UK GDPR and PECR for Newsletters: Consent Explained Simply

Cast your mind back to spring 2018. Your inbox was buried under a avalanche of “we’ve updated our privacy policy” emails, most of them from companies you’d barely heard of, all scrambling to look ready for 25 May 2018. GDPR had arrived, and every UK business suddenly cared about consent. But here’s the question we keep coming back to: if the ICO audited your newsletter list today, would your consent stand up? For a lot of UK businesses, the honest answer is no. Let’s walk through what UK GDPR and PECR actually require, in plain English, without the legal jargon.

The Two Laws That Govern Your UK Newsletter

Two separate rulebooks apply to your email marketing, and confusing them is where most compliance problems start. UK GDPR governs how you process personal data — including names, email addresses, and any behavioural data you attach to them. PECR, the Privacy and Electronic Communications Regulations, sits alongside UK GDPR and specifically covers electronic marketing, including email. The ICO enforces both, and a single newsletter campaign can breach one, the other, or both at the same time.

What UK GDPR Means for Your Mailing List

Under UK GDPR, you need a lawful basis for processing someone’s personal data. For newsletters, that basis is almost always consent — though legitimate interests can apply in narrow circumstances. You must tell people what you’re doing with their data, keep it accurate, store it securely, and honour their rights, including the right to erasure. Your mailing list is personal data, full stop, even if it only contains work email addresses.

How PECR Specifically Targets Email Marketing

PECR is narrower but stricter in one key way: it prohibits sending unsolicited direct marketing by email to individual subscribers unless they’ve consented, or unless the soft opt-in exception applies. It also requires a valid return address and a way to opt out in every message. PECR doesn’t care whether your intentions were good — if you emailed without a lawful route, you’ve broken the rules.

Where the Two Overlap (and Where They Don’t)

Consent is the meeting point. UK GDPR defines what valid consent looks like; PECR requires it for electronic marketing. Where they differ: UK GDPR applies to all personal data processing (including analytics, segmentation, and CRM storage), while PECR only bites when you actually send marketing. You can be UK GDPR-compliant in how you store data and still breach PECR by sending one careless campaign.

What Counts as Valid Consent Under UK GDPR

The ICO’s consent guidance sets out four requirements, and all four must be met. Consent must be freely given, specific, informed, and unambiguous. Miss any one of these and your consent is invalid — which means every email sent on the back of it was sent unlawfully.

Freely Given: Why ‘No’ Must Be a Real Option

People must be able to refuse without detriment. If someone can’t download your whitepaper, complete a purchase, or access a service unless they tick the newsletter box, that consent isn’t freely given. Bundling consent into terms and conditions fails the same test. The ICO has been clear that consent must be a genuine choice, not a toll gate.

Specific and Informed: Naming Your Newsletter Clearly

Consent to “receive marketing communications from us and selected partners” is not specific. Tell people exactly what they’re signing up for: “weekly email newsletter about UK tax updates” beats “marketing emails” every time. You must also name your organisation, explain how they can withdraw consent, and be transparent about any third-party tools processing their data on your behalf.

Unambiguous: The Problem With Pre-Ticked Boxes

The ICO’s direct marketing guidance states plainly that pre-ticked boxes do not constitute valid consent. Neither does silence, inactivity, or a default opt-in. Consent requires a clear, affirmative action — an unticked box the user actively ticks, or a deliberate button click. If your sign-up form has a pre-ticked newsletter box, fix it this week.

PECR’s Soft Opt-In: The Exception UK Marketers Rely On

PECR’s soft opt-in is the one exception that lets you email people without explicit consent, and it’s narrower than most marketers assume. It applies when you obtained the email address in the course of a sale or negotiations for a sale, the messages relate to similar products or services, and you offered an easy opt-out at the point of collection and in every subsequent message. Miss any of those conditions and you’re back to needing explicit consent.

When Soft Opt-In Applies to B2B and B2C Lists

Soft opt-in works for both consumer and business recipients, but only where there’s an existing customer or negotiation relationship. A one-off enquiry that went nowhere is unlikely to qualify. A completed purchase, or active negotiations, is the usual threshold. Keep records showing when and how the address was obtained — the ICO will ask.

What You Must Include in Every Soft Opt-In Email

Every message must identify you as the sender, include a valid contact address, and provide a simple, free way to opt out. That opt-out must be honoured promptly. We recommend a one-click unsubscribe link in the footer of every send, plus a clear line explaining how the recipient’s data is used.

Why Purchased Lists Are Still a Bad Idea

Buying a list and emailing it is almost always unlawful under PECR. The people on it never gave you consent, and you can’t rely on soft opt-in because there was no sale or negotiation with your business. Beyond the legal risk, purchased lists wreck your sender reputation and deliverability. The ICO has fined businesses for exactly this.

Penalties, Complaints, and the ICO’s Enforcement Record

This isn’t theoretical. The ICO fined Leave.EU and Eldon Insurance £120,000 in 2019 for unlawful marketing emails — a case that made national headlines. More recently, the ICO fined Colour Car Sales £130,000 in 2021 for sending marketing emails without consent. And individuals can complain to the ICO directly, which means a single annoyed recipient can trigger an investigation.

Maximum Fines Under UK GDPR and PECR

UK GDPR allows fines up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious breaches. PECR fines are capped at £500,000 per breach, but the ICO can issue multiple fines for multiple contraventions. Even mid-range fines of £100,000+ are enough to sink a small business.

How the ICO Investigates Newsletter Complaints

Most investigations start with a complaint from a recipient. The ICO typically asks for evidence of consent: sign-up records, timestamps, IP addresses, and the wording of your opt-in. If you can’t produce it, you’re in trouble. Our advice is to assume every send could be audited and keep evidence accordingly.

Reputation Damage Beyond the Fine

The fine is often the smallest cost. ICO rulings are published, picked up by trade press, and indexed by search engines. Being named in an enforcement notice damages trust with customers and partners far more than the financial penalty. Deliverability also suffers — mailbox providers watch enforcement actions closely.

Practical Steps to Keep Your Newsletter Compliant

Compliance isn’t complicated once you’ve built the right foundations. Here’s the shortlist we give every UK client:

• Use double opt-in so every subscriber confirms their email address
• Record consent timestamps, source, and the exact wording shown at sign-up
• Include a one-click unsubscribe in every message
• Run regular list hygiene — remove hard bounces and long-term inactive subscribers
• Document your lawful basis for every list segment

Mailchimp and Campaign Monitor both offer built-in consent tools tailored to UK users, including double opt-in toggles and consent tracking. They won’t make you compliant on their own, but they make the mechanics much easier.

Setting Up Double Opt-In Properly

Double opt-in means a new subscriber receives a confirmation email and must click a link before being added. It reduces list size slightly but dramatically improves engagement and gives you a clean consent record. Configure the confirmation email to restate what they’re signing up for.

Recording and Storing Consent Evidence

For every subscriber, store the date and time of consent, the source (which form, which page), the exact wording they agreed to, and the IP address where possible. If you change your sign-up wording, keep the old versions. The ICO expects you to prove consent, not just claim it.

Making Unsubscribe Easy and Immediate

Unsubscribe must be free, quick, and honoured without delay. Don’t force people to log in, don’t ask them to email you, and don’t make them explain why. One click, processed immediately, is the standard. Anything less risks a PECR complaint.

Common Consent Mistakes We See in UK Newsletters

The ICO publishes a direct marketing checklist, and most of the mistakes we encounter map directly to it. Here are the ones that come up again and again.

Mistaking Legitimate Interests for Consent

Legitimate interests can be a lawful basis under UK GDPR, but it doesn’t satisfy PECR’s consent requirement for electronic marketing to individuals. Marketers regularly confuse the two and end up sending cold email with no valid route. If you’re relying on legitimate interests for a newsletter, get legal advice before your next send.

Forgetting the Corporate Subscriber Test

PECR treats “corporate subscribers” (limited companies and LLPs) differently from “individual subscribers” (sole traders and partnerships). Cold email to a generic company address like info@ is less restricted than email to a named individual at the same company. Many B2B marketers assume all business email is fair game — it isn’t.

Letting Consent Go Stale Over Time

Consent doesn’t expire automatically, but the ICO expects it to be refreshed if circumstances change or a long period passes with no engagement. If someone hasn’t opened an email in three years, we recommend a re-permission campaign. No response means remove them.

FAQ

Do I need consent to email existing customers in the UK?

Not always. PECR’s soft opt-in lets you email existing customers about similar products or services if you obtained their address during a sale or negotiations and you include an easy opt-out in every message. For anything outside that scope, you need explicit consent.

Are B2B newsletters exempt from UK GDPR and PECR?

No. UK GDPR applies to any personal data, including work email addresses that identify an individual. PECR applies to email marketing to individual subscribers and treats corporate subscribers differently, but “B2B” is not a blanket exemption. Check the corporate subscriber test before assuming you’re in the clear.

What happens if someone complains to the ICO about my newsletter?

The ICO will typically contact you and ask for evidence of consent — sign-up records, timestamps, and the wording shown at the point of collection. If you can’t demonstrate valid consent, you may face an enforcement notice, a fine, or both. The ICO publishes its decisions, so reputation damage often follows.

How long can I keep someone on my mailing list?

There’s no fixed legal limit, but consent must remain valid. If a subscriber hasn’t engaged for a long period — we’d suggest two to three years — run a re-permission campaign. If they don’t respond, remove them. Stale lists hurt deliverability as well as compliance.

Is double opt-in legally required in the UK?

Not strictly. UK GDPR requires consent to be freely given, specific, informed, and unambiguous — single opt-in can meet that test if your form is clear. But double opt-in gives you stronger evidence, reduces fake sign-ups, and is the approach we recommend for any UK business serious about deliverability.

Consent isn’t a checkbox you tick once and forget. It’s an ongoing relationship — one you have to maintain, evidence, and refresh as your list and your business evolve. This week, take thirty minutes to audit your newsletter sign-up flow: check the wording, confirm double opt-in is on, and make sure your unsubscribe works in one click. That small exercise will tell you more about your compliance posture than any policy document ever will.