There are two regulations applicable to email marketing in the UK. As the result of Brexit and with effect from the 1st Jan 2021, the UK stopped being part of the EU and hence the EU GDPR cease to protect the rights and freedoms of UK Citizens regarding their Personal Information. UK adopted its own implementation of GDPR (General Data Protection Regulation) called the UK GDPR this is based on EU GDPR and governs the data, such as email addresses or first names, which you use for email marketing. The Privacy and Electronic Communications Regulations (PECR) define permissions to send email marketing communications. Currently the UK GDPR works side by side with DPA 2018 and PECR to protect the privacy and rights of its citizens.
All emails must include a valid postal address and clear identification of sender. If you are sending a promotion you must make it clear that you are selling something and what the conditions attached are.
In short, you must not send electronic mail marketing to individuals, unless
- they have specifically consented to receive email from you, or
- they are an existing customer who bought (or negotiated to buy) a similar product or service from you in the past, and you gave them a simple way to opt out both when you first collected their details and in every message you have sent. This is called 'soft opt-in'.
Unsubscribe requests must be processed within 28 days.
The soft opt-in rule means you may be able to email your own customers, but it does not apply to prospective customers or new contacts (e.g. from bought-in lists). It also does not apply to non-commercial promotions (e.g. charity fundraising or political campaigning).
The maximum fine available under the GDPR is up to 17.5 million GBP, or 4% annual global turnover – whichever is higher.