- B2B cold email is legal in the UK when you target corporate subscribers such as limited companies, LLPs and Scottish partnerships, because the PECR email consent rule does not apply to them.
- Sole traders and most other partnerships are individual subscribers under PECR, so you need consent or a valid soft opt-in before emailing them, which cold outreach will not have.
- UK GDPR still applies to named business contacts, so you need a lawful basis (usually legitimate interests), a documented assessment, transparency about where you got the data and an opt-out you honour permanently.
- Regulated firms have a third layer: FCA financial promotion rules govern what you can say, so keep product claims, rates and returns out of cold email.
- Under the Data (Use and Access) Act the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover, so keep records you could show a regulator.
Yes, cold email to UK businesses is legal when you target corporate subscribers such as limited companies and LLPs, rely on a documented legitimate interest under UK GDPR, identify yourself clearly and include an opt-out in every message. For regulated firms there is a third layer: the FCA's financial promotion rules, which shape what you can say rather than whether you can send.
Most answers stop at "corporate subscribers are exempt". That is true, but it is the start of the job, not the end. Below is the checklist we would work through for a commercial finance broker, lender, debt recovery firm, payments business or wealth and insurance firm before a single email goes out.
One caveat first. The ICO's business-to-business marketing guidance notes it is under review following the Data (Use and Access) Act coming into law on 19 June 2025. The principles below are stable, but check the current guidance and take legal advice on anything specific to your firm.
Step 1: Check the legal form of every company before it enters a sequence
Why
PECR's rule on marketing by electronic mail requires consent or a soft opt-in, but it does not apply to corporate subscribers. The ICO defines those as corporate bodies with separate legal status: companies, LLPs, Scottish partnerships and some government bodies. Sole traders and other partnerships are individual subscribers, and PECR treats them the same as consumers. You will not have consent or a soft opt-in from someone you have never dealt with, so they are off limits for cold email.
How
Match every target company to a Companies House record. A registered number for a Ltd, PLC or LLP puts it in the corporate bucket. A trading name with no registration usually means a sole trader or ordinary partnership, so remove it. Do this at list-building stage, not after the copy is written.
Example
An asset finance broker targeting haulage firms will find plenty of owner-drivers trading as sole traders. They might be perfect prospects commercially, but they cannot go in a cold email sequence. A debt recovery firm targeting accountancy practices needs the same check: many smaller practices are traditional partnerships, while larger ones are often LLPs.
Step 2: Write and file a legitimate interests assessment
Why
A named work address like jane.smith@company.co.uk is personal data, so UK GDPR applies even when PECR permits the send. For cold outreach the lawful basis is almost always legitimate interests, and the ICO expects you to be able to show your working through a three-part test:
- Purpose: you have a legitimate interest in marketing to this audience.
- Necessity: processing this person's data is necessary for that purpose.
- Balance: your interest is not overridden by their rights and reasonable expectations.
How
Write one assessment per audience or campaign. Record who you are targeting, why their role makes the message relevant, what data you hold (keep it to name, role, work email and company), where it came from and what safeguards you apply: opt-out on every email, permanent suppression, no special category data. Date it and review it when the audience or offer changes.
Example
A payments firm emailing finance directors at e-commerce retailers about card acceptance costs passes the balance test comfortably, because the subject sits squarely within the role. The same firm emailing that finance director about their personal pension would not. The test is about relevance to the person's job, not just the fact that they work at a limited company.
Step 3: Source data you can explain
Why
When you collect personal data from somewhere other than the person, UK GDPR requires you to give them privacy information, including the source. The ICO's guidance says this applies to publicly available data used in a business context too. If you cannot say where a contact came from, you cannot meet that duty.
How
Build lists from sources you can name: Companies House, company websites, job postings, press coverage and professional profiles. Log the source against each contact. Link a privacy notice in your email footer that explains why you hold the data and how to object. Be cautious with bought lists: if the seller cannot evidence how the data was collected, the risk transfers to you.
Example
A commercial lender that finds prospects through new Companies House charges or recently filed accounts can say exactly where the data came from, and the reason for contact is obvious to the recipient. That is far easier to defend than a spreadsheet of 20,000 "UK SME directors" bought with no provenance.
Step 4: Identify yourself and put an opt-out in every email
Why
The corporate subscriber exemption removes the consent requirement, not the rest of PECR. You must not conceal your identity, and you must give a valid way to opt out, in every message, including the third follow-up.
How
Send from a real person, name the company, and include a registered address in the signature. Add a plain opt-out line, such as "If this isn't relevant, reply and I won't contact you again", or a working unsubscribe link. Many FCA-authorised firms also include their regulatory status in signatures, so follow your compliance team's policy.
Example
An invoice finance provider runs a four-step sequence. Each step carries the same signature block and the same opt-out line. A follow-up that drops the footer because it "looks cleaner" is a breach waiting to happen.
Step 5: Treat every opt-out as permanent and global
Why
Under UK GDPR the right to object to direct marketing is absolute. Once someone says stop, you stop, and there is no balancing test to argue.
How
Keep one suppression list that covers every campaign, sending domain and channel, including LinkedIn. Treat "remove me", "not interested, please stop" and angry replies as opt-outs. Do not delete the contact entirely: keep the minimum (usually the email address) on the suppression list so they are never re-imported from a fresh data pull.
Example
A broker sending from several domains gets an opt-out on one of them. If that suppression only applies to that domain, the same director can receive a different campaign next month, which is exactly the kind of complaint that reaches the ICO.
Step 6: Keep financial promotions out of cold email
Why
This is where regulated firms differ from everyone else. Section 21 of the Financial Services and Markets Act restricts communicating an invitation or inducement to engage in investment activity unless you are authorised or the promotion is approved by an authorised person. The FCA's financial promotions guidance sets out what that means in practice. A cold email can easily become a promotion if it describes a product, its benefits or its returns.
How
Use the first email to open a conversation about a business situation, not to pitch a product. Leave out rates, returns, tax benefits and approval claims. Detailed product information comes later, once someone has replied, through materials your compliance team has signed off. Even where the product is unregulated, such as much commercial lending, most compliance teams want the same discipline because misleading claims still create risk.
Example
A wealth firm emailing business owners who have just filed strong accounts might ask whether they have started thinking about an exit and what it means for them personally. It would not mention investment performance or products. That keeps the email on the right side of the line and, in our experience, short, situation-led emails get better replies anyway. We cover that in more detail in The Reality of Financial Outbound: Lessons from 942,508 Emails.
Step 7: Send from infrastructure that meets mailbox provider rules
Why
This is not law, but it is just as binding in practice. Since February 2024 Google requires anyone sending 5,000+ emails a day to Gmail to have SPF, DKIM and DMARC, one-click unsubscribe and a spam complaint rate under 0.3%. Microsoft introduced the same requirements for Outlook in May 2025.
How
Set up SPF, DKIM and DMARC on every sending domain. Send from separate, warmed-up domains rather than your main corporate domain, so a deliverability problem never touches your client emails. Keep volumes per mailbox modest and watch complaint rates.
Example
A fintech firm that sends cold email from its primary domain and gets flagged risks its onboarding and billing emails landing in spam too. Separate domains keep that risk contained.
Step 8: Keep records you could show the ICO
Why
The stakes have gone up. Under the Data (Use and Access) Act the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover, whichever is higher. The previous maximum was £500,000.
How
Keep a compliance file per campaign: the legitimate interests assessment, the entity checks, the data source log, copies of every template, the suppression list and a note of how opt-outs are processed. If a complaint arrives, you should be able to answer "why did you email me and where did you get my details?" within a day.
Example
An insurance broker receives a complaint from a director who says they never agreed to be contacted. With a file showing the company is a registered Ltd, the data came from the company website, the assessment was completed and the opt-out was actioned within hours, the conversation is short.
Common mistakes
- Assuming every business email is fair game. A business email at a sole trader is still an individual subscriber under PECR.
- Getting generic addresses wrong. An info@ address at a limited company is not personal data, so UK GDPR has less to say, but the PECR identity and opt-out rules still apply. It is not a loophole for sole traders either.
- Dressing marketing up as something else. "Quick question" or "free consultation" emails that promote your services are still direct marketing.
- Buying lists with no provenance. If you cannot name the source, you cannot meet your transparency duty.
- Running suppression per campaign. Opt-outs must follow the person across every campaign, domain and channel.
- Writing the assessment once and forgetting it. A new audience or offer needs a fresh look.
- Letting product claims creep in. Rates, returns and approval language turn a conversation opener into a possible financial promotion.
If you want the targeting side of this explained, see How to Build a High-Intent Outbound Pipeline in Financial Services.
At Rept, these steps are built into every managed campaign across our 150+ financial services clients: corporate-subscriber targeting under PECR, an opt-out on every email, a legitimate interests assessment on file, permanent suppression lists, sending from separate warmed-up domains and no financial promotions in cold email.