UK GDPR & PECR rules for bulk email

What applies: UK GDPR vs PECR

Two sets of rules govern bulk email in the UK:

• UK GDPR (General Data Protection Regulation): Covers how you collect, store, and process personal data (names, email addresses, job titles).
• PECR (Privacy and Electronic Communications Regulations): Covers the sending of electronic marketing, including unsolicited emails. PECR sits alongside UK GDPR and adds specific rules for marketing messages.

Both apply when you send bulk emails. PECR's rules are stricter for B2C (business-to-consumer) emails than B2B (business-to-business).

B2B vs B2C: the key difference

B2C (emailing individual consumers)

If you're emailing personal email addresses (Gmail, Outlook, Yahoo, etc.) for marketing purposes, you must have prior consent from each recipient. "Soft opt-in" applies only if:

• You obtained the email address during a sale or negotiation of a sale,
• You're marketing similar products or services, and
• You gave the person a clear chance to opt out when you collected the email and in every subsequent message.

Example: A charity emailing individuals who donated last year can use soft opt-in. A recruiter cold-emailing personal Gmail addresses cannot.

B2B (emailing corporate email addresses)

PECR's consent requirement does not apply to emails sent to corporate email addresses (e.g., name@company.com, info@company.co.uk). However:

• You still need a lawful basis under UK GDPR (usually "legitimate interests").
• You must identify yourself and provide an unsubscribe option in every email.
• You cannot email sole traders or partnerships at personal addresses without consent (they count as individuals under PECR).

Example: A freelance designer cold-emailing marketing@agency.co.uk is B2B and does not need prior consent. The same email to a sole trader's personal Gmail requires consent.

Consent vs legitimate interest

Consent

Consent must be:

• Freely given: Not coerced or bundled with unrelated terms.
• Specific: Clear what the person is consenting to.
• Informed: You tell them who you are, what you'll send, and how to withdraw consent.
• Unambiguous: An affirmative action (ticking a box, clicking "Yes"). Pre-ticked boxes and silence do not count.

You must keep a record of when and how consent was given. The recipient can withdraw consent at any time.

Legitimate interests (B2B cold email)

For B2B emails to corporate addresses, you can rely on "legitimate interests" as your lawful basis under UK GDPR. This means:

• You have a legitimate business reason to contact them (e.g., offering a relevant service).
• The email is not intrusive, excessive, or unexpected given the recipient's role.
• You've done a legitimate interests assessment (LIA) documenting your reasoning.

Even under legitimate interests, you must provide an unsubscribe option and honour opt-out requests immediately.

Unsubscribe requirements

Every marketing email must include:

• Your identity: Your name or trading name, and a valid contact address (postal or email).
• A clear unsubscribe option: A link, email address, or reply instruction that allows the recipient to opt out easily.

When someone opts out, you must:

• Stop sending marketing emails to that address immediately (within one working day at most).
• Keep a record of the opt-out (a "suppression list") to avoid re-adding them.
• Not charge the recipient or require them to log in to unsubscribe.

Data retention and storage

Under UK GDPR, you must:

• Only keep personal data for as long as necessary for the purpose you collected it.
• Store data securely (use encrypted connections, strong passwords, access controls).
• Delete or anonymise data when it's no longer needed.
• If you use a mail merge tool or CRM, check where data is stored (UK, EU, or elsewhere) and ensure adequate safeguards if it's transferred outside the UK.

MailMerge context: When you use a mail merge tool, the tool processes your contact data. Check the tool's privacy policy to understand where data is stored and for how long.

Compliance checklist for Gmail mail merge

Before sending a mail merge campaign, confirm:

• Lawful basis: You have consent (B2C) or legitimate interests (B2B) documented.
• B2B or B2C: You know which applies. Personal email addresses usually require consent.
• Unsubscribe link: Every email includes a clear opt-out method.
• Sender identity: Your name and contact details are visible in the email.
• Suppression list: People who opted out are excluded from your contact list.
• Data security: Contact data is stored securely and deleted when no longer needed.
• Honest subject line: The subject accurately describes the email content (no misleading headers).

Where to learn more

• ICO Direct Marketing Guidance (official UK regulator guidance)
• ICO UK GDPR Guidance
• PECR 2003 (legislation.gov.uk)

Related guides

• What is mail merge?
• How to do a mail merge in Gmail
• Mail merge from Google Sheets to Gmail
• Gmail sending limits explained