Is B2B email marketing legal in the UK?

Yes. B2B email marketing is legal in the UK when the recipient is a corporate subscriber (a limited company, an LLP, a Scottish partnership or another body corporate) and every message identifies you and offers a working way to opt out. Under regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR) you do not need a corporate subscriber’s prior consent. You do need consent, or the soft opt-in, for individual subscribers: people on personal addresses, sole traders and most partnerships. UK GDPR still applies whenever the address identifies a named person.

Two sets of rules apply at once

UK email marketing sits under two overlapping regimes. PECR decides whether you may send an unsolicited marketing email at all, and on what terms. UK GDPR decides whether you may use the personal data involved, which includes a named work address such as jane.smith@company.co.uk. Passing one test does not pass the other.

The regulator for both is the Information Commissioner’s Office (the ICO), which became the Information Commission on 30 September 2026. Its guidance and enforcement powers carried over, so the ICO guidance quoted here still describes how the rules are applied.

Who counts as a corporate subscriber

ICO guidance on business to business marketing says corporate subscribers include companies, limited liability partnerships, Scottish partnerships, some government bodies and other bodies corporate. The reg 22 consent rule does not apply to them. Sole traders and other partnerships are individual subscribers, so they get the same protection as consumers.

The practical problem is that an email address does not tell you which category the recipient is in. A domain such as smithconsulting.co.uk could belong to a registered company or to a sole trader with no company at all. That is the gap PECR Check fills: it matches the domain to a UK registered company, checks its Companies House status and returns a verdict with reason codes.

What you must do even for corporate subscribers

Corporate subscribers are outside the consent rule, not outside the law. For every B2B marketing email you still need to:

• identify yourself clearly and give a valid address where the recipient can opt out (PECR regulation 23);
• honour opt outs promptly, including from corporate subscribers;
• have a lawful basis under UK GDPR for named individuals. For most senders this is legitimate interests, supported by a documented legitimate interests assessment;
• give recipients privacy information about where you got their details and how to object;
• stop direct marketing to anyone who objects. The right to object to direct marketing is absolute.

The ICO’s legitimate interests guidance, updated on 23 March 2026, says legitimate interests can apply to direct marketing only where PECR does not require consent, and the processing must be proportionate, have a minimal privacy impact and not surprise people.

When you need consent

If the recipient is an individual subscriber, reg 22 applies and you need their prior consent, unless the soft opt-in covers them because they are an existing customer. Consent cannot realistically be obtained for a cold list. ICO guidance also says that if you are unsure whether details belong to a corporate or an individual subscriber, you should treat them as an individual. In other words, uncertainty counts against you.

What changed in 2026

The core rules above did not change. What changed is the cost of getting them wrong. From 5 February 2026 the Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of total worldwide annual turnover, whichever is higher, for breaches including regs 22 and 23. The Act also added wording to UK GDPR that lists direct marketing as an example of a purpose that may be a legitimate interest. That is not automatic: the purpose, necessity and balancing tests still apply.

A practical checklist before you send

1. Remove free webmail and consumer ISP addresses, or get consent.
2. Confirm the domain belongs to an active UK body corporate, and keep a record of that check.
3. Treat anything uncertain as an individual subscriber.
4. Screen against your own suppression list.
5. Write and keep a legitimate interests assessment.
6. Identify yourself and include a working opt out in every email.

PECR Check automates steps one to four for each address and stores an audit record of the result. It gives you a classification with evidence, not legal advice: you remain the sender and responsible for what you send.