UK GDPR and PECR for B2B outreach: cold email, LinkedIn and EU data transfers

What to take away

Which law covers which part of an outreach campaign?

Cold outreach touches two regimes at once. The Privacy and Electronic Communications Regulations (PECR) restrict unsolicited marketing by phone, email, text and other electronic messages, and the rules are generally stricter for individuals than for companies. UK GDPR applies whenever you process personal data, which includes a business contact's name or an email address that identifies a person.

The Information Commissioner's Office (ICO) says generic addresses such as info@ or "the IT department" are not personal data. A work address like firstname.surname@company.co.uk is. That distinction matters because UK GDPR duties (a lawful basis, privacy information, honouring objections) attach to the second kind even when PECR lets you send the message.

For the wider picture of how these duties fit a campaign, see our guide to demand generation data protection and the overview of UK rules in England.

Can you cold email a business contact without consent?

It depends on who the recipient is, not on how professional the address looks. PECR separates two kinds of subscriber.

Corporate subscribers are bodies with a separate legal status, such as companies, limited liability partnerships and Scottish partnerships. An employee's work email counts as a corporate subscriber. PECR's consent rule does not apply, so you can email or text them without prior consent. You still must not disguise your identity, and you must give a valid address for opting out. The ICO also says you should honour opt-outs from corporate subscribers and keep a do-not-email list, even though PECR does not spell that out.

Individual subscribers include sole traders and some partnerships, such as English, Welsh and Northern Irish partnerships that are not LLPs. The ICO's advice is that if you are unsure which type a business is, treat it as an individual subscriber. For these recipients you need specific consent or the soft opt-in.

The soft opt-in is narrow. The details must have been obtained during a sale or negotiation for a sale, you may market only similar products or services, an opt-out must have been offered when the details were collected, and every message must offer an opt-out again. The ICO states that the exception does not cover prospective customers or bought-in lists. A cold prospect therefore never qualifies.

Valid consent, where you need it, must be freely given, clear and specific, and name your organisation and the type of communication. Pre-ticked boxes do not count, and you should keep a record of what was agreed, when and how.

Does LinkedIn outreach count as electronic mail?

Yes, in the way that matters. The ICO's electronic mail guidance describes electronic mail broadly as any text, voice, sound or image message sent over a public electronic communications network, and it names direct messages via social media among the covered forms. Marketing sent through social media direct messaging falls under the same rules as email and text.

In practice this means the corporate and individual subscriber test applies to a connection request note or an InMail that promotes your service. The ICO also says that using a professional networking site in a personal capacity is not B2B marketing, so a genuine personal exchange differs from a sales sequence.

Treat a profile being public as irrelevant to permission. The ICO states that being public does not mean someone agreed to marketing, and personal data taken from public sources remains subject to UK GDPR. If a tool scrapes profiles into a database, the same lawful basis and privacy information duties apply as for any other source.

What does UK GDPR add for named contacts?

Even where PECR allows the message, you need a lawful basis for holding and using the contact's data. The ICO points to consent or legitimate interests as the usual routes, and you must give privacy information when you collect the data. If you obtained it from somewhere else, such as a list provider, you must tell people their data was obtained for marketing.

Individuals have an absolute right to stop their data being used for direct marketing. Keep objectors on a suppression list instead of deleting their details, so you can screen future lists against it. The same list should be checked against the Telephone Preference Service (TPS) and Corporate TPS (CTPS) before any calling.

If you buy or rent lists, or rely on bought signals, apply the checks in our piece on intent data for UK B2B demand generation. A feed that names individuals is personal data, and holding a record does not give you permission to message.

Who is responsible when an agency or tool sends the messages?

You are. The ICO says you are treated as "instigating" the messages even when a contractor sends them, and enforcement would usually be taken against you. A specialist subcontractor might also face action if it deliberately or persistently ignored the rules. The ICO recommends a written contract that sets out the contractor's responsibilities and notes that an indemnity does not replace proper checks on the contractor.

When a vendor supplies consent records for an inherited list, check that the consent specifically names your organisation. The ICO says generic consent obtained indirectly from a third party is not enough.

What changed with the Data (Use and Access) Act?

The Data (Use and Access) Act 2025 amends PECR. According to the ICO, the Data Protection Act definition of direct marketing is now written into PECR: communication, by whatever means, of advertising or marketing material directed to particular individuals. It also creates a soft opt-in for charities, and it allows the PECR enforcement regime to be aligned with the UK GDPR penalty regime. The ICO's summary pages do not give the new penalty amounts, and the ICO describes its electronic mail marketing guidance as under review, so check the ICO's current guidance before you rely on older figures.

How do EU data transfers work after Brexit?

Two separate questions arise: receiving data from the EEA and sending UK-held data to it.

Receiving is straightforward. The European Commission renewed the UK's adequacy decisions on 19 December 2025, and the ICO says both last until 27 December 2031. The GDPR decision is a full adequacy finding, so EEA organisations can send personal information to the UK without appropriate safeguards. The ICO still advises mapping your data flows so you know which regime applies to each one. The EU GDPR may apply to you directly if you operate in the EEA, offer goods or services there, or monitor people there, and if you target EEA individuals without an EEA base you generally need an EEA representative.

Sending is governed by UK rules. A transfer is restricted when UK GDPR applies to your processing, you initiate the transfer to an organisation outside the UK (including making data accessible by remote access), and the receiver is a separate legal entity. Group companies count as separate entities. The ICO's adequacy regulations list all EEA countries as having full adequacy, so no transfer risk assessment or extra safeguard is needed for a restricted transfer to the EEA. For a destination without adequacy, you would need an appropriate safeguard such as the UK addendum to EU standard contractual clauses.

A UK team sharing a prospect export with a separate sales partner in, say, Ireland is therefore a restricted transfer that the adequacy regulations cover, while the same export to a vendor in a country without adequacy needs more work.

A short pre-send checklist

For where this fits in a programme, see how content syndication in the UK hands lead data between parties.

Official sources

• Business-to-business marketing (ICO)
• Electronic mail marketing (ICO)
• Electronic and telephone marketing (ICO)
• Privacy and electronic communications under the Data (Use and Access) Act 2025 (ICO)
• Receiving personal information from the EEA (ICO)
• Are we making a restricted transfer? (ICO)
• Adequacy decisions (European Commission)