Email marketing and consent for a small business

Email marketing is the thing the regulator fines small businesses for most often, because the rule is older than most of the businesses breaking it and because the email platforms make sending to a list so much easier than checking where the list came from. The rule is consent before the first email unless the recipient is an existing customer who was offered the chance to refuse, an unsubscribe in every message, a suppression list for the people who say no, and a different rule for named individuals at companies. I draft the privacy notice and the cookie notice for the business, with guidance on the consent mechanism, for a fixed fee of £595, delivered in five working days.

Who this is for

Small businesses in England and Wales sending newsletters, offers or follow-ups by email, whether to a few hundred customers or a list built over years from every address the business has ever collected.

What matters in email marketing and consent

The rule and who it protects

The soft opt-in apart, regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent for electronic marketing to individuals, where 'individual' means a living person (including a sole trader or a partner in an ordinary partnership) and 'electronic mail' includes email, text and the messages sent through messaging apps; the rule is enforced by the Information Commissioner against the sender without the recipient needing to show any harm, which is why the fines list is full of small businesses that bought a list or emailed everyone in the accounts system, and the privacy notice drafted for the business states the basis the business relies on for each kind of recipient.

Consent that would stand up and the records that prove it

Consent must meet the UK GDPR standard: a clear affirmative action (an unticked box the person ticks, a separate sign-up, a reply saying yes), specific to marketing by email from this business, informed by a link to the notice, freely given (not a condition of buying), and recorded with the date, the source and the wording the person saw, which the email platform usually captures; a pre-ticked box, a line in the terms and conditions, a business card handed over at an event or an address found online is not consent, and the business should be able to produce the record for every address on the list, because the regulator's first request is for the consent evidence for a sample of recipients.

The soft opt-in and the customers a business may email without asking

The soft opt-in in regulation 22(3) lets a business email a person whose details it obtained in the course of a sale or negotiations for a sale, about its own similar products or services, where the person was given a clear way to refuse at the time the details were collected and in every message since; the four conditions are cumulative, so a customer who bought online and saw an unticked marketing box at checkout is within it, an enquirer who never bought may be within it (negotiations), and a customer whose details came from a trade show or a referral is not; the sign-up wording drafted with the pack implements the soft opt-in at the points where the business collects details, and the Data (Use and Access) Act 2025 extends it to charities on commencement.

Business contacts and the different rule for companies

Marketing to a named individual at a corporate subscriber (a limited company, a limited liability partnership, a public body) is outside regulation 22, so that the business may rely on legitimate interests under Article 6(1)(f) of the UK GDPR with an opt-out, provided the marketing is relevant to the person's role, the business has told them (under Article 14 where the details came from elsewhere), the opt-out is honoured and the Telephone Preference Service is screened for calls under regulation 21; a sole trader's business address is an individual's address and needs consent or the soft opt-in, and a list that mixes companies with sole traders needs to be sorted before the send.

The unsubscribe, the suppression list and the complaint

Every marketing email must identify the sender, give a valid address for opting out and contain a working unsubscribe, the unsubscribe must take effect promptly and without conditions (no login, no reason, no 'allow ten days'), and the business must keep a suppression list of the people who have unsubscribed or objected so that they are not re-added when the next list is imported, which is the commonest cause of the complaints the regulator receives; a person who objects to marketing under Article 21 of the UK GDPR must be honoured without argument, and the business's response to a complaint (an apology, confirmation of suppression, no further messages) is usually the end of it, where a defensive reply is the start of a regulatory enquiry.

The platform, the tracking and the fines the 2025 Act raised

The email platform is a processor under Article 28 of the UK GDPR with terms the business has accepted (often hosted abroad under the safeguards Article 46 requires), it records opens and clicks through pixels and tracked links that the regulator treats as similar technologies needing consent under regulation 6 of the Regulations, and the business should either obtain consent to tracking at sign-up or turn open tracking off; the Data (Use and Access) Act 2025 raises the maximum fine under the Regulations to the UK GDPR level on commencement, which turns a rule many small businesses treated as a nuisance into one with the same exposure as a data breach, and the privacy notice, the sign-up wording and the consent guidance drafted for the business are the evidence that it took the rule seriously; the notice can record the business's registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Can we email everyone in our accounts system?

Only those within the soft opt-in (their details came from a sale or negotiations, you market similar products, and they could refuse at the time and in every message since) or who consented. Everyone else needs consent first. The sign-up wording and the notice implement the basis for each.

We bought a list from a broker. Can we use it?

Only if the broker obtained consent that named your business or the category you fall in, which is rare, and you tell the recipients where their data came from. Most purchased lists cannot lawfully be emailed, and the regulator's fines say so.

Does the rule apply to emails to other businesses?

Named individuals at companies can be emailed on legitimate interests with an opt-out and relevance to their role. Sole traders and partners are individuals and need consent or the soft opt-in. Sort the list before sending.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a newsletter
• SMS and WhatsApp marketing terms

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.