Email marketing for law firms: a UK GDPR-compliant guide

Email is the channel UK law firms are most often caught out on, and it belongs inside a wider professional services marketing plan rather than beside it. This guide sets out the two regimes that apply to solicitor newsletters, the lawful bases you can rely on, and the steps to build a sign-up that stands up to scrutiny.

What to take away

Where UK GDPR and PECR bite for solicitor newsletters

The Data Protection Act 2018 sits under the UK GDPR and governs how your client list is collected, used and deleted. Every subscriber record needs a lawful basis, a retention rule and a route to erasure.

PECR adds the marketing layer. Regulation 22 requires consent before electronic mail is sent for direct marketing to individual subscribers, and it treats sole traders and some partnerships as individuals even when the address looks corporate.

Where the recipient is a corporate subscriber, such as a limited company or an LLP, the consent rule does not apply in the same way. UK GDPR still covers the named individual, so check the ICO's Direct marketing guidance and its Guide to PECR first.

The ICO's UK GDPR guidance sets out the lawful bases and transparency duties that a newsletter list tests hardest.

Before the first send, several UK GDPR duties land at once. Your privacy notice must carry the Article 13 and Article 14 information: who the controller is, why you are processing the data, the lawful basis, who receives it, how long you keep it, and the rights available to the individual. Consent must meet the Article 7 conditions, which means a clear affirmative action, specific wording, no pre-ticked boxes and an easy way to withdraw. Every list, campaign and consent version belongs in the Article 30 record of processing, and the email platform must be appointed under written Article 28 processor terms.

Two further duties catch firms out. Most controllers must pay the ICO's annual data protection fee, so check that the firm is registered rather than assuming it is. If a list is exposed or your email platform is breached, you must notify the ICO within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk to them is high.

Individuals can ask for a copy of their data, object to marketing or request erasure, and you have one month to answer a subject access request. A marketing objection must be honoured as soon as it is made, whatever the lawful basis, and the suppression list is your evidence that it was.

The ICO enforces PECR itself and can impose monetary penalties, and the burden falls on the sender: when a complaint arrives, the firm has to show how the address was collected and what the subscriber was told. The SRA sits on top of both regimes, and the SRA Code of Conduct requires publicity about your firm to be accurate and not misleading.

Email works best alongside referrals and events, as our guide to marketing a law firm in England and Wales explains.

Comparing consent, soft opt-in and legitimate interests

Three routes cover most law firm sending. The right one depends on the recipient and how the relationship began.

The soft opt-in, in regulation 22(3) of PECR, is the workhorse. It applies where the firm collected the details during a sale or during negotiations for a sale, and it covers similar services only. Move a conveyancing client onto a commercial litigation newsletter and the basis fails.

A legitimate interests assessment is not a formality. Record why the processing is necessary and how it affects the individual, then revisit that when the list changes.

Building a compliant sign-up, step by step

Work through these steps before the first campaign goes out.

Automation that stays inside the rules

Automation does not change the lawful basis, only the speed. A welcome sequence is fine when the sign-up captured the right wording.

Build the suppression list before the first campaign. It should hold unsubscribes, hard bounces, complaints and anyone who has objected to processing.

Keep the audit trail beside the send list. If the firm cannot show which privacy notice version a subscriber agreed to, the record is weak.

Email is not the only route to the same contacts. Our comparison of LinkedIn versus networking for solicitors covers the alternatives.

Measuring a solicitor newsletter without over-collecting

Track open rates, click rates and list growth at campaign level. Individual tracking pixels collect personal data, so they belong in the privacy notice rather than in a default setting nobody reviewed.

Aggregate reporting is usually enough for a firm selling legal services. To segment by practice area, ask subscribers to state an interest rather than inferring it from behaviour.

Common questions

These are the points firms raise most often when they audit a list against the rules above.

Can we email former clients without consent?

Sometimes. The soft opt-in covers people who enquired or bought from you, provided the message promotes similar services and carries an opt-out.

Do we need consent to email other businesses?

It depends. Limited companies and LLPs are corporate subscribers, so the PECR consent rule does not apply in the same way. UK GDPR still covers the named contact.

How long can we keep newsletter subscribers?

Only as long as you need them. Set an inactivity rule, often twelve to twenty-four months, and send a re-permission email before deleting the record.

Is a bought list ever acceptable?

Rarely. The addresses were not collected by you and the consent wording is usually missing, which makes the risk hard to defend.

This article is general guidance. Individual cases need advice from a qualified data protection adviser.