Two laws, one email
Welcome back! Last time we talked about why email still works and what it's for. Now we're going to look at something that sounds dry but really isn't: the law.
Don't worry. You don't need a law degree for this. You just need to know two names and one good habit.
We'll use an example all the way through. Say you run a small candle shop. You sell online and at weekend markets, and you'd love to email customers about new scents. Before you send a single email, it's worth asking yourself: am I allowed to?
In the UK, two laws answer that together. They are UK GDPR and PECR.
What does UK GDPR cover?
UK GDPR is the big, general data protection law. It covers how you handle personal data, meaning any information about an identifiable person.
Is an email address personal data? Usually, yes. sarah.jones@gmail.com clearly points to a person. So as soon as you collect, store and use your customers' addresses, UK GDPR applies.
It sets the ground rules. You need a lawful reason to use the data, you have to be open about what you're doing, and you have to look after the data properly. It also gives us the definition of consent we'll look at in a moment.
And what does PECR cover?
PECR stands for the Privacy and Electronic Communications Regulations 2003. It's narrower and more specific. Among other things, it sets the rules for sending direct marketing by electronic mail.
That phrase covers more than you might think. The ICO, the UK's data protection regulator, counts emails, texts, picture and video messages, voicemails, in-app messages and even direct messages on social media.
Here's an easy way to picture the two laws. UK GDPR is the rulebook for the data: the list of addresses sitting in your system. PECR is the rulebook for the message: what you need before a marketing email lands in someone's inbox.
So do you have to pick one? No. When you email marketing to customers, both apply at the same time.
When do you need consent?
Under PECR, the normal rule is simple. Before you send marketing emails to an individual, you need their consent.
There is one exception, called the soft opt-in. It's important for shops like ours, so it gets its own lesson next time. For now, treat consent as your starting point.
Who counts as an "individual"? The ICO says this means individual subscribers, which includes sole traders and some partnerships. Limited companies are "corporate subscribers", and the rules for emailing them are different. Your candle shop mostly emails members of the public, though, so the individual rules are the ones that matter to you.
The stakes are real. Since the Data (Use and Access) Act 2025 came into force, the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover. The old maximum was £500,000. A small shop is unlikely to face anything that size, but it shows how seriously this is taken.
What makes consent valid?
This is the heart of today's lesson. PECR doesn't define consent itself. It borrows the UK GDPR definition, which says consent must be:
- Freely given: people have a real choice. They can say no without losing out.
- Specific: it covers this particular thing, your marketing emails, and isn't hidden inside something else.
- Informed: people know who's asking and what they're signing up for. The ICO says to give your name in the request and make it clear that it covers your marketing messages.
- Unambiguous: there's a clear, positive action, like ticking an empty box or typing in an email address to join a newsletter.
Let's test this on your checkout page. Say the box reading "Yes, send me news and offers" is already ticked. Is that consent?
No. The ICO is clear that silence, pre-ticked boxes and inactivity don't count. If the customer didn't act, they didn't agree.
What about "You must sign up to our newsletter to complete your order"? That fails too. Tying consent to something that doesn't need it means it isn't freely given.
Here's a good version: an unticked box that says "Tick to get emails from [Your Shop Name] about new candles and offers. You can unsubscribe at any time." It names you, it says what's coming, and the customer has to choose to act.
Consent also has to be as easy to withdraw as it was to give. That's a topic for a later lesson.
Check the guidance yourself
This area changes, so make a habit of going to the source. The ICO publishes free guidance on ico.org.uk. Two pages are worth bookmarking: "Guidance on direct marketing using electronic mail" and "What is valid consent?" under its UK GDPR guidance.
Each time you read one, look for the date it was last updated and write down the date you read it. When this lesson was written, the electronic mail guidance showed a last update of 28 April 2026. The consent page had a notice saying it was under review because of the Data (Use and Access) Act. That's exactly why you check rather than rely on memory.
Your task
Write the consent wording for your sign-up box. Then check it:
- Is the box unticked by default?
- Does it name your business?
- Does it say you'll send marketing emails?
- Can someone buy without signing up?
- Have you noted which ICO page you checked, and the date you read it?
Key takeaways
- UK GDPR covers personal data in general. PECR covers electronic marketing messages. Both apply to your marketing emails.
- Under PECR, you normally need consent before emailing marketing to individuals, including sole traders.
- Valid consent is freely given, specific, informed and unambiguous.
- Pre-ticked boxes, silence and forced sign-ups are not consent.
- Read the ICO's guidance yourself and note the date you read it.