Can I add customers to my email list?

Regulation 22 of PECR says you must not send unsolicited marketing emails or texts to individuals unless they have told you they consent, or the soft opt-in applies. "Individuals" includes sole traders and some partnerships, not just consumers.

Consent must meet the UK GDPR standard: freely given, specific, informed and given by a clear positive action, such as ticking an unticked box. Pre-ticked boxes, silence and consent buried in your terms don't count. The request should make clear that the marketing will come from you and by which channel, such as email or text. Keep records of who consented, when and how, so you can prove it later.

Marketing includes newsletters, offers and promotions. Purely service messages, like order confirmations and delivery updates, aren't marketing, as long as they don't slip in promotional content.

You can email someone without express consent if all three of these apply:

• you got their details in the course of a sale, or negotiations for a sale, of your product or service to them
• you're marketing your own similar products or services
• you gave them a simple, free way to refuse when you collected their details, and you give one in every message

So a customer who bought from your online shop, and didn't opt out at checkout, can usually receive offers on similar products. Someone who only entered a competition, or whose details came from someone else, can't.

Since 5 February 2026, the Data (Use and Access) Act 2025 has given charities their own version of the soft opt-in for supporters. It doesn't change the rule for businesses.

The consent rule doesn't apply to "corporate subscribers": limited companies, limited liability partnerships, Scottish partnerships and government bodies. You can send them marketing without consent, but you must say who you are and give a valid address for opting out (regulation 23 of PECR).

Sole traders and other partnerships count as individuals, so the consent or soft opt-in rules apply to them.

A named work address, like jane.smith@company.co.uk, is still personal data. The UK GDPR applies, so you need a lawful basis (often legitimate interests), must tell the person how you use their data and must stop if they object.

Every marketing email must make clear who it's from and include a working way to opt out, such as an unsubscribe link or a reply address.

People have an absolute right to object to direct marketing under Article 21 of the UK GDPR. When someone opts out, stop promptly and keep their address on a suppression list so they aren't added back by mistake, for example when you import a new list.

The Data (Use and Access) Act 2025 was brought into force in stages between June 2025 and June 2026. For email marketing:

• since 5 February 2026, fines for breaching PECR can reach the UK GDPR maximum: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher
• charities can use their own soft opt-in, as above
• on 30 September 2026, the Information Commission took over from the Information Commissioner's Office (ICO) as the regulator, with the same powers

The core consent and soft opt-in rules for businesses haven't changed. PECR applies across the UK.