Buying a Business Email List: UK Rules and Deliverability Checklist

Buying a business email list is legal in the UK, but what you can send, to whom, and whether it reaches the inbox depends on three things: PECR, UK GDPR and how you set up your sending. This guide covers all three in plain English.

PECR: who you can email without consent

The Privacy and Electronic Communications Regulations (PECR) control marketing by email and text. They split recipients in two:

Recipient	PECR treats them as	What you need
Limited companies, LLPs, public limited companies	Corporate subscriber	No prior consent. Identify yourself and give a valid way to opt out.
Public bodies: councils, schools, NHS organisations	Corporate subscriber	No prior consent. Identify yourself and give a valid way to opt out.
Charities that are companies or CIOs	Corporate subscriber	No prior consent. Identify yourself and give a valid way to opt out.
Sole traders	Individual subscriber	Prior consent (or an existing customer relationship under the "soft opt-in").
Ordinary partnerships	Individual subscriber	Prior consent (or the soft opt-in).

That's why each of our sector guides shows how that sector is set up according to ONS figures: in estate agency nearly every business is a company, while in sectors such as hairdressing and building a large share are sole traders, and email is the wrong first contact for them.

A work email such as [email protected] is personal data, even at a limited company. PECR may let you send without consent, but UK GDPR still applies:

Lawful basis: most B2B marketers rely on legitimate interests. Write down a short assessment: why the email is relevant to that person's job, and why it's reasonable for them to receive it.
Tell them where you got their details within one month of first using them, at the latest in your first email. One line in the footer does it: who you are, that you got their work details from a business data supplier, and how to object.
Honour objections straight away and keep a suppression list, so someone who unsubscribes is never emailed again, even if they turn up in a list you buy later.
Keep it relevant: email people about things connected with their job. A facilities manager about cleaning contracts is reasonable; the same person about a personal loan is not.

The Information Commissioner's Office has full guidance on direct marketing.

Before you buy: questions to ask any supplier

How many records in my selection have a named email, and how many only a general inbox?
When were the records last checked, and what happens if emails bounce?
Can you separate limited companies from sole traders and partnerships?
Can I select by job title, region and company size, and only pay for what I take?
Can I see sample records first?

Deliverability checklist

Authenticate your domain. Set up SPF, DKIM and DMARC records. Gmail and Yahoo require all three from anyone sending in bulk to their users, and business mail systems run similar checks.
Use a separate sending domain or subdomain for cold outreach, so a problem doesn't affect your everyday company email.
Warm up slowly. Start with a few dozen emails a day per mailbox and increase over several weeks.
Remove bounces immediately and never re-send to an address that has hard-bounced.
Add a one-click unsubscribe and process opt-outs promptly. Gmail and Yahoo require one-click unsubscribe for bulk senders.
Watch spam complaints. Google asks bulk senders to keep their spam rate below 0.3%. If replies say "not interested" or "remove me", slow down and tighten your targeting.
Send plain, personal emails: little or no imagery, one link at most, no attachments, no link shorteners.

Writing an email people answer

Subject line: short, specific to their sector, and honest about what's inside. Our sector guides include examples.
First line: why you're writing to them, not who you are.
One ask: a reply, a short call or a free trial, not all three.
Footer: your company name and address, where you got their details, and how to opt out.

Frequently asked questions

Is it legal to buy a business email list in the UK?

Yes. Buying and using business data is legal, but how you use it is regulated. Under PECR you can email limited companies, LLPs, public bodies and most charities without prior consent if you identify yourself and offer an opt-out. Sole traders and ordinary partnerships need to have consented first. UK GDPR also applies when the email address belongs to a named person.

Do I need consent to email a named person at a limited company?

Not under PECR, because the email goes to a corporate subscriber. But a named work email is still personal data, so UK GDPR applies: you need a lawful basis (usually legitimate interests), must tell the person where you got their details, and must stop if they object.

What is the difference between a named contact email and a company email?

A named contact email belongs to a specific person, such as a director or manager. A company email is a general inbox such as info@ or office@, read by whoever handles it. Named emails get decisions; company emails are useful for reaching smaller businesses where the owner reads everything.

How many emails can I send a day from a new domain?

There's no single safe number, but start small: a few dozen a day per mailbox, rising gradually over several weeks while you watch bounces, replies and spam complaints. Sending thousands on the first day is the quickest way to get blocked.