What to keep as evidence of a B2B email check

For every address you email as a corporate subscriber, keep a record of what you checked, when, what the result was and why: the date and time, the domain, the company name and Companies House number you matched, its status, the verdict and reason codes, the rules or policy version used, and a reference linking it to your campaign. Add your legitimate interests assessment, your suppression list and proof that each email identified you and offered an opt-out. That lets you show your working if a recipient complains or the regulator asks.

Why evidence matters more since 2026

From 5 February 2026 the Data (Use and Access) Act 2025 raised the maximum PECR fine to £17.5 million or 4% of worldwide turnover, whichever is higher, and gave the ICO new investigatory powers such as interview notices and technical reports. (The ICO became the Information Commission on 30 September 2026; its powers carried over.)

ICO guidance also says that if you are unsure whether an address belongs to a corporate or an individual subscriber, you should treat it as an individual. A general statement that “we only email businesses” does not resolve that doubt for a specific address. A record of the check for that address does.

Be clear about what evidence can and cannot do. PECR has no due diligence defence: relying on a check does not make a breach lawful. What a careful, documented process does is show how you reached each decision and that you took the rules seriously.

The per-address check record

For each address you classify as a corporate subscriber, keep:

• A unique ID and timestamp for the check, in UTC.
• A hash of the address (for example SHA-256 of the lower case address) rather than the plaintext, plus the domain.
• The company matched: registered name, Companies House number, company type and status on the day.
• The verdict and reason codes, such as CORPORATE_SUBSCRIBER with COMPANY_MATCHED and COMPANY_ACTIVE.
• The confidence and the threshold you applied.
• The policy version, so you can show which rules were in force.
• Your own reference, such as a CRM contact or campaign ID.

Keep records for addresses you decided not to email too. They show the process works in both directions.

The campaign level records

• Legitimate interests assessment. For named work addresses, UK GDPR still applies. Record the purpose, why emailing is necessary, and how you balanced it against recipients’ interests.
• Privacy information. What you told recipients about where their details came from and how to object.
• Regulation 23 compliance. A copy of the email as sent, showing your identity and a working opt-out.
• Suppressions and objections. Your suppression list, including whole domains where a company has opted out, and proof it was applied before each send.
• Complaints log. Controllers have had to run a data protection complaints process since 19 June 2026.

Keep it lean and secure

Evidence should not become a second copy of your contact list. Store hashes rather than plaintext addresses where you can, restrict access, and set a retention period. Delete what you no longer need.

How PECR Check records each check

Every call to PECR Check creates a stored evidence record with an audit_id. It holds the check time, a SHA-256 hash of the address (never the plaintext), the domain, the company name, number, type and status, the verdict, recommended action, confidence, reason codes, the policy_version and your own reference. You can fetch any record later with GET /api/v1/audit/{audit_id}. Records are kept for 3 years by default. Addresses you check are never added to Emailmovers’ marketing database.

A PECR Check record is a classification with evidence, not legal advice. You remain the sender and responsible for your messages.