Rules and ethics
UK GDPR and ICO enforcement for professional services lead generation
Professional services marketing faces UK GDPR and PECR duties: lawful basis, consent, cookies and ICO enforcement for B2B email and lead generation.
What to take away
- PECR does not require consent for marketing email to corporate subscribers such as limited companies, but UK GDPR still demands a lawful basis and an opt-out.
- Sole traders and ordinary partnerships are individual subscribers, so consent or the soft opt-in is needed.
- The PECR penalty ceiling has been £500,000 in England and Wales; the Data (Use and Access) Act 2025 raises it to the UK GDPR level once commenced.
- Analytics and tracking cookies need consent before they load, and refusing must be as easy as accepting.
- Buy a list and the compliance risk sits with you, not the broker.
Consent for B2B email turns on the recipient's status
For a limited company, PECR does not require prior consent for marketing email. For a sole trader or an ordinary partnership, it does. Both still need a lawful basis under UK GDPR.
The ICO's guidance on business-to-business marketing sets out the distinction. Email an individual subscriber without consent and you have broken PECR, however well meaning the campaign.
Before you build a list, define a target audience so companies, sole traders and partnerships are separated from the first draft.
PECR email rules by recipient
Is the recipient a corporate subscriber?
Consent not required, but UK GDPR applies
Consent required, unless soft opt-in applies
Corporate subscribers are companies and comparable bodies. Email them and PECR's consent rule does not apply, but UK GDPR does.
Sole traders and ordinary partnerships are individual subscribers, so reach them only with consent or under the soft opt-in. That opt-in covers contacts whose details you collected during a sale or negotiations, for similar services, with an opt-out offered then and in every message.
Lawful basis for cold outreach: legitimate interests or consent
Legitimate interests is the usual basis for cold outreach to corporate subscribers. It is not automatic. You must run a balancing test and record it.
The ICO's Guide to the UK GDPR requires a three-part assessment: purpose, necessity and balance.
Relevance matters: a message about audit services to a finance director is easier to justify than the same message to a junior administrator.
Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes and silence do not count, and you must be able to show when and how consent was collected.
Cookies, analytics and the storage and access rules
PECR's storage and access rules require consent before anything is stored on, or read from, a user's device. Only strictly necessary cookies are exempt.
| Cookie type | Consent needed | Example |
|---|---|---|
| Strictly necessary | No | Basket contents, security token |
| Analytics | Yes | Google Analytics |
| Advertising and pixels | Yes | LinkedIn Insight Tag |
Chat widgets, heatmaps and third-party analytics all set cookies, so assume consent is needed before they load. Make refusing as easy as accepting, then review your marketing data protection before your first campaign send.
PECR and UK GDPR fines: what the ICO can impose
The ICO can issue reprimands, enforcement notices and monetary penalties. The PECR maximum for England and Wales has been £500,000.
| Regime | Maximum penalty |
|---|---|
| PECR, England and Wales, before the DUAA | £500,000 |
| UK GDPR | £17.5 million or 4% of global annual turnover, whichever is higher |
| PECR once the DUAA change commences | UK GDPR level |
The largest penalty under the old ceiling was the £500,000 fine the ICO issued to Facebook in October 2018.
New PECR fine maximum
£17.5m or 4% of turnover
The Data (Use and Access) Act allows ICO to fine up to UK GDPR maximum for PECR breaches
Previously, PECR fines were capped at £500,000
Enforcement reaches professional-services firms as well. The ICO fined Tuckers Solicitors LLP £98,000 in 2020 after a ransomware attack exposed client files. Direct marketing cases have brought fines for emailing without valid consent and for ignoring opt-outs.
Example: a list that would fail an ICO assessment
A firm buys 5,000 contacts at limited companies (illustrative figure). PECR permits the emails without consent. The firm has no record of where the data came from, no legitimate interests assessment and no opt-out in the first message.
The ICO expects provenance checks on any bought list, so that combination is where enforcement bites. Work through these steps before launch.
- Confirm the legal status of each recipientcompany or individual subscriber.
- Record your lawful basis and, for legitimate interests, the balancing test.
- Check the source of purchased data and the consent behind it.
- Put a working opt-out in every message and honour it promptly.
- Keep a suppression list and a record of processing activities.
Firms sending partner-led newsletters should read email marketing for law firms for client-list handling.
What the Data (Use and Access) Act changes
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It lifts the PECR penalty ceiling to the UK GDPR maximum once the relevant provision is commenced.
It also creates a narrow exception to cookie consent for low-risk purposes such as analytics and security. The detail will arrive in secondary legislation, so keep consenting for analytics until the ICO confirms otherwise.
The Act leaves the fundamentals intact. Email marketing to individuals still needs consent or the soft opt-in, and opt-outs must still be honoured.
Common questions
Do I need consent to email a limited company?
No. PECR's consent rule covers individual subscribers, not corporate subscribers such as limited companies. You still need a UK GDPR lawful basis, a privacy notice and a working opt-out.
Can I rely on legitimate interests for cold B2B email?
Yes, if the message is relevant to the recipient's role and you have completed and recorded a balancing test. Stop contacting anyone who objects or unsubscribes.
How much can the ICO fine for a PECR breach?
Up to £500,000 in England and Wales at present. The Data (Use and Access) Act 2025 will raise that to £17.5 million or 4% of global turnover once commenced.
Do analytics cookies need consent?
Yes. Analytics, advertising and tracking pixels are not strictly necessary, so they must not load until the user agrees. Only cookies needed to deliver a service the user requested are exempt.
