How PECR and UK GDPR change email consent and list cleaning for British senders

What to take away

Why PECR and UK GDPR sit side by side for British senders

PECR decides whether you may send an electronic mail marketing message to a particular person. UK GDPR decides whether you may hold, profile, segment and retain the data that makes the send possible. A campaign can fail either test independently, and passing one does not excuse failing the other.

Both rulebooks reach the same campaign, which is why a clean list and a lawful basis are not alternatives. They are the same job viewed from two ends. The wider UK rules and compliance around an email campaign matter too, because advertising standards, consumer law and financial promotion rules can all bite on the same message.

PECR's consent rule for unsolicited email protects individual subscribers. Corporate subscribers can be sent unsolicited marketing email without consent or a soft opt-in, though UK GDPR still applies to the personal data of the people who work there. The safer habit is to treat an address as personal unless you have checked which kind it is.

Opt-in under PECR: what counts as valid consent for email

The ICO guidance on email marketing states that unsolicited marketing to individual subscribers needs either consent or all the requirements of a soft opt-in. PECR takes its consent standard from UK GDPR: freely given, specific, informed and unambiguous.

Pre-ticked boxes are the classic failure. So is bundling: a single tick that covers newsletters, event invitations, partner offers and research invites is not specific consent for any of them. Separate ticks, or separate journeys, are the fix, and withdrawal has to be as easy as giving consent in the first place.

Consent must also be demonstrable. Under UK GDPR you have to be able to show who consented, when, to what wording, and through which route. A timestamped record of the exact form text is worth more than a vague note that the address came from a sign-up form.

Consent has no fixed expiry, so keep it under review. A contact who has not opened a message in years is a weak candidate for continued mailing. That is a list hygiene question as much as a legal one, and the list cleaning steps further down turn it into a routine.

Soft opt-in and the existing customer exception, line by line

Soft opt-in is the exception that lets you email people whose details you obtained in the course of a sale, or negotiations for a sale, without a fresh consent tick. It is narrower than most senders assume, and you must meet all of its requirements, not most of them.

If any requirement fails, you are relying on consent, and you need the evidence for it. A downloaded whitepaper is not a sale or negotiations for a sale. A newsletter sign-up is not either. An abandoned basket is closer to negotiations, but the refusal opportunity still has to have been offered at the point of collection.

Similarity is judged on the product, not the brand. A customer who bought home insurance from you has not thereby agreed to hear about your travel policies. A customer who bought a monthly software plan has a stronger case for hearing about an upgraded plan than about a conference you are sponsoring.

The refusal route must be real. A link buried three clicks deep, or a reply-to address nobody monitors, does not meet the standard. One click in the footer, working on every send, does. Soft opt-in ends when the person objects, and the address then belongs on a suppression list.

Choosing your lawful basis for email marketing under UK GDPR

PECR decides whether you may send. UK GDPR decides why you may process the data. Treat the lawful basis as a decision you make before the first send, not after a complaint, and write it down for each purpose.

Consent is the default for cold lists and for anything beyond a similar product to an existing customer. Legitimate interests can support some email marketing, but the assessment has to be genuine: what the interest is, why the person would expect it, and what happens if they object. Cold outreach raises further issues, covered under cold email deliverability.

Contract and legal obligation are not marketing bases. A renewal notice or a security alert may sit under contract, but a promotional insert in the same message needs its own basis. Mixing the two is a common cause of complaints.

One basis per purpose, recorded in writing, is the working rule. If you change the purpose, revisit the basis. A list that was collected for service updates does not become a marketing list because the business needs revenue.

This is also where email software data protection pays off, because the basis you choose determines what the platform is allowed to do with the data once it is inside, and who acts as controller or processor.

Withdrawal, right to erasure and suppression lists after a request

Withdrawal of consent must take effect without delay. An unsubscribe link that works is the minimum. A preference centre that lets someone keep one stream and drop another is better, because it reduces the number of people who leave entirely.

The right to erasure is a separate right. In a marketing context it usually arrives as a request to delete all personal data, not just to stop emails. Under the ICO right to erasure guidance, you must respond without undue delay and within one month, saying whether you erased the data or refused the request.

Deletion and suppression are not the same act. If you delete the record entirely, nothing stops the next import from mailing the same address again. The practical answer is a suppression list: the minimum data needed to ensure the person is never contacted, kept for that purpose alone.

A workable suppression entry holds the hashed or plain email address, the date of the request, the source of the request, and nothing else. No profile, no segments, no purchase history. That keeps the suppression list proportionate and defensible.

Erasure does not override every other duty. You may need to retain some records for tax, fraud prevention or legal claims, and you should say so in your privacy notice. What you cannot do is keep the marketing profile alive because it is convenient.

Suppression must be checked at the point of send, not just at the point of import. A campaign that reads a stale segment file will mail suppressed addresses even if the main list is clean.

List cleaning steps: provenance, engagement windows and re-permission

List cleaning starts with provenance. For every source, you need to know how the address arrived, what the person was told, and what they agreed to. Sources you cannot explain are liabilities, not assets. A tidy list also helps with why UK emails land in spam.

A worked example makes the arithmetic plain. Suppose a list of 40,000 addresses has 12,000 with no recorded source, 9,000 who have not opened in eighteen months, and 19,000 with clear consent and recent engagement. Remove the 12,000 unproven, suppress the 9,000 unengaged, and keep the 19,000. The list shrinks by more than half, and every remaining send is defensible.

Re-permission campaigns need care. They are themselves marketing messages, so the person must already be contactable on some basis, and the message must be honest about the consequence of silence. A subject line that says "confirm your subscription or we will remove you" is clear. A vague "we miss you" is not.

Deliverability improves as a side effect. Lower complaint rates and fewer bounces help your standing with mailbox providers, and tools such as Google Postmaster Tools and Microsoft SNDS give UK senders a view of how their domain is being treated. A permission ledger is the artefact that proves the cleaning was done on evidence rather than instinct.

Records, accountability and the data protection fee for UK senders

UK GDPR accountability means you can show how you comply, not merely assert it. For email marketing that means records of processing, consent evidence, legitimate interests assessments, suppression logs and a retention schedule. If the ICO asks, the answer should be a document, not a memory.

Most UK organisations that process personal data must also pay the annual data protection fee to the ICO. The tier depends on size and turnover, and paying it is separate from complying with PECR or UK GDPR. Non-payment is itself enforceable.

Accountability also covers processors. Your email platform, analytics tools and any list-cleaning vendor are processors, and you need written terms with each. A vendor due diligence request should cover where data is hosted, how long it is kept, and what happens on termination.

Breach handling belongs in the same folder. A mailing that goes to the wrong segment, or a suppression failure, is a personal data breach and may need reporting to the ICO within seventy two hours of you becoming aware. Have the route documented before it happens.

Quality checks on the release itself matter too, because a single careless export can undo months of careful list work. The discipline of checking suppression, claims and rollback before a send is what stops a clean list from being undone by a bad export.

How the Data (Use and Access) Act 2025 changes the consent picture

The Data (Use and Access) Act 2025 adjusts parts of the framework email marketers work in. It does not repeal PECR, and it does not remove the need for a lawful basis or for consent where consent is the basis. Treat it as an amendment, not a fresh start.

The ICO email guidance now describes two soft opt-ins that apply in different contexts: the products and services soft opt-in, which all organisations can use, and a charitable purposes soft opt-in, which only charities can use. Each has its own requirements, so check which one you rely on before you send.

The practical response is to keep your records in a form that can absorb change: consent wording versioned, bases labelled, suppression lists portable, and policies reviewed on a set cycle. That way a statutory change becomes an edit, not a rebuild.

Above all, remember that compliance is never just a configuration setting. The tool can enforce a rule you have written down, but it cannot decide what the rule should be, and it cannot tell you when a rule has changed. That judgement stays with the people who own the list.

Common questions

Does PECR still apply after the Data (Use and Access) Act 2025?

Yes. PECR remains the rule for electronic mail marketing, and the 2025 Act does not replace the consent bar for sending. Read PECR and UK GDPR together, and keep your consent records and lawful basis notes up to date so that any change to the rules becomes a small edit to your file.

Can I email a business address without consent?

Corporate subscribers fall outside the PECR consent rule for unsolicited email. UK GDPR still applies to the personal data of the people who work there, so keep a lawful basis and an easy objection route, and treat an address as personal if you are unsure which kind it is.

How long does consent last?

There is no fixed expiry. Keep consent under review, because long silence weakens your position. An engagement window of twelve to twenty four months is a defensible working rule, provided that you record the window you chose, apply it to every send, and re-permission contacts who fall outside it before mailing them again.

What should a suppression list contain?

The minimum needed to prevent contact: the email address, the date of the request and its source. Keep no marketing profile alongside it, and check it at the point of send, not only when you import a new list or build a segment.

Can I buy a UK email list and clean it?

No. Cleaning cannot create consent that was never given, and purchased lists fail the PECR test. Remove them and rebuild from sources you can document, with consent wording and a date recorded for every address you keep in the list.