October 2026Dataset Refreshed: Expanded to 15.17M+ Unique Contacts
[email protected]+1 727-617-0017

What are UK GDPR and PECR rules for B2B email?

Also called: PECR, UK GDPR, GDPR B2B email

In the UK, B2B email marketing is governed by PECR, which sets the rules for electronic marketing, and by UK GDPR, which governs the personal data involved. Emails to corporate addresses don't need prior consent under PECR but must identify the sender and offer an opt-out; individual and sole-trader addresses generally need consent.

By John Britton, VP of Marketing, MedicalProspects · Updated November 4, 2026 · Compliance

Why it matters for healthcare sales and marketing

Teams reaching UK healthcare organizations need to know which contacts can be emailed and on what basis. The rules differ from both the U.S. and Canada.

How it works

  • PECR, corporate subscribers: companies, LLPs and public bodies can receive B2B marketing email without prior consent, with sender identification and an opt-out.
  • PECR, individual subscribers: sole traders and some partnerships are treated like individuals and generally need consent.
  • UK GDPR: a named person's work email is personal data, so you need a lawful basis (often legitimate interests), transparency about how you got the data, and respect for objections.
Comparison of UK corporate subscribers (companies, LLPs, public bodies; no prior consent; identify sender and offer opt-out) and individual subscribers (sole traders, some partnerships; consent generally needed).
Under PECR, corporate and individual subscribers have different rules. General information, not legal advice.

Example

Illustrative scenario. A health IT company emails named IT leaders at NHS trusts and private hospital groups on a legitimate interests basis, with a clear privacy notice and opt-out, and keeps sole-practitioner contacts out of email campaigns unless they have consented.

Common mistakes

  • Treating all UK contacts the same. Corporate and individual subscribers differ.
  • No privacy information. Tell people how you got their data.
  • Applying UK rules across the EU. EU countries have their own laws.

Related terms

  • Opt-In and Opt-Out (Email Consent)Opt-in means a person agrees before you email them; opt-out means you may email them until they ask you to stop. U.S. law (CAN-SPAM) is an opt-out system, while Canada's CASL is largely opt-in and the UK and EU have their own rules.
  • CASL (Canada's Anti-Spam Legislation)CASL is Canada's Anti-Spam Legislation. It generally requires consent, express or implied, before sending commercial electronic messages, along with sender identification and a working unsubscribe, and it applies to B2B email sent to recipients in Canada.
  • CAN-SPAM ActThe CAN-SPAM Act is the U.S. law that sets the rules for commercial email, including business-to-business email. It doesn't require prior consent, but it does require honest sender information and subject lines, a physical postal address, a working opt-out, and handling opt-outs within 10 business days.
  • Suppression ListA suppression list is the set of email addresses you must never send to, such as people who unsubscribed, addresses that hard-bounced and people who marked your email as spam. It should apply across every tool and campaign you send from.

Put it to work

Sources

  1. Guide to PECR: electronic mail marketing, Information Commissioner's Office
  2. Legitimate interests, Information Commissioner's Office

← Back to the healthcare GTM glossary