Harper James advises start-ups, scale-ups and established businesses on electronic marketing compliance under the laws of England and Wales. The key framework is the Privacy and Electronic Communications Regulations 2003 (PECR), supported by the UK GDPR and Data Protection Act 2018.
PECR generally requires prior consent before sending marketing emails or SMS messages to individual subscribers, including sole traders and some partnerships. Consent must be specific, informed, freely given and capable of being withdrawn. A pre-ticked box, vague wording in general terms, or consent obtained for unrelated purposes will not provide a sound basis for a campaign.
The “soft opt-in” is a limited exception for existing customers. It applies where the business collected contact details during a sale or negotiations for a sale, markets its own similar products or services, and gave a clear opt-out when collecting the details and in every later message. Businesses should also distinguish corporate subscribers from individuals, keep evidence of how each address was obtained, and maintain a suppression list for people who have opted out. Read the practical compliance guidance before launching a campaign or changing a customer database.
Marketing to a limited company’s generic business address, such as sales@company.co.uk, is treated differently from marketing to a named employee. PECR still requires the sender to identify itself and provide a straightforward unsubscribe method, while UK GDPR applies where the address identifies an individual. A bought-in list does not transfer responsibility for consent, transparency or data accuracy to the purchaser.
A workable process starts with a source and consent record for every contact, approved wording for sign-up forms, a clear preference centre, and automatic suppression of unsubscribed addresses across all systems. Review suppliers that send campaigns on the business’s behalf, check contracts for data-processing obligations, and include the legal entity’s identity and a functioning unsubscribe link in every message.
Regulatory reform is being introduced in stages, including changes under the Data (Use and Access) Act 2025 that affect data protection and electronic communications. Businesses should track commencement dates and updated Information Commissioner’s Office guidance rather than assume that a new rule applies immediately. A focused review of consent records, soft opt-in use, supplier arrangements and unsubscribe controls gives a practical starting point. For larger marketing operations, Harper James can support a documented PECR and UK GDPR review alongside wider data protection governance.