- GDPR and PECR are separate tests: legitimate interests lets you use the data, but only corporate subscribers such as limited companies and LLPs can be cold emailed without consent.
- A campaign-specific legitimate interests assessment, filed before the first send, is far stronger than one generic document covering all outreach.
- Keep cold emails as short conversation openers with no rates, returns or product claims, and leave product detail to approved material after someone replies.
- One central, permanent suppression list checked across every domain, mailbox and channel prevents most real complaints.
- Under the Data (Use and Access) Act the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover, so data security and evidence matter as much as copy.
To run GDPR-compliant cold email in UK financial services, you only email corporate subscribers, document a legitimate interests assessment before you send, and keep every message free of financial promotion content. Then you make opting out easy, suppress people permanently, and secure the data and sending setup so you can evidence all of it if the ICO or your compliance team asks.
The rest of this guide is the operating detail: what to check, in what order, and what it looks like in a broker, lender, debt recovery, fintech or wealth campaign.
One note first: this describes how compliant outbound is run in practice. It is not legal advice, and your compliance officer or solicitor should sign off your own setup.
Step 1: Classify every recipient under PECR before they enter a list
Why
UK GDPR decides whether you can use someone's personal data. PECR decides whether you can send them unsolicited marketing by email. They are separate tests, and passing one does not pass the other.
The ICO's business-to-business marketing guidance is clear that the PECR rule on marketing by electronic mail does not apply to corporate subscribers: companies, LLPs, Scottish partnerships and some government bodies. Sole traders and other partnerships are individual subscribers, and PECR treats them the same as consumers, so you generally need consent.
How
Check legal status at company level, not from the email domain. A tidy address at smithjoinery.co.uk tells you nothing about whether Smith Joinery is incorporated.
- Match each target company against Companies House and keep only incorporated companies and LLPs.
- Drop anything trading as a sole trader or ordinary partnership.
- Drop personal mailboxes (Gmail, Hotmail, iCloud), even where the person is a director.
- Record the check against the contact so you can show it later.
Example
A commercial finance broker targeting trades and hospitality will find plenty of sole traders in the market. They may need funding, but they are off limits for cold email without consent. The campaign targets limited companies only, which are also the businesses with filed accounts and registered charges you can actually research.
Step 2: Write and file a legitimate interests assessment
Why
For named contacts at corporate subscribers, legitimate interests is the lawful basis most firms rely on. The ICO's marketing and data protection guidance sets out when it can apply. It only holds up if you have done the three-part test and written it down before the first send.
How
Your LIA should answer three questions:
- Purpose: what specific commercial interest are you pursuing?
- Necessity: is emailing this role a proportionate way to pursue it, using only the data you need?
- Balancing: would someone in this role reasonably expect to hear from a firm like yours on this subject, and what safeguards reduce the impact on them?
Make it campaign specific. An LIA covering "sales outreach" is weak. One covering "emailing finance directors of UK limited companies with recent Companies House charges about invoice finance" is strong, because relevance is built into the targeting. Review it whenever the audience, offer or data source changes.
Example
A debt recovery firm emails credit controllers at UK limited companies whose filed accounts show trade debtors rising. The interest is commercial, the recipient is the person responsible for collections, and the message relates directly to their job. That balancing argument is far easier to make than one for a blast to every "manager" on a bought list.
Step 3: Minimise and trace the data you hold
Why
Data minimisation and accuracy are core UK GDPR principles. In outbound they also limit the damage if a tool or supplier is breached.
How
Separate company research from personal data. Signal-triggered outbound runs mostly on company facts: a funding round, a new Companies House charge, a sales hiring push, a leadership hire, new paid advertising. The personal data you need is usually just name, job title and work email.
For every contact, record:
- where the details came from and when
- the signal that made the company relevant
- a retention date, after which unengaged contacts are deleted
Don't enrich with data you will not use, such as mobile numbers, home addresses or personal social profiles.
Example
A payments fintech targets ecommerce businesses that have just launched paid advertising or changed their checkout tech stack. The research file holds those company facts. The contact record holds the head of ecommerce's name, title and work address, plus a source and a deletion date. Nothing else. For more on choosing signals, see how to build a high-intent outbound pipeline in financial services.
Step 4: Make the first email transparent
Why
When you collect personal data from somewhere other than the person, UK GDPR requires you to give them privacy information, and where you use that data to contact them, at the latest at the first communication. In cold email, the first email is that moment. PECR separately requires that you never disguise who is sending and that you give a valid address for opt-outs, and the ICO's electronic mail marketing guidance confirms this applies to corporate subscribers too.
How
Every first email should make clear:
- who you are and which firm you work for, as a real person at a real company
- why you are writing to them specifically
- briefly, where you got their details
- a link to your privacy notice
- a simple way to opt out
This doesn't need to be clunky. One footer line covers source, privacy link and opt-out. The body stays short and specific.
Example
A wealth firm emailing founders after a funding round writes two or three sentences referencing the round and asks whether a conversation would be useful. The footer reads: "We found your details via Companies House and your company website. Our privacy notice is here. Reply 'no thanks' and we won't contact you again."
Step 5: Keep cold email out of financial promotion territory
Why
Under section 21 of FSMA, a communication that invites or induces someone to engage in investment activity is a financial promotion, and it must be made or approved by an authorised person. Whether a given email crosses that line depends on the product, and that is a call for compliance. Cold email is the wrong place to test it. A promotion buried in a sequence compliance never saw is exactly the kind of problem your FCA supervisor will care about.
How
Treat the cold email as a conversation opener, not a pitch.
- No rates, returns, performance figures or eligibility claims.
- Nothing that reads as a promise, such as "guaranteed" or "risk-free".
- State the reason you are writing and ask a question.
- Product detail comes later, after a reply, through approved materials and your normal process.
- Have compliance approve the templates and the rules writers follow, not one sample email.
Short emails help. The less you say, the less there is to get wrong, and they tend to read better too: see why minimalist email templates outperform complex sequences.
Example
A commercial lender targeting manufacturers that have just hired a new CFO writes: "Saw you've brought in a new CFO. New finance leaders often review existing funding lines in their first months. Would a short call be useful?" No rates, no product promise. If the CFO replies, the lender's team takes over with approved material.
Step 6: Suppress opt-outs permanently, everywhere
Why
The right to object to direct marketing is absolute. Once someone says stop, you stop, and you don't add them back next quarter when fresh data arrives. Failures here generate most real complaints.
How
- Put an opt-out in every email, not just the first.
- Treat any reply that means "stop" as an opt-out, however it's phrased.
- Run one master suppression list, checked before every send across every domain, mailbox and channel, LinkedIn included.
- Suppress the whole company domain when someone says "don't contact anyone here".
- Never delete the suppression list. Keep only what you need to recognise the person.
- Screen new data against it before it is loaded, not after.
Example
A broker sends from several warmed-up domains to protect its main brand. A director opts out from domain two. If suppression lives inside each mailbox rather than centrally, domain four emails the same director next week. That is how well-intentioned firms end up explaining themselves to the ICO.
Step 7: Secure the data and the sending infrastructure
Why
Clients, auditors and regulators hold financial services firms to high data security standards. The penalties have also changed: under the Data (Use and Access) Act, the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover, whichever is higher. The previous maximum was £500,000.
How
On data:
- Named user access with MFA, removed the day someone leaves.
- A data processing agreement with every supplier touching contact data, including any outbound agency, with controller and processor roles agreed in writing.
- Know where data is hosted and what transfer safeguards apply if it leaves the UK.
- A breach process naming who decides whether to notify the ICO.
On sending:
- SPF, DKIM and DMARC on every sending domain.
- One-click unsubscribe.
- A spam complaint rate under 0.3%. Since February 2024 Google has required all of this from anyone sending 5,000+ emails a day to Gmail, and Microsoft introduced the same requirements for Outlook in May 2025.
- Separate, warmed-up sending domains, so a deliverability problem never touches the domain your clients rely on.
Example
A fintech hiring an outbound provider should ask for the DPA, a list of sub-processors, where data is stored, how suppression works across tools, and the campaign LIA. If a provider can't produce those quickly, that tells you how they would handle a complaint.
Step 8: Keep the evidence in one place
Compliance you can't prove is hard to defend. Keep a single folder per campaign: PECR classification checks, the LIA, template approvals, data sources, the suppression list, DPAs and deliverability figures. Review it monthly.
If a finance director complains that they never agreed to be contacted, you should be able to show within a day that their employer is a limited company, which LIA covered the campaign, where their details came from, that every email offered an opt-out, and the date they were suppressed.
Common mistakes
- Assuming B2B means PECR doesn't apply. Sole traders and ordinary partnerships are individual subscribers.
- Trusting a list seller's word. Bought or scraped data still needs your own classification, sourcing record and LIA.
- One LIA for everything. Generic assessments don't survive scrutiny.
- Product detail in the first email. Rates and returns belong in approved material after a reply.
- Suppression per mailbox. Multiple domains need one central list.
- Hidden or awkward opt-outs. No logins, no forms, no "allow ten working days".
- Treating authentication as optional. Missing DMARC now costs you inbox placement as well as credibility.
- Thinking outsourcing outsources responsibility. If an agency emails on your behalf, your firm's name is on it.
How Rept does it
Rept runs fully managed, signal-triggered outbound for UK financial services firms with these controls built in: corporate-subscriber targeting under PECR, a legitimate interests assessment on file, an opt-out on every email, permanent suppression lists and no financial promotions in cold email. We map the target market, research every company for signals, write each email from that research, send from separate warmed-up domains and hand interested replies to you. Across 150+ financial services clients, that process has produced a 29.4% average positive reply rate.