Is cold email legal in the UK?

The lawful basis for B2B outreach

UK GDPR requires a lawful basis for processing personal data. For business to business outreach, that basis is normally legitimate interest.

Relying on it is not automatic. You must be able to show the contact is relevant to the recipient's professional role, that the intrusion is proportionate, and that you have balanced your interest against theirs. That assessment should be recorded, not assumed.

What PECR adds

The Privacy and Electronic Communications Regulations govern electronic marketing specifically. PECR permits direct marketing to corporate subscribers, meaning limited companies and public bodies, without prior consent.

Sole traders and individual partnerships are treated more like individuals, so stricter consent or soft opt in rules apply. This distinction catches people out regularly.

What every message must include

Regardless of basis, each message needs accurate sender identification, a subject line that reflects the content, a working opt out, and a valid postal address. Hiding who you are, or making unsubscribing difficult, moves you from lawful outreach to a breach.

What is not permitted

Some things are clearly outside the rules regardless of how the campaign is framed.

• Contacting people who have already opted out.
• Using data obtained from a breach or from scraping private areas of a platform.
• Disguising the sender or using misleading reply addresses.
• Continuing to send after complaints without changing anything.
• Treating consumers as though they were business contacts.

How Leadhaus operates

Every campaign runs under a recorded legitimate interest assessment. Contacts come from public and legitimate sources, unsubscribes are honoured globally across all client accounts, and a full audit trail is available in your dashboard.

Our Anti Spam Policy sets this out in full, including how to make a complaint.