Legitimate interest for B2B email: UK GDPR, PECR and the EU difference

Two separate questions#

PECR, the UK's e-marketing rules, governs the sending of marketing by electronic mail. UK GDPR governs the personal data involved. A generic address such as info@ at a limited company may raise only the PECR question; an address like first.last@ raises both.

Based on ICO guidance on business-to-business marketing, October 2026.

The three-part test#

The ICO expects you to apply a three-part test before relying on legitimate interests, and to write it down in a legitimate interests assessment (LIA).

1. Purpose: is there a legitimate interest? Offering a relevant product to businesses can be one; the Data (Use and Access) Act 2025 makes clear that direct marketing can be a legitimate interest.
2. Necessity: is processing this data necessary for that purpose, or could you reach the business another way with less data, such as a generic address?
3. Balancing: would the person reasonably expect this contact in their business role, and does their interest outweigh yours? A clinic manager whose work email is on the clinic's website may expect relevant B2B approaches; a private mobile number found elsewhere is a different matter.

A short example assessment#

Purpose: offer online booking software to dental practices.
Data: practice name, public website, practice manager's work email as published on the practice website.
Necessity: only the business role and work email; no private details, no data bought from third parties.
Balancing: the manager deals with patient booking; the email is relevant to that role, short, sent once with two follow-ups at most, and offers a one-click opt-out.
Safeguards: privacy notice link in every email, source of the data stated, objections suppressed permanently, data deleted after 180 days without a reply.
Conclusion: legitimate interests apply. Reviewed: [date], by [role].

What you must tell people#

If you collect a contact's details from their website rather than from them, UK GDPR expects you to give privacy information, including where you got the data, at the latest when you first contact them. The right to object to direct marketing must be brought to their attention explicitly, at the latest in that first communication, and kept separate from other information.

• Who you are and how to contact you
• Why you're writing and on what basis
• Where you found their details
• That they can object to direct marketing at any time, and how
• A link to your full privacy notice

Objections are absolute#

When someone objects to direct marketing, you must stop using their data for it. There is no balancing at that point. Keep a suppression list of objections, check it before every campaign and never re-import the same person from another source.

Why the EU is different#

The EU GDPR also says, in its recitals, that direct marketing may be regarded as carried out for a legitimate interest. But the ePrivacy Directive leaves email marketing to legal persons to each member state. Germany and Austria require prior consent for advertising emails to businesses too. The European Data Protection Board's guidelines on legitimate interests say that where such consent rules apply, processing for that direct marketing can't be based on legitimate interests.

So a UK company can often email a UK limited company on the basis of legitimate interests, but the same email to a business in Germany needs the recipient's prior consent.

Checklist before you rely on legitimate interests#

• PECR allows the email for this recipient's legal form
• A written LIA covering purpose, necessity and balancing
• Only business-role data from a source the person would expect
• Privacy information and the right to object in the first email
• Objections suppressed permanently across all campaigns
• A retention period for leads who don't reply

This article is general information as of October 2026, not legal advice. Speak to a lawyer or the ICO about your own situation.