Nerdy Joeby Koldify

Cold Email in the UK: PECR, UK GDPR and B2B Lead Generation

Some links on this page are affiliate links. If you sign up through them, we may earn a commission at no extra cost to you. How we make money

B2B cold email into the UK is legal when you write to companies and LLPs, identify yourself, offer an easy opt-out and handle the personal data on your list under UK GDPR. The catch is that most UK businesses are sole traders or ordinary partnerships, and those need consent. Koldify runs done-for-you cold email campaigns for companies selling into the UK, and this page covers the rules and the practical playbook.

Yes, with two laws working together. The Privacy and Electronic Communications Regulations 2003 (PECR) decide whether you may send the marketing email at all.

UK GDPR and the Data Protection Act 2018 govern how you collect and use the personal data behind it. The Information Commissioner's Office (ICO) enforces both.

What follows is a plain summary of ICO guidance as of October 2026. It is not legal advice. The ICO says several of its marketing guidance pages are under review after the Data (Use and Access) Act 2025, so check for updates before a large campaign.

Corporate vs individual subscribers under PECR

PECR's consent rule for marketing email depends on who you are emailing.

Recipient PECR subscriber type Can you cold email without consent?
Limited company (Ltd, PLC) Corporate Yes, with identification and an opt-out address
Limited liability partnership (LLP) Corporate Yes, with identification and an opt-out address
Scottish partnership Corporate Yes, with identification and an opt-out address
Sole trader Individual Generally no, consent needed (or soft opt-in)
Ordinary partnership (England, Wales, Northern Ireland) Individual Generally no, consent needed (or soft opt-in)
Consumer Individual No, consent needed (or soft opt-in)

The ICO's definitions: individual subscribers are "people, sole traders, ordinary partnerships," while corporate subscribers are "organisations with their own legal personality, for example limited companies, LLPs and Scottish partnerships."

For corporate subscribers, the ICO says the consent rule does not apply, but you must not disguise your identity and must "give a valid address for business to opt-out or unsubscribe from your messages." The ICO also recommends honoring a company's opt-out even though PECR does not strictly require a corporate suppression list. We treat every opt-out as permanent.

The soft opt-in lets you email existing customers, or people who negotiated a purchase with you, about similar products, provided you offered an opt-out when you collected their details. It never covers cold prospects.

Why this matters more in the UK than you would expect

Government statistics show how many UK businesses fall on the consent side of the line. The Department for Business and Trade's Business Population Estimates 2025 count about 5.7 million private sector businesses: 3.2 million sole proprietorships (57%), 368,000 ordinary partnerships (6%) and 2.1 million companies (37%).

So roughly six in ten UK businesses are, legally, individual subscribers for email marketing. Your list needs a reliable way to tell a limited company from a sole trader, for example by checking against Companies House registration, before anyone gets a cold email.

UK GDPR still applies to B2B email

A corporate subscriber's employee is still a person. The ICO says business contact details are personal data when they identify an individual, giving the example that "the email address you are using to communicate with the business identifies an individual." A generic address like info@ is usually not personal data, but jane.smith@ is.

That brings in UK GDPR duties:

  • Lawful basis. Where PECR does not require consent, the ICO says "in many cases it is likely that legitimate interests will be the appropriate lawful basis." You need to pass the three-part test (purpose, necessity, balancing) and should write it down in a legitimate interests assessment.
  • Transparency. If you got the data from somewhere other than the person, the ICO says "the latest point at which you must provide the information is when you first communicate with the individual," and the one-month limit still applies. A short privacy line with a link in your first email handles this.
  • The right to object. An individual's right to object to direct marketing "is absolute and there are no grounds for you to refuse." Suppress them immediately and keep them suppressed.

What changed with the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on June 19, 2025. It amends PECR and UK GDPR rather than replacing them, and its provisions were phased in between June 2025 and June 2026. Points relevant to cold email:

  • B2B rules unchanged. The government considered extending PECR's consent rules to B2B email but did not implement that proposal, according to a Mayer Brown analysis of the Act.
  • Much bigger PECR fines. The ICO can now fine up to £17.5 million or 4% of global turnover for PECR breaches, up from a previous maximum of £500,000.
  • Direct marketing as a legitimate interest. The ICO says the Act "clarifies that direct marketing can be a legitimate interest," which it frames as a clarification rather than a material change. You still need the balancing test.
  • Complaints procedure. From June 19, 2026, organizations must make it easy to complain about data protection, acknowledge complaints within 30 days and respond without undue delay.
  • Charities. A new soft opt-in for charities does not affect commercial B2B senders.

Most remaining data protection provisions came into force on February 5, 2026, the ICO said in its commencement statement.

Calls and LinkedIn follow-up

If your UK sequence includes phone calls, PECR's call rules apply. The ICO advises screening B2B call lists against both the Telephone Preference Service (TPS) and the Corporate TPS, plus your own do-not-call list, because some businesses register on each.

What's different about selling into the UK

Tone and language

UK buyers tend to respond badly to hard sell, inflated claims and false familiarity. A short, polite, specific email with a modest ask usually reads better than an American-style "Let's hop on a call" opener; this is our practical experience, not a study.

Write in British English for UK prospects: organisation, optimise, programme, colour. Small things like US date formats (10/12 for December 10) confuse readers, so spell dates out.

Who you are emailing

The DBT figures show 75% of UK private sector businesses have no employees beyond their owners, and most of those are sole proprietorships. Combined with PECR, that pushes most B2B cold email toward incorporated companies with staff.

Common decision-maker titles include managing director (often the CEO equivalent at smaller firms), director, head of, and finance director. Many directors' names and appointments are public on Companies House, which also helps confirm that a business is a limited company.

Time zone and holidays

Great Britain and Northern Ireland share one time zone: GMT in winter and BST (GMT+1) from the last Sunday in March to the last Sunday in October. That makes scheduling simpler than in North America. One catch: the US changes its clocks on different dates (second Sunday in March, first Sunday in November), so the usual five-hour gap with New York narrows for a few weeks each year if you send from US time.

Bank holidays differ by nation. Scotland has 2nd January and St Andrew's Day (November 30), and its summer bank holiday falls in early August; Northern Ireland adds St Patrick's Day (March 17) and the Battle of the Boyne (July 12). Segment by nation if your list is large, and pause sends over Christmas and the substitute days that follow.

Data coverage

Apollo and similar databases include UK contacts, but we have not found independent, published accuracy figures by country. Test a sample, verify it, and watch bounce rates before scaling.

For PECR, coverage is not enough: your data also needs the company's legal form. If your database does not tell you whether a business is a limited company, LLP or sole trader, add that check before sending.

Want a second opinion? If you are unsure whether your UK list mixes sole traders with limited companies, book a 30-minute call with David at Koldify and we will look at your targeting together.

How we run cold email into the UK

The core of Koldify's process is the same in every market, with UK-specific steps added.

  1. Separate infrastructure. We own and operate our sending infrastructure and send from separate domains, never your main domain. Inboxes warm up for about three weeks, and campaigns typically launch around week four. Our cold email infrastructure guide explains the setup.
  2. Corporate subscribers only. We build the list with you around incorporated companies and LLPs, and filter out sole traders and ordinary partnerships.
  3. Legitimate interests on paper. We help you document why the outreach is relevant to each segment, so your legitimate interests assessment reflects what is actually sent.
  4. Offer and copy approved by you. You approve the list, offer and copy, written in British English, before launch.
  5. Compliance footer. Every email identifies the sender, includes a contact address, links to a privacy notice and offers a one-step opt-out that is honored permanently.
  6. Replies routed to you. Interested replies go to your team, which handles the conversation, booking and closing.

Engagements are month-to-month, with no long-term contract. The full scope is on our cold email services page, or you can book a call with David at Koldify to discuss your UK targets.

Sample cold email for a UK prospect

The copy below uses British spelling on purpose. Run your own drafts through our spam word checker before sending.

Subject: Month-end close at [Company]

Hi [First name],

I noticed [Company] has opened two new sites this year, which usually means more entities and a longer month-end close for the finance team.

We help UK mid-sized businesses cut close time by automating intercompany reconciliations. Happy to share how [similar company] approached it, if useful.

Would a short call in the next fortnight be worthwhile?

Kind regards,
[Your name]
[Title], [Your company]

[Your company] Ltd, registered in England and Wales, company no. [number]
[Registered address]
We contacted you because your role relates to [topic]. How we use your details: [privacy notice link]
To stop hearing from us, reply "unsubscribe" or click here: [opt-out link]

Send this only to corporate subscribers. For a sole trader, you would need consent first, so the email above would not be appropriate.

Proof

These figures cover Koldify's work across all markets. They are not specific to the UK.

  • 10M+ cold emails sent, 50K+ leads generated, $10M+ in pipeline and $2M+ in revenue generated for clients.
  • Vidsec: 160+ ready-to-buy leads in 2 months and $12,000+ closed.
  • Black Stone Funding Group: 120+ leads in 60 days.
  • Skrapper: 140+ interested leads.
  • Koldify's own outbound: about 500 leads from about 250,000 sends in 3 weeks.

David Tile, who takes the intro calls, is a partner at Koldify. Nerdy Joe is a certified Apollo.io Managed Services Partner and a PlusVibe Certified Silver Partner. To compare other providers, see our list of B2B lead generation companies in the UK.

DIY instead?

You can run UK cold email in-house if you build the PECR and UK GDPR checks into your process. Some tool links here are affiliate links (disclosure).

  • Data: Apollo combines contact data with email verification. As of October 2026, third-party sources list the Basic plan at $49 per user per month on annual billing, with a free plan for testing. Add a legal-form check for every UK company.
  • Sending: Smartlead starts at $39 a month on Base (6,000 sends), PlusVibe at $37 a month on Personal (25,000 emails) and Instantly at $47 a month on Growth (5,000 emails), all as of October 2026. Smartlead also offers US and EU server locations.
  • Records: Keep your legitimate interests assessment, the source of each contact and a permanent suppression list in one place.

Selling into continental Europe too? Rules there differ by country; see our cold email Europe guide.

Talk to us about the UK

UK cold email works when the list is clean, the targets are incorporated and the tone is restrained. If you want a team to handle infrastructure, list filtering and copy while your people take the conversations, book an intro call with David at Koldify.

Other markets we cover

How to set up a cold email campaign: the tools you'll need

Some tool links here are affiliate links (disclosure). Prices are as of October 2026.

  1. Get your data (who you'll email). Build your list in Apollo by title, industry, company size and location, then export contacts with verified emails. Nerdy Joe is a certified Apollo Managed Services Partner.
  2. Buy 2 to 3 sending domains. Never send cold email from your main domain. Use lookalikes (for example, getyourbrand.com). The simplest route is buying them inside your sending tool: Instantly sells done-for-you domains (about $15 a year), Smartlead sells them through SmartSenders, and PlusVibe offers a done-for-you setup. Before you buy, check whether domains bought in a tool can be moved out later; some Instantly users report they can't.
  3. Create 2 to 3 inboxes per domain. Google Workspace or Microsoft 365 inboxes, not one big inbox. Instantly sells done-for-you Google inboxes (about $5 a month, or $10 pre-warmed), Smartlead sells pre-warmed Google and Outlook inboxes (about $9 a month), and PlusVibe can set them up for you. Done-for-you setups configure SPF, DKIM and DMARC for you.
  4. Warm up for about 3 weeks. Warmup is built into Instantly, Smartlead and PlusVibe. Keep it running after launch.
  5. Write and check your sequence. Three to five short emails. Run each one through our free Spam Word Checker.
  6. Launch slowly. Start at about 20 to 30 emails per inbox per day in Instantly, Smartlead or PlusVibe, and watch bounces and replies. Use our Cold Email Cost Calculator to size domains, inboxes and spend.

Rather not run it yourself? Koldify, the done-for-you cold email agency where David Tile is a partner, builds and runs all of this on infrastructure it owns. Book a 30-minute call with David.

Sources

  • ICO, Business-to-business marketing: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/
  • ICO, Key concepts for direct marketing using electronic mail: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/key-concepts-for-direct-marketing-using-electronic-mail/
  • ICO, Electronic mail marketing (Guide to PECR): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/
  • ICO, When should we provide privacy information?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/when-should-we-provide-privacy-information/
  • ICO, The Data (Use and Access) Act 2025: what does it mean for organisations?: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/
  • ICO, Statement on the commencement of the Data (Use and Access) Act (February 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa
  • Mayer Brown, The Data (Use and Access) Act: PECR reform (July 2025): https://www.mayerbrown.com/en/insights/publications/2025/06/the-data-use-and-access-act-pecr-reform-rules-relating-to-electronic-marketing-and-cookies-in-the-uk
  • Department for Business and Trade, Business population estimates for the UK and regions 2025: https://www.gov.uk/government/statistics/business-population-estimates-2025/business-population-estimates-for-the-uk-and-regions-2025-statistical-release
  • Companies House, Find and update company information: https://find-and-update.company-information.service.gov.uk/
  • US Department of Transportation, Daylight Saving Time: https://www.transportation.gov/regulations/daylight-saving-time
  • GOV.UK, UK bank holidays: https://www.gov.uk/bank-holidays
  • GOV.UK, When do the clocks change?: https://www.gov.uk/when-do-the-clocks-change
  • Koldify, results and client case studies: https://koldify.io
  • Apollo pricing, as reported by Saleshandy (Sept 2026) and Valley (Oct 2026): https://www.saleshandy.com/blog/apolloio-pricing/ and https://www.joinvalley.co/blog/apollo-pricing-and-credits-explained-2026
  • Instantly, Plans overview: https://help.instantly.ai/en/articles/10273259-instantly-plans-overview
  • Smartlead, Pricing: https://www.smartlead.ai/pricing
  • PlusVibe, Pricing: https://plusvibe.ai/pricing

Frequently asked questions

Is cold email legal in the UK?

Yes, for emails to corporate subscribers such as limited companies, LLPs and Scottish partnerships, as long as you identify yourself, give a valid opt-out address and comply with UK GDPR. Cold email to individual subscribers, which includes sole traders and ordinary partnerships, generally needs prior consent under PECR.

Can I cold email a sole trader in the UK?

Generally not without consent. The ICO treats sole traders and ordinary partnerships as individual subscribers, so the PECR consent rule for marketing emails applies to them just as it does to consumers, unless the soft opt-in applies.

Does UK GDPR apply to B2B cold email?

Yes, whenever the email address identifies a person, such as firstname.lastname@company.co.uk. You need a lawful basis, usually legitimate interests, must give privacy information by your first email at the latest, and must stop immediately if the person objects to direct marketing.

What did the Data (Use and Access) Act 2025 change for cold email?

It did not change the B2B rule for corporate subscribers. It raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover, confirmed that direct marketing can be a legitimate interest and added a duty to handle data protection complaints from June 19, 2026.

Do I need to check the TPS before sending B2B cold emails?

No. The TPS and CTPS registers apply to live marketing calls, not email. If you add phone follow-up to a UK campaign, the ICO advises screening against both registers.

Who regulates cold email in the UK?

The Information Commissioner's Office (ICO) enforces both PECR, which covers electronic marketing messages, and UK GDPR, which covers the personal data on your list.