UK Email Marketing Law

British email marketers answer to two sets of rules at once. One decides whether you may send a marketing message. The other decides how you must treat the personal data that makes the message possible. Both are enforced by the Information Commissioner’s Office (ICO), and both were reshaped by the Data (Use and Access) Act 2025, whose main data-protection provisions commenced on 5 February 2026. This guide maps the whole framework; the practical send rules are covered in our PECR explainer.

This is general information, not legal advice.

The two layers at a glance

The layers stack. Passing PECR does not excuse a UK GDPR failure, and a sound lawful basis under UK GDPR does not let you skip PECR consent.

The UK GDPR principles, applied to a mailing list

• Lawfulness, fairness and transparency. Tell people at sign-up who you are, what you will send and how often. Your privacy notice should mention email tracking.
• Purpose limitation. An address collected to send an invoice is not automatically available for promotions unless the soft opt-in conditions are met.
• Data minimisation. A newsletter form rarely needs more than an email address and a first name. Ask for a birthday only if you plan to use it.
• Accuracy and storage limitation. Remove hard bounces and review contacts who have not engaged for a long time rather than keeping them forever.
• Security. Choose processors that encrypt data in transit and restrict access. Mailpro uses TLS 1.3 and never sells or rents your data.
• Accountability. Be able to prove all of the above, which means keeping consent records and a written contract with your email provider.

Lawful basis: consent or legitimate interests?

For the data-handling side, many organisations rely on consent; others use legitimate interests, and the 2025 Act confirmed in the text of UK GDPR that direct marketing can be a legitimate interest. That does not change PECR. For email and SMS to individuals you still need consent or the soft opt-in, whatever lawful basis you choose under UK GDPR.

Rights your subscribers can use

People can ask for a copy of their data, ask for it to be corrected or erased, and object to direct marketing at any time. The objection right is absolute: once someone says stop, you stop. Mailpro’s unsubscribe management keeps opted-out contacts suppressed across future sends.

Admin duties UK senders often miss

• The data protection fee. Most organisations that process personal data must pay an annual fee to the ICO unless an exemption applies. Check the ICO’s self-assessment before you start collecting sign-ups.
• A complaints procedure. Under the 2025 Act, organisations had to have a process for handling data-protection complaints in place by 19 June 2026.
• Processor contracts. UK GDPR requires a written agreement with any provider that handles your contact data on your behalf.

Where your data lives

The UK runs its own adequacy regime for international transfers, separate from the EU’s since Brexit, and it recognises Switzerland as adequate. Mailpro hosts data on private Swiss infrastructure, outside US jurisdiction, so UK contact data is not exposed to US access laws. Our page on why Switzerland and the glossary entry on data residency explain why this matters.

Mailing Europe as well?

If your list includes people in the EU, the EU GDPR and each country’s own e-privacy law apply to them too. See our GDPR definition and how Mailpro approaches GDPR compliance.

Beyond data law

The content of your emails is covered by the CAP Code, which the Advertising Standards Authority applies to marketing emails and texts. Price claims, fake countdowns and misleading urgency, common around Black Friday, can also fall foul of consumer law under the Digital Markets, Competition and Consumers Act 2024, which the Competition and Markets Authority enforces. Next step: learn how to collect and record permission properly.