Email marketing in the UK is governed by the UK GDPR (the UK's post-Brexit implementation of the EU's General Data Protection Regulation), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The UK GDPR and DPA 2018 govern the data, such as email addresses or first names, which you use for email marketing, while PECR defines the permissions needed to send email marketing communications.
All three were significantly amended by the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025. Its key changes for email marketers took effect on 5 February 2026: PECR fines were raised from 500,000 GBP to UK GDPR levels, and a new soft opt-in for charities was introduced.
You must not disguise or conceal your identity, and every email must include a valid contact address the recipient can use to opt out. (Companies must separately include a geographic address in commercial emails under the E-Commerce Regulations 2002.) If you are sending a promotion, the E-Commerce Regulations also require you to make it clear that it is a promotion and what the conditions attached are.
In short, you must not send electronic mail marketing to individuals, unless
- they have specifically consented to receive email from you, or
- they are an existing customer who bought (or negotiated to buy) a similar product or service from you in the past, and you gave them a simple way to opt out both when you first collected their details and in every message you have sent. This is called 'soft opt-in'.
There is no fixed statutory window for processing an unsubscribe – the ICO's guidance says you must act promptly and stop sending marketing once someone opts out.
The commercial soft opt-in rule means you may be able to email your own customers, but it does not apply to prospective customers or new contacts (e.g. from bought-in lists).
Since 5 February 2026, charities benefit from their own soft opt-in: they may email supporters without prior consent where the sole purpose is furthering the charity's charitable purposes, the contact details were collected when the recipient expressed interest in or offered support for those purposes, and an opt-out was offered at collection and in every message.
The maximum fine under both the UK GDPR and PECR is up to 17.5 million GBP, or 4% annual global turnover – whichever is higher. (PECR fines were previously capped at 500,000 GBP; the higher maximum applies to conduct after 5 February 2026.)