking separately
Permission to send an email does not automatically settle permission for tracking pixels. PECR’s storage and access rules apply separately. Assess the technology, any applicable exception and consent requirements before enabling it.
Assign responsibility
Give someone ownership of your data protection processes. A formal Data Protection Officer is required only in specified circumstances, such as certain public bodies or large-scale monitoring and sensitive-data activities.
Collect only what you need, restrict access, review retention and keep records accurate. Check your own handling of exports, integrations and AI tools as well as the email platform.
Your permission-first checklist
- Every recipient has actively opted in to your email marketing.
- You can show when, how and what they agreed to.
- Your signup wording and privacy information are clear.
- The campaign fits the permission and expectations set.
- Unsubscribes and objections are suppressed across your lists.
- Your sender identity and unsubscribe link are easy to find.
- You have reviewed tracking, access and data retention.
- You have a clear route for rights requests and complaints.
If you cannot explain where an address came from or show a positive opt-in, leave it out of your Email Blaster campaign.
Common questions, clear answers
Can I upload a purchased or scraped business list?
No. Email Blaster does not permit third-party-generated, purchased or scraped lists. Every recipient must have opted in directly with you. A supplier describing a list as “GDPR compliant” does not satisfy this requirement.
Can legitimate interests replace an opt-in on Email Blaster?
No. Whatever legal basis may apply in a particular context, our platform requires a clear positive opt-in from every recipient.
Do existing customers automatically qualify?
No. A purchase is not automatically a positive opt-in. Obtain a clear marketing choice before including the person in an Email Blaster campaign.
Does using compliant software make my campaign compliant?
No. Your audience, collection process, content and use of data also matter. The platform supports your work, but your organisation remains responsible for its decisions.