Key takeaways
- Limited companies, LLPs and Scottish partnerships can be emailed, texted or messaged without consent, if you identify yourself and offer an opt-out.
- Sole traders and most other partnerships need to have consented first. When in doubt, the ICO says treat a business as a sole trader.
- Live calls are allowed to any business whose number isn't on the TPS or CTPS and who hasn't objected; automated calls need consent.
- Social media direct messages count as electronic mail, so the email rules apply to them.
- The maximum PECR fine is now £17.5 million or 4% of global turnover, after the Data (Use and Access) Act 2025.
The rules at a glance
UK direct marketing is governed by PECR (the Privacy and Electronic Communications Regulations) and, when you use someone's personal data, UK GDPR. PECR treats businesses in two groups, and the group decides what you can do.
| Contact method | Limited company, LLP, Scottish partnership | Sole trader or other partnership |
|---|---|---|
| Allowed without consent, if you identify yourself and offer an opt-out | Consent needed (or the soft opt-in for existing customers) | |
| Text message | Allowed, on the same terms as email | Consent needed |
| Social media direct message | Allowed, on the same terms as email | Consent needed |
| Live phone call | Allowed unless the number is on the CTPS or TPS, or they've objected | Allowed unless the number is on the TPS or CTPS, or they've objected |
| Recorded or automated call | Consent needed | Consent needed |
| Letter or visit | Not covered by PECR; UK GDPR applies if you use a person's details | Not covered by PECR; UK GDPR applies |
Sources: the ICO's guidance on business-to-business marketing, electronic mail marketing and telephone marketing. The ICO counts texts, voicemails and social media direct messages as “electronic mail”, so the email rules apply to all of them.
How to tell a company from a sole trader
The deciding question is whether the business is a corporate subscriber (a company, LLP, Scottish partnership or public body) or an individual subscriber (a sole trader or an ordinary partnership in England, Wales or Northern Ireland). To check:
- Look for “Ltd”, “Limited” or “LLP” in the name on invoices, the shop sign or social media pages.
- Search the business name, or the owner's name, on the Companies House register. It's free, and the advanced search can filter by location and incorporation date.
- Check the company is active, not dissolved, and that its trading name matches the business you found.
- If you can't tell, treat the business as a sole trader. That's the ICO's advice.
Expect many small local businesses to be sole traders: barbers, beauticians, groomers and tradespeople often are. Plan to reach them by phone, by post or in person.
Emailing businesses: what you must include
When you email a corporate subscriber without consent, PECR requires two things in every message:
- Who you are. You must not disguise or conceal your identity.
- A valid way to opt out. A reply address works for one-to-one emails; an unsubscribe link for bulk sends.
The ICO says you should honour opt-outs from companies even though PECR doesn't strictly require it, and keep a suppression list rather than deleting people, so you never contact them again by mistake.
When UK GDPR applies too
If the email address identifies a person (jane.smith@company.co.uk, or a director you found on Companies House), you're processing personal data, and UK GDPR applies alongside PECR. In practice that means:
- a lawful basis, usually legitimate interests, which you should assess and record;
- telling the person who you are, where you got their details and how to object, in your first message or a linked privacy notice;
- stopping immediately if they object. The right to object to direct marketing is absolute.
Generic addresses such as info@ or bookings@ that don't identify anyone aren't personal data, so only PECR applies. The cold email templates include an identification and opt-out line that meets these rules.
Calling businesses
Live sales calls don't need consent, but every call must follow these rules:
- Screen against both the TPS and CTPS, because sole traders register on the TPS and companies on the CTPS. Don't call a registered number unless that business has told you it's happy to receive your calls.
- Say who is calling, and give an address or freephone number if asked.
- Display your number, or another number they can call back on.
- Keep a do-not-call list and check it before every call.
Screening is done through the TPS and CTPS registers, either directly or through a screening service. The cold calling script is built around these rules.
Penalties
The ICO enforces PECR, takes complaints from businesses and the public, and can fine organisations that break it. The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to the UK GDPR level: £17.5 million or 4% of global annual turnover, whichever is higher. Fines on that scale are aimed at mass senders and cold callers, but a complaint can lead to an ICO investigation whatever your size, and a reputation for spam is costly in a small local market.
Common mistakes
Thinking “B2B” means anything goes
The business-to-business exemption covers companies, not sole traders, and many small local businesses are sole traders.
Solution: Check every business against Companies House. Only corporate subscribers can be emailed without consent.
Cold DMs on Instagram
A direct message is electronic mail under PECR, so the consent rule for sole traders applies.
Solution: Use a phone call (after TPS screening), a letter or a visit for sole traders, and ask whether you can message them.
Buying an email list
Bought lists rarely say which contacts are sole traders, and their consent, if any, wasn't given to you.
Solution: Build your own list from public listings, and check each business yourself.
Losing track of opt-outs
Contacting someone who has asked you to stop is the quickest route to a complaint.
Solution: Keep one suppression list for email and one do-not-call list, and check them before every campaign.
Quick reference: a compliance checklist
| Before you… | Check |
|---|---|
| Email, text or DM | Company or LLP on Companies House? If not, have they consented? |
| Email a named person | Legitimate interests assessed; privacy information in or linked from the message |
| Call | Number screened against TPS and CTPS; not on your do-not-call list; number displayed |
| Any message | Your name and business stated; a working way to opt out |
| After an opt-out | Added to your suppression or do-not-call list the same day |
This guide is general information, not legal advice. The ICO notes that its direct marketing guidance is under review following the Data (Use and Access) Act 2025, so check its latest guidance before a large campaign.
Common questions
Do I need consent to email a business in the UK?
Not if it's a limited company, LLP, Scottish partnership or other corporate body: PECR lets you send it marketing emails as long as you identify yourself and give a valid opt-out address. Sole traders and most other partnerships count as individuals, so you need their consent first.
Can I email info@ addresses?
Yes, if the business is a corporate subscriber, with your identity and an opt-out in the message. A generic address that doesn't identify a person isn't personal data, so UK GDPR doesn't apply, but PECR's company-versus-sole-trader rule still does.
Do PECR rules apply to LinkedIn and Instagram messages?
Yes. The ICO counts social media direct messages as electronic mail, so a sales message to a sole trader needs their consent, and messages to companies must identify you and offer an opt-out.
Does GDPR stop me from emailing businesses?
No. UK GDPR applies when you use a person's details, such as a named director's email address. You'll usually rely on legitimate interests, tell them who you are and how you got their details, and stop if they object.
What is the soft opt-in?
An exception that lets you email existing customers about similar products or services when you collected their details during a sale or negotiations for one, gave them a chance to opt out, and repeat that opt-out in every message. It doesn't cover new prospects.
Social media messages, texts and letters
Instagram, Facebook and LinkedIn messages count as electronic mail, so a sales message to a sole trader's Instagram account needs their consent, just like an email. Replying to a public question, or sending a message after they've invited you to, is different from a cold sales pitch.
Texts follow the email rules. Letters and visits aren't covered by PECR, which makes a posted mock-up or a walk-in the simplest lawful first contact with a sole trader. UK GDPR still applies if you address a letter to a named person: say who you are and how to opt out.