United Kingdom and Ireland: cold B2B e-mail under PECR and SI 336/2011

The United Kingdom and Ireland both chose the "opt-out for companies" route when they implemented the EU ePrivacy rules, and the UK kept its version after leaving the EU. For a manufacturer this makes them the most straightforward markets in Western Europe for a first e-mail to a distributor, with a few traps that catch people who assume "B2B means anything goes".

Putting it simply: you may send an unsolicited marketing e-mail to a limited company in the UK or Ireland. You must not hide who you are, you must give a valid address for opting out, and you must stop when asked. In the UK, sole traders and most partnerships count as individuals and need consent; in Ireland, a work address of a sole trader or employee may be used without consent when the message relates solely to their business. Named employees are still people under GDPR, so the information duty and right to object apply to them.

United Kingdom: PECR regulations 22 and 23

The rules are the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), enforced by the Information Commissioner's Office (ICO).

Regulation 22 states that it "applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers". For those recipients, consent is required unless the soft opt-in applies (details obtained in a sale or negotiations, similar products, easy refusal at collection and in each message). Regulation 22 does not apply to corporate subscribers.

Regulation 2 defines a corporate subscriber as a company, a company incorporated by royal charter, a partnership in Scotland, a corporation sole, or "any other body corporate or entity which is a legal person distinct from its members". An individual is "a living individual and includes an unincorporated body of such individuals", which is why sole traders and ordinary (non-Scottish) partnerships are individuals for PECR purposes.

The ICO's guide says the same in plain words: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)", whereas "sole traders and some partnerships are treated as individuals, so you can only email or text them if they have specifically consented, or if they bought a similar product from you in the past and didn't opt out".

Regulation 23 applies to every marketing e-mail, whoever receives it. You must not send one where "the identity of the person on whose behalf the communication has been sent has been disguised or concealed", or where "a valid address to which the recipient of the communication may send a request that such communications cease has not been provided".

Named addresses and UK GDPR

A corporate subscriber can be e-mailed under PECR, but firstname.surname@company.co.uk belongs to a person. The ICO notes that "you may also need to consider data protection implications if you are emailing employees at a corporate body who have personal corporate email addresses". The UK GDPR mirrors the EU text: legitimate interest as the lawful basis, privacy information at the first contact when the address was not collected from the person, and an absolute right to object to direct marketing. A short footer with your identity, the source of the address and a one-step opt-out covers PECR and UK GDPR at once.

What changed in 2025

The Data (Use and Access) Act 2025 amended PECR. According to the ICO's summary, the Act brings "the enforcement powers under PECR into line with UK GDPR, so that enforcement mechanisms and penalties are the same in most cases", widens the definition of a communication to anything "transmitted" whether or not it arrives, and adds a soft opt-in for charities. The corporate-subscriber position is unchanged. The ICO says its PECR guidance is under review; check the current pages.

Ireland: SI 336/2011, Regulation 13

Ireland implemented the ePrivacy Directive in the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011. The Data Protection Commission (DPC) enforces them and, unusually in Europe, prosecutes breaches in the criminal courts.

Regulation 13 requires consent for unsolicited marketing e-mail to a subscriber who is a natural person. For other subscribers, that is companies, e-mail is permitted, but it becomes an offence once the company has told you it does not consent. The DPC's prosecution of Viking Direct (Ireland) Limited shows how this works in practice: a business owner received marketing to a business e-mail address after sending three opt-out requests, and the company was charged under Regulation 13(4) with "sending an unsolicited marketing email to a business email address". The DPC case summary records that the failures came from the company's internal suppression process, which is exactly the system a manufacturer needs to get right.

Regulation 13 also carries the universal rules: do not disguise the sender, and include a valid address to which the recipient can send a request that the communications cease.

The penalties are per message. The DPC's guidance states that an offence under Regulation 13 carries "on summary conviction ... a fine of up to €5,000 for each unsolicited marketing email", and on indictment a fine of up to €50,000 for a natural person or €250,000 for a body corporate. The courts have often applied the Probation Act or ordered donations instead, but the DPC publishes every case.

For natural persons, sole traders included, Regulation 13(2) carves out business addresses: an e-mail to an address that reasonably appears to be used mainly in the person's commercial or official activity, relating solely to that activity, is not marketing that needs consent. So a sole trader's or an employee's work address may be used when the message is strictly about their business; a personal address needs consent.

The practical standard in both countries

• Identity: legal name, postal address, a real reply address.
• Opt-out: a reply-to-stop line is enough; an unsubscribe link is also fine. It must work and be actioned promptly.
• Suppression: one list across all tools and colleagues. The Irish prosecutions are mostly about opt-outs that were received and ignored.
• Relevance: write to the role that buys your category. UK GDPR and the EU GDPR, which applies in Ireland, both rest on legitimate interest, which depends on the recipient reasonably expecting the message.
• Volume: small, targeted batches to companies with evidence of selling your category. Mass campaigns draw the complaints that bring the ICO and DPC to you.

Both countries permit a first e-mail to corporate addresses under the conditions above. In Cresques, Ireland is a market with award evidence: the market view lists the companies with evidence of selling your category, and Cresques drafts the first e-mail with an opt-out for you to send from your own mailbox, so each e-mail has a reason behind it. The UK is covered by a country guide only, without award evidence.

What this means for a manufacturer

• A first e-mail to a limited company in the UK or Ireland is lawful. Keep it honest, identified and easy to refuse.
• Check the legal form before you send. A trading name on a website may hide a sole trader; look for "Ltd", "Limited", "LLP", "plc" or a company registration number.
• Treat named contacts as people: tell them where you got the address and that they can object.
• Build the suppression list before the first send, not after the first complaint.
• Expect the UK rules to be re-stated by the ICO during 2026 and 2027 following the Data (Use and Access) Act; the position for companies is not expected to change, but read the current guidance.