Email marketing compliance for UK startups: a practical guide to PECR

What PECR covers and why it matters to startups

When you send marketing emails or texts to promote your startup, two pieces of legislation apply in the UK: the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). The ICO enforces both. PECR sits on top of the UK GDPR and sets specific rules for electronic direct marketing. Most fines for small businesses come from breaking PECR, not from broader data protection failings, so it is worth getting the basics right early.

PECR applies to any unsolicited direct marketing sent by email, SMS, or automated calling. It does not cover B2B telemarketing in the same way, and it does not cover marketing by post, but for email and text it is the law you need to follow.

B2C marketing: opt-in consent is the default

If you are emailing individual consumers (B2C), you must have their prior consent. That means a clear, affirmative action, such as ticking an unticked box or clicking a button that says “yes, send me offers”. Pre-ticked boxes, silence, or simply including an email address in a purchase are not valid consent.

Consent must be specific and informed. Your signup form should name your company, explain what types of messages you will send, and mention how often they can expect to hear from you. If you want to share their details with third parties for their marketing, you need separate, granular consent for that, plainly explained.

The wording matters. A line like “by signing up you agree to receive our newsletter” above a link to a dense privacy policy is unlikely to be enough on its own. Instead, use a sentence next to the checkbox: “Tick here to receive our weekly product tips and offers. You can unsubscribe at any time.”

B2B marketing: the rules are lighter, but still tight

When you email corporate bodies (such as limited companies or LLPs), PECR allows you to send marketing emails without prior consent. The condition is that the content must relate to the recipient’s business role and you must always offer an easy way to opt out.

But there is a catch. Sole traders and some partnerships count as individuals under PECR, so B2C rules apply to them. Before you import a contact list, check whether those contacts are actually individuals in a business capacity or just sole traders. If you are unsure, err on the side of getting consent.

And remember, you still need to comply with the UK GDPR when processing business contacts’ personal data. That means having a lawful basis, usually “legitimate interests” for B2B marketing, but you must document your legitimate interest assessment and make sure your privacy notice covers it.

The soft opt-in exception for past customers

PECR provides a narrow exception called the “soft opt-in”. You can send marketing emails about your own similar products or services to a person whose details you collected during a sale or negotiation, as long as you gave them a clear chance to opt out at the time of collection and you continue to offer an opt-out in every subsequent message.

This is not a blanket licence. It only covers your own products and services that are similar to the original purchase. It does not allow you to send third-party offers or unrelated content. You also need to have genuinely collected the email address in the context of a sale or serious negotiation, not from a purchased list or a business card handed out at a networking event.

If you rely on the soft opt-in, keep a record of the original transaction and the opt-out opportunity you offered at that time. Without that record, the ICO may assume you sent unsolicited marketing.

The essential paperwork: consent records and policy updates

Your document hub should keep evidence of how consent was obtained and when. That means storing a timestamped record of the consent action for each subscriber. StartupDocs’ consent log template can help you track the date, source, and wording shown to the person at the point of signup. This record is crucial if someone complains or the ICO asks questions.

Your privacy notice must explain clearly that you may send marketing emails, what the lawful basis is (consent for B2C, legitimate interests for B2B where applicable), and that people can withdraw consent or object at any time. If you use the soft opt-in, mention that too. A generic privacy statement that just says “we use your data for marketing” is not specific enough.

You also need a documented process for handling opt-out requests. PECR demands that every marketing email includes an unsubscribe link. The link must be simple, free, and responsive. You must honour an opt-out promptly, normally within 28 days, but best practice is to act within 48 hours. Keep a record of opt-outs so you do not accidentally email those contacts again.

Practical steps to get your startup’s email marketing paperwork in order

• Review your signup forms. Make sure consent checkboxes are unticked by default, use clear language, and record the exact wording shown to the subscriber.
• Create a consent log. For every subscriber who opted in, note the date, source (e.g. website form, event signup), and the consent statement they agreed to. Digital records with time stamps are ideal.
• Check your existing lists. Segment B2C, B2B, and sole traders. If you cannot prove consent for B2C contacts, do not email them; instead, run a re-consent campaign that meets PECR standards.
• Update your privacy notice. Add a section dedicated to electronic marketing, stating the legal basis and how to opt out. Link to it from every marketing email footer.
• Test your unsubscribe process. Send a test email to yourself and click the link. Make sure it works immediately and that your internal process removes the address.
• Train your team. Anyone composing marketing emails needs to know the difference between B2C and B2B rules and to never use bought lists without proper vetting.

When to check with a solicitor

PECR looks simple on the surface, but the details can trip you up. If you are unsure whether your current list meets the soft-opt-in conditions or if you plan to launch a complex multi-channel campaign, sit down with a data protection specialist. Getting it wrong can lead to ICO enforcement and damage your startup’s reputation just when you can least afford it.

Keeping your email marketing paperwork in the same compliant document hub as your other startup documents makes it easier to review and prove your approach if anyone asks. It also means you are not scrambling to find consent evidence months after a campaign has run.