Emailing other businesses in the UK: what PECR allows, who counts as a company, and what every message must carry
The direct answer
Under the Privacy and Electronic Communications Regulations (PECR), the rule requiring consent or a soft opt in for marketing by electronic mail applies to individual subscribers and leaves corporate subscribers outside it. The ICO classes companies, limited liability partnerships, Scottish partnerships and some public bodies as corporate subscribers, so a business may send unsolicited marketing email to an employee's work address at a company without PECR consent, provided it never disguises or conceals its identity and gives a valid address for opting out. Sole traders, ordinary partnerships and other unincorporated bodies are individual subscribers with the same protection as private people, so emailing them needs consent or the soft opt in. The UK GDPR applies to any personal data, including a named contact's work email: the sender needs a lawful basis, usually legitimate interests, must tell the person it is marketing to them, and must stop when they object. The ICO notes this guidance is under review following the Data (Use and Access) Act.
Five conclusions
The argument, compressed.
- PECR's email consent rule leaves corporate subscribers out: companies, LLPs, Scottish partnerships and some public bodies.
- Sole traders and ordinary partnerships are individual subscribers and need consent or the soft opt in, like private people.
- Every marketing email must identify the sender and give a valid address to opt out.
- The UK GDPR applies to a named contact's work email: lawful basis, transparency, and a right to object that must be honoured.
- The ICO says this guidance is under review after the Data (Use and Access) Act; check it before building a campaign.
Working framework · 5 decisions
The lawful outreach check
Five checks before a list of businesses receives a first email.
Decision 01 / 05
Status
Sort the list: companies, LLPs and Scottish partnerships on one side; sole traders, ordinary partnerships and unincorporated bodies on the other. The second group needs consent.
Two kinds of subscriber
PECR's marketing rules refer to subscribers, the customer named on the bill for a phone line or internet connection, and split them in two. Corporate subscribers are bodies with separate legal status: companies, corporation soles, limited liability partnerships, Scottish partnerships, some government bodies and any other body corporate. An employee's work email at a company is therefore a corporate subscriber's address, because the subscriber is the employer.
Individual subscribers include sole traders, ordinary partnerships in England, Wales and Northern Ireland, and other unincorporated bodies of individuals. PECR treats them the same as private individuals, with the greater protection that brings. The ICO's table is blunt: electronic mail to corporate subscribers sits outside PECR; electronic mail to sole traders and some partnerships sits inside it.
The short version
Companies may be emailed without consent, with your identity shown and an opt out included. Sole traders are people; ask first.
What every email must carry
Even where the consent rule falls away, two PECR requirements stay. The sender must never disguise or conceal its identity, and must give a valid address for the business to opt out or unsubscribe. A cold email from a named founder, with the company named, a reply address and a plain line inviting the recipient to say stop, meets both.
The UK GDPR runs alongside PECR and applies whenever personal data is processed, which includes a named person's work address. Collecting a contact's details in their business capacity to send them marketing means telling them, and having a lawful basis, usually legitimate interests. Using publicly available personal data to market to someone, even at work, still needs UK GDPR compliance. And any business or contact can object to direct marketing at any time, after which the sending stops.
The review, and the practice
The ICO flags that its business to business marketing guidance is under review following the Data (Use and Access) Act, so a campaign built in 2026 should check the current page rather than an older summary. The structure above has been stable for years; the detail may move.
Law is the floor. The practical ceiling is lower: a domain that sends hundreds of unsolicited emails a day gets filtered, and then the business's ordinary emails to clients start landing in spam too. One to one messages, a handful a day, each written for the recipient and referencing something true about their business, stay inside the law and inside the inbox.
- Works: A named founder emailing a limited company's marketing lead about a specific gap on their website, with an opt out line.
- Works: Asking a sole trader on LinkedIn whether they would like the guide by email, then sending it.
- Fails: A purchased list of 2,000 addresses, mixing sole traders and companies, sent in one afternoon.
- Fails: A message with no company name, a no reply address and no way to say stop.
Outreach as brand
A cold email is the first thing most prospects ever read from a business, and it is the brand in miniature: who it is for, what it noticed, how it speaks. Written that way, it earns a reply from the right people and a polite no from the rest, and neither harms the sender.
Written as a blast, it tells the recipient the business treats attention as free. The law is the smaller reason to avoid that.
Before you use it
Questions that can change the recommendation.
Can I send cold marketing emails to UK companies without consent?
Under PECR, yes: the electronic mail consent rule applies to individual subscribers and leaves corporate subscribers such as companies and LLPs outside it. You must still identify yourself clearly, give a valid opt out address, and comply with the UK GDPR for any named contact's data.
Does a sole trader count as a business for PECR?
No. The ICO classes sole traders, ordinary partnerships and other unincorporated bodies as individual subscribers with the same protection as private individuals, so marketing emails to them need consent or the soft opt in.
Does the UK GDPR apply to a work email address?
Yes, where it identifies a person. The sender needs a lawful basis, usually legitimate interests, must tell the contact that their details are used for marketing, and must stop when they object.
What must a B2B marketing email include?
The sender's identity, undisguised, and a valid address the recipient can use to opt out or unsubscribe. Honour any objection.
What does brand strategy cost in the UK?
At Branding Tatva the Foundation engagement starts at £1,950 for UK clients. Its published scope includes discovery and positioning, audience definition, a core visual identity, starter brand guidelines and launch messaging direction. Data protection advice is outside the scope.
Research record
What this guide draws from.
Each source note describes what the reference supports. Platform guidance, research findings and Branding Tatva's practical suggestions have different scopes.
- Business to business marketing
Information Commissioner's Office
Corporate and individual subscribers, the PECR table, identity and opt out requirements, and the UK GDPR overlay. Flagged by the ICO as under review following the Data (Use and Access) Act.
- Electronic mail marketing
Information Commissioner's Office
