Outreach to newly registered UK companies: what UK GDPR and PECR actually allow

Two laws govern outreach in the UK. UK GDPR governs how you process personal data, including a director's name taken from the public register. PECR, the Privacy and Electronic Communications Regulations, governs electronic marketing messages specifically. Most confusion about whether you can email a new company comes from mixing the two up. This is not legal advice, but it is the framework, and it is more permissive than most people think, with a few rules that genuinely bite.

PECR: who you can email without consent

PECR distinguishes individual subscribers from corporate subscribers. Marketing email to an individual subscriber needs prior consent, with a narrow soft opt-in exception for existing customers. Marketing email to a corporate subscriber does not. A corporate subscriber is a company, an LLP, a Scottish partnership or a public body. Every entity on the Companies House register is one. So an unsolicited business email to a limited company is permitted, provided that:

1. you do not conceal your identity;
2. you provide a valid address at which you can be contacted;
3. you give a simple means to opt out, and honour it; and
4. you do not email an address that has told you to stop.

Two wrinkles. First, sole traders and ordinary partnerships are individual subscribers, so if a company's record leads you to a director's personal address, the corporate rule does not cover a personal inbox. Second, the corporate rule covers the sending; it does not switch off UK GDPR.

UK GDPR: processing the people on the record

A director's name, role and service address on the register are personal data, and publication does not make them free to use for anything. You need a lawful basis. For B2B prospecting that is almost always legitimate interests, which requires a short, documented balancing test: what is your interest, is the processing necessary for it, and does it override the individual's reasonable expectations? A director who has just registered a company can reasonably expect to be contacted about business services; the ICO's own guidance recognises B2B marketing as a legitimate interest in many cases. Record the assessment once for your outreach programme.

You also owe transparency. If you build a list of named directors, you must be able to tell them, on request or in your first message, that you obtained their details from the public register and why. A sentence in the email does this. And you must respect rights: someone who objects to marketing must be removed, promptly and permanently.

Good practice that keeps you safe

• Email the company, not the person, where you can. A hello@ or info@ address for the company is a corporate subscriber's address. It is also what Lead Forge Plus surfaces from a company's own website.
• Minimise. Keep the fields you need: company number, name, role. You do not need month of birth or nationality for a sales email; do not store them.
• Be accurate and specific. The record gives you true things to say. Do not invent a website or infer a home address.
• Keep a suppression list and check it before every send. One 'no' is forever.
• Keep it business. Do not use register data for consumer marketing, and never for anything a reasonable director would consider intrusive.
• Document once. A one-page legitimate interests assessment, a privacy notice you can link to, and a record of your suppression process cover the paperwork.

What Lead Forge does and does not do

Lead Forge displays the register as published and adds labelled analysis. It does not publish personal email addresses or phone numbers of individuals, and its AI is instructed never to guess them. Business contact details shown to Plus members come from a company's own public website. The privacy page explains how we handle data and how anyone named on a record can raise a concern. Use the register with the same respect you would want for your own name on it, and the law will not be your problem.