Email Marketing Rules in the UK (2026): PECR Guide for SMEs
If you run a small business in the UK and send marketing emails, the rules come from the Privacy and Electronic Communications Regulations (PECR), read alongside UK GDPR. In short: you need consent (or the “soft opt-in”) to email individuals and sole traders, you can email most limited companies without consent, and every message must say who you are and offer an easy way to opt out. Since the Data (Use and Access) Act 2025 provisions took effect in February 2026, the maximum PECR fine is now in line with UK GDPR, so getting this right matters more than it used to.
This guide explains the rules in plain English, shows how they apply to common SME situations, and ends with a checklist you can work through this week. It is general information, not legal advice; if your situation is unusual (for example, you buy data, run a charity or operate in a regulated sector), check the ICO guidance or speak to a data protection adviser.
What changed in 2026
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, and most of its remaining provisions came into force on 5 February 2026. For email marketers, three changes stand out:
- Higher fines. PECR breaches used to carry a maximum fine of £500,000. The cap is now the higher of £17.5 million or 4% of global annual turnover, the same level as UK GDPR.
- A charity soft opt-in. Charities can now send electronic marketing to people who supported or showed interest in their work, as long as those people were offered an opt-out. The ICO updated its electronic mail guidance on 28 April 2026 to explain this.
- Cookie changes. Some low-risk cookies (for example, certain analytics) can now be set without consent, though transparency and opt-out duties still apply. If you run an online shop, this sits alongside your email rules.
The core email rules for businesses did not get softer. If anything, the risk of ignoring them went up.
Who you are emailing decides the rules
PECR splits recipients into two groups, and the difference is the single most important thing to understand.
| Recipient | Example | Consent or soft opt-in needed? | Must identify sender and offer opt-out? |
|---|---|---|---|
| Individual subscriber | A customer’s personal Gmail address | Yes | Yes |
| Sole trader or some partnerships | A self-employed plumber’s work email | Yes (treated like individuals) | Yes |
| Corporate subscriber | Someone at a limited company or LLP | No | Yes |
Two practical notes on the B2B row. First, if you email a named employee (jane.smith@company.co.uk), you are still processing personal data, so UK GDPR applies: you need a lawful basis, a privacy notice and to honour objections. Second, many small business customers are sole traders, so a “B2B list” often contains people who need consent. If you cannot tell which is which, treat the address as an individual.
Consent: what counts
PECR uses the UK GDPR standard of consent: “freely given, specific, informed and unambiguous”. For a small business, that means:
- A clear, active choice. An unticked box the person ticks, or a separate “Yes, email me offers” button. Pre-ticked boxes, silence or inactivity do not count.
- Separate from your terms. Do not bundle marketing consent into checkout terms, and do not make it a condition of buying.
- Named and specific. Say that it is your business sending the emails and that the consent covers email marketing.
- Recorded. Keep a record of who consented, when and how (form version, page, timestamp).
- Easy to withdraw. Once someone withdraws, stop emailing them.
The soft opt-in for existing customers
Most small businesses rely on the soft opt-in for their customer newsletter. It lets you email individuals without consent only if all of these conditions are met:
- You got the email address directly from the person, during a sale or negotiations for a sale (for example, at checkout or when sending a quote).
- You only market your own similar products and services.
- You gave them a simple way to refuse marketing when you collected the address, and you give it again in every email.
The soft opt-in does not cover addresses you bought or got from a partner, marketing for other companies, or (for commercial businesses) campaigning messages. The charity soft opt-in introduced in 2026 has its own conditions and only applies to charities.
What a compliant checkout looks like
At checkout, add a line such as “We’ll send you occasional emails about similar products. Untick this box if you’d prefer not to.” For the soft opt-in, the key is that the person can refuse at the point you collect the address. Then put an unsubscribe link in every email and process requests promptly.
What every marketing email must include
These two requirements apply to everyone you email, including limited companies:
- Do not hide or disguise who you are. The sender name and content must make clear the email is from your business.
- Give a valid contact address for opting out. In practice, a working one-click unsubscribe link plus your business contact details in the footer.
Real enforcement examples
The ICO fines businesses for electronic marketing breaches regularly. In January 2026 it announced two fines totalling £225,000:
- Allay Claims Ltd (£120,000) sent more than four million promotional texts. Its soft opt-in claim failed because people were not offered a chance to opt out when their details were collected.
- ZMLUK Limited (£105,000) sent more than 67 million marketing emails using data bought from a third party. People saw a list of 361 “partner” organisations but could not choose between them, which the ICO said was not specific, informed consent.
Both cases are useful lessons for SMEs: the opt-out must be offered at collection, and bought-in lists carry real risk.
A 7-step compliance checklist for SMEs
- Map your sources. List every place email addresses enter your systems: checkout, newsletter form, quotes, events, imported lists.
- Tag each contact. Mark them as consent, soft opt-in, corporate (B2B) or unknown.
- Fix your forms. Use unticked boxes, plain wording and a link to your privacy notice.
- Add the opt-out at collection. Especially at checkout and quote stage, so the soft opt-in is valid.
- Check your footer. Business name, contact address and a working unsubscribe link in every template.
- Quarantine risky data. Do not email “unknown” or bought-in contacts until you have valid consent.
- Keep records. Store consent logs and suppression lists so unsubscribed people never get re-added.
If you want a second pair of eyes on your forms, tracking and email setup, our Digital Performance Audit reviews your site and marketing stack, and the Analytics & Reporting Setup helps you measure email results without breaking privacy rules.
Common mistakes
- Pre-ticked boxes or consent hidden in terms and conditions.
- Treating every business address as B2B, when many are sole traders who need consent.
- Using the soft opt-in for prospects who never bought or asked for a quote.
- Promoting partner offers to soft opt-in contacts (that is marketing for someone else).
- Importing old or bought lists without checking how consent was collected.
- Slow or broken unsubscribes, or re-importing people who already opted out.
FAQ
Do I need consent to email limited companies in the UK?
No, PECR’s consent and soft opt-in rules do not apply to corporate subscribers. You must still identify yourself and provide an opt-out, and UK GDPR applies if you email named individuals.
Can I use the soft opt-in for newsletter sign-ups?
Not usually. The soft opt-in needs a sale or negotiations for a sale. A newsletter sign-up form should collect clear consent instead.
Is a sole trader treated as a business or an individual?
As an individual. Sole traders and some partnerships need consent or a valid soft opt-in, just like consumers.
What is the maximum fine for breaking PECR now?
Since the DUAA provisions took effect in February 2026, the maximum is the higher of £17.5 million or 4% of global annual turnover.
Conclusion
UK email marketing rules are manageable for small businesses once you know who is on your list. Get clear consent from individuals and sole traders, use the soft opt-in only for genuine customers, identify yourself and make opting out easy in every message. With higher fines now in force, a short audit of your forms and lists is one of the cheapest risk reductions you can make this year.
For related reading, see our guides to email marketing rules in Germany, cookie banner rules in the Netherlands and how a digital performance audit uncovers growth blocks.
Sources
- ICO: Guidance on direct marketing using electronic mail (updated 28 April 2026)
- ICO: What are the rules on direct marketing using electronic mail?
- Lewis Silkin: UK data reform becomes reality (February 2026)
- Data (Use and Access) Act 2025: increased maximum fines for cookies and direct marketing (July 2025)
- RPC: ICO issues fines over electronic marketing breaches (Spring 2026)
