Live marketing calls
- Screen against TPS and CTPS and don't call registered numbers unless the person told you directly they're happy to hear from you.
- Don't call anyone who has asked you not to.
- Display your number (no withheld numbers) and say who you are.
Automated (recorded) calls
You need the person's specific consent to receive automated marketing calls from you. General third-party consent is not enough.
Texts and emails to individuals
You need consent. If the consent was collected by someone else, it must be specific enough to cover your organisation. The "soft opt-in" only applies to your own existing customers.
Business-to-business
You can email and text limited companies and LLPs without prior consent if you identify yourself and offer an easy opt-out. Sole traders and some partnerships are treated like individuals.
Keep records
Keep proof of consent — when, where and what the person agreed to. Every DataMembership record includes the opt-in time/date stamp, the URL and the consent channels chosen, so your audit trail starts on day one.
Questions
Who enforces PECR?
The Information Commissioner's Office (ICO), which can investigate complaints and issue fines.
Does PECR cover post?
No — post is covered by UK GDPR. Screen against the Mailing Preference Service to respect people who don't want direct mail.
This guide is general information, not legal advice. For the full rules see the Information Commissioner's Office (ico.org.uk). Last updated October 2026.
