Can I cold email a sole trader in the UK?

Generally not without consent. PECR treats sole traders and ordinary partnerships as individual subscribers, so the consent requirement in regulation 22 applies in the same way it does for consumers. Calling them, subject to TPS and CTPS screening, is usually the more appropriate route.

How can I tell whether a business is a limited company?

Search the Companies House register. An active registration as a limited company or LLP indicates a corporate subscriber. A business absent from the register may be a sole trader, or may simply be registered under a different name, so treat a non-match as unverified rather than as proof.

Guide · Last reviewed August 2026

Is cold email legal in the UK?

Q: Is cold email legal in the UK?

It depends who you're emailing. Under PECR regulation 22, unsolicited marketing email to 'corporate subscribers' such as limited companies and LLPs does not require prior consent. Sole traders and ordinary partnerships are treated as individual subscribers and generally do require consent. UK GDPR obligations apply either way.

Usually yes — but only for some of the businesses on your list. The rules turn on a distinction most lead lists don't make, and getting it wrong is the single most common way UK B2B outreach breaks the law.

The short answer

Under the Privacy and Electronic Communications Regulations (PECR), regulation 22, you may send unsolicited marketing email to a corporate subscriber — a limited company, LLP or similar — without prior consent. You may not do the same to an individual subscriber, which includes sole traders and ordinary partnerships, unless you have their consent or they are an existing customer who was given a chance to opt out.

So "is cold email legal?" is really the question "is this particular business incorporated?" — and that varies lead by lead.

Corporate vs individual subscribers

The high street mixes both freely. Two salons side by side can sit on opposite sides of this line.

Corporate — email permitted

No prior consent needed under PECR reg 22

Limited companies (Ltd)
Limited liability partnerships (LLP)
Public limited companies (PLC)
Government bodies and other corporate entities

Individual — consent required

Treat like a consumer. Call instead, subject to TPS/CTPS

Sole traders
Ordinary partnerships (in England, Wales and NI)
Consumers at personal addresses
Anyone trading under their own name without incorporating

One wrinkle worth knowing: partnerships in Scotland have separate legal personality, and are generally treated as corporate subscribers — unlike ordinary partnerships elsewhere in the UK.

The stakes have risen

PECR penalties historically topped out at £500,000. Reforms under the Data (Use and Access) Act align them with UK GDPR levels — substantially higher, and calculated against turnover. Enforcement has always leaned on complaints, and a single annoyed recipient is enough to start one.

Most UK B2B lists don't distinguish corporate from individual subscribers at all. If yours came from a Google Maps scrape, it almost certainly mixes both — and the sole traders in it are the ones that generate complaints.

What a lawful B2B email needs

Emailing a limited company is permitted — it isn't unconditional.

Identify yourself clearly

The recipient must be able to tell who is writing without having to dig. Don't disguise or conceal the sender identity.

Give a working opt-out

Provide a valid address for opt-out requests, and honour them promptly. A reply-to that goes nowhere isn't an opt-out.

Include your company details

The Companies Act requires your registered name, company number and registered office address on business emails.

Keep a suppression list

Once someone opts out, they stay out — across every campaign, not just the one they replied to.

Have a lawful basis under UK GDPR

PECR isn't the whole picture. Named business addresses are still personal data, so you need a basis — usually legitimate interests — plus a note of why you think it's justified.

How do you tell which is which?

The Companies House register is the practical check. An active registration as a limited company or LLP is good evidence you're dealing with a corporate subscriber. Doing that by hand, for every lead, is the part nobody actually keeps up.

One caveat that matters: a non-match isn't proof of anything. Businesses trade under names that differ from their registered ones, and search misses happen. "Not found" means unverified, not "definitely a sole trader" — which is why it's worth treating those as call-first rather than assuming either way.

How WhatWebCo helps

Every lead we generate is checked against Companies House automatically and flagged 🟢 Emailable, 🟠 Call only, or ⚪ Not checked. It surfaces the information you need to make the call — it doesn't make the call for you, and it isn't a compliance guarantee. You remain the data controller and the decision to send is yours.

See how the flag works

This is general information, not legal advice. It summarises how PECR and UK GDPR are commonly understood to apply to B2B email as at August 2026, and it may not reflect later changes or your particular circumstances. The ICO publishes detailed direct marketing guidance, and if you are running outreach at scale you should take your own legal advice rather than relying on a vendor's summary — including this one.

Know who you can email before you send

Scan a postcode and every lead comes back checked against Companies House.

Start scanning free See pricing