Direct marketing

Last updated 5 October 2026

If you collect, store, use or otherwise process personal information about customers, potential customers or suppliers, you must comply with the principles outlined in UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

These require that:

• the processing of personal data must be lawful and fair
• the purpose for which personal data is collected must be specified, explicit and legitimate, and not be processed in a manner that is incompatible with the purpose for which it was collected
• personal data processed must be adequate, relevant and not excessive
• personal data processed must be accurate and, where necessary, kept up to date
• personal data processed must be kept for no longer than is necessary for the purpose for which it is being processed
• personal data must be processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures

You must also:

• have a lawful basis for collecting and using personal information; and
• check whether you need to pay a data protection fee with the Information Commission, unless you are exempt.

Read more about privacy and data protection in marketing.

Privacy and electronic communications

The Privacy and Electronic Communications Regulations require you to get individuals to opt in consent before sending them marketing emails unless they've already shown interest in similar products or services and have met the requirements of the 'soft opt-in' rule.

The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules for marketing by email, text, phone and fax.

You normally need specific consent before sending unsolicited marketing emails or texts to individual subscribers. This includes individuals, sole traders and some partnerships.

You can generally send unsolicited marketing emails to corporate subscribers, such as limited companies and limited liability partnerships, without consent under PECR. However, you must identify your business and provide a valid way to opt out.

The UK GDPR still applies if you use personal information, such as a named employee’s business email address.

Preference services

Individuals and businesses may prefer not to be contacted by your business unless they have given their consent for you to do so. If you are selling or marketing using post, phone, fax or email, you should check to see if anyone you intend to contact does not want to be approached in this way and keep a record of this. You can do this by:

• getting your call list cleaned by a list cleaning company
• checking numbers online on the Telephone Preference Service (TPS) website
• buying a licence for the area or time you require

Anyone opting out of receiving direct mail may have registered through the TPS, the Mailing Preference Service (MPS) or the Fax Preference Service (FPS). 

It is illegal to communicate by telephone or fax with anyone registered with the TPS or FPS if you do not have their consent first. You must not send unsolicited marketing emails or texts to individual subscribers unless they have specifically consented or you meet all the conditions of the soft opt-in. Read more about email marketing.

As with all marketing, you must be honest and accurate about the goods and services you offer.