GDPR and PECR Rules for B2B Cold Email in the UK and EU
· 4 min read
This is general information, not legal advice. GDPR and PECR are UK and EU law; both change, and how they are enforced differs by country. If you send at scale into the UK or EU, ask a lawyer who knows the rules where your recipients are.
Two different sets of rules usually come up together and get treated as one, and that is where most of the confusion starts. PECR (the Privacy and Electronic Communications Regulations) governs how you may contact someone electronically — email, text, phone. GDPR governs how you may hold and use someone's personal data. A cold email touches both, because it is an electronic message that usually contains a person's name and email address.
The distinction that matters most: who you are writing to
PECR treats a corporate subscriber — a limited company, an LLP, a Scottish partnership — differently from an individual subscriber, which includes a person, a sole trader, and an ordinary partnership in England and Wales.
| Who you are emailing | PECR treatment | What it means in practice |
|---|---|---|
| A limited company (info@, a named role) | Corporate subscriber | PECR's consent rule for direct marketing does not apply the same way; email to a company address is generally allowed without prior consent |
| A sole trader or an ordinary partnership | Individual subscriber | Treated like emailing a person: PECR's marketing consent rules apply in full |
| A named person at a company, using their personal data | Still a person under GDPR | The company exemption is about PECR's marketing-by-electronic-means rule; GDPR's data protection rules apply to any personal data regardless |
A cold email to [email protected] and one to [email protected], Jane Smith, sole trader are not under the same rules, even though both look like ordinary B2B outreach.
GDPR still applies, even when PECR does not block you
Reaching a company's generic inbox does not opt you out of GDPR. If the email contains a person's name, role, or direct contact details, that is personal data, and you need a lawful basis to process it — usually legitimate interest for ordinary B2B marketing. Legitimate interest is not a blank check: it asks you to weigh your interest in contacting them against their interest in not being contacted, and to be able to show that weighing if asked.
In practice, legitimate interest for B2B cold email tends to hold up when:
- The message is relevant to the business's actual activity (a booking-page offer to a business with no website, not a generic blast).
- You identify yourself clearly and say why you are writing.
- You offer an easy way to object or opt out, and you honor it without delay.
- You are not holding or reusing the data for anything beyond that outreach.
What every message should have, regardless of entity type
- Who you are. A real name and a real business, not a brand that only exists as a sender name.
- Why they are getting it. Where the information came from (their own public listing, their own website) and why you thought it was relevant.
- A way to object. Under GDPR this is the right to object to processing, separate from PECR's opt-out; in practice, one clear unsubscribe link or reply instruction covers both.
- No pretending. No fake "Re:" subject lines, no borrowed brand names, nothing that misrepresents who is writing — this is the same rule as CAN-SPAM's ban on deceptive subject lines, under different law.
Where this differs from the United States
CAN-SPAM is an opt-out law: you may generally send the first message without permission, as long as you are honest and you stop when asked. GDPR and PECR start from a narrower place — you need a lawful basis before the first message, not just good behavior after it. For a company's general inbox, "fair, relevant B2B outreach under legitimate interest" is usually that basis; for an individual or sole trader, PECR's stricter marketing-consent rules apply on top.
If your list mixes countries, the United States rules in the CAN-SPAM checklist and the UK/EU rules here are not interchangeable — check the recipient's own country, not your own.
Keeping this manageable
A do-not-contact list that is checked before every send, and again at the moment of sending, covers the opt-out requirement under both PECR and GDPR at once. AyePin keeps that list across every campaign and channel, so an objection raised once is honored everywhere, and quiet hours follow the recipient's own time zone and country rather than a single global setting. For what to do once someone actually replies and objects, see how to handle STOP and "not interested" replies.