GDPR, PECR and contacting a newly incorporated company

Post, email, text and phone calls to a newly incorporated company each carry different UK GDPR and PECR duties, and those duties depend on who — or what — you're actually contacting.

This page helps a UK accountancy practice work out, channel by channel, which recipients need specific consent, which can instead rely on a documented legitimate-interests assessment, and which duties — telling people you hold their data, honouring objections, and keeping a suppression record — apply whichever channel you choose. It draws only on current guidance from the Information Commissioner's Office (ICO) and the Privacy and Electronic Communications Regulations (PECR), checked or re-checked on 17 September 2026. It is general guidance built from primary sources, not advice on your specific campaign, and the law itself is moving: the Data (Use and Access) Act 2025 amended PECR and is commencing in phases, so parts of this area will keep changing. This page sits inside our wider guide to reaching newly incorporated companies, which covers the rest of the process.

Definitions before you choose a channel

Direct marketing. The ICO defines it as "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals" — a definition the Data (Use and Access) Act 2025 inserted directly into PECR. ICO, Identify direct marketing (checked 17 September 2026).

Personal data in a business context. A company on its own is not personal data: "information about a limited company or another legal entity ... does not constitute personal data." A named person changes that: "a name and a corporate email address clearly relates to a particular individual and is therefore personal data." So a director's name, a sole trader's details, or a named contact's work address is personal data; a generic mailbox (info@, hello@) with no individual identified is not — though PECR still governs the message you send to it. ICO, What is personal data? (checked 17 September 2026).

Individual and corporate recipients under PECR. For electronic mail, the ICO treats sole traders and some partnerships as individuals: "you can only email or text them if they have specifically consented, or if they bought a similar product from you in the past and didn't opt out." A company, a Scottish partnership, a limited liability partnership or a government body is a corporate body, and "you can email or text any corporate body" without that consent requirement. An ordinary English or Welsh partnership is treated the same as its individual partners. ICO, Electronic mail marketing (checked 17 September 2026).

A public register doesn't remove these duties. Companies House being public does not place your marketing outside data protection law: "Data protection law and PECR don't necessarily prevent you from doing this but there may be restrictions," and you must still "tell people that you have their information and what you want to do with it." ICO, Collect information and generate leads (checked 17 September 2026).

Which channel and recipient combinations need what

The table works through the channels a practice typically considers for first contact, and what each channel-and-recipient combination requires. Where the primary sources don't settle a point, the table says "unclear – seek advice" rather than guessing.

The registered office deserves one more note: it's a statutory contact address, not proof of where anyone works. See registered office versus trading address for what that means before you address post there.

Before you make contact

1. Choose your lawful basis and, if relying on legitimate interests, document the three-part assessment. LI
2. Identify the recipient type: a company, LLP, Scottish partnership or government body; or an individual — a sole trader, a partner in a non-Scottish partnership, or a named person. EMM
3. Check the channel rule for that recipient against the table above.
4. For any live call, check the TPS or CTPS register first. TM
5. For post, you should check the Mailing Preference Service, though it isn't a statutory requirement. RPP
6. Check your own suppression list before sending or calling. RPP
7. Have your privacy information ready to give at or before first contact. CIGL

In your first message or call

Once you know which channel and consent position applies, our guide to writing an introduction letter covers structure and tone. Whatever you send needs to:

1. Identify yourself and your practice — don't disguise or conceal who you are. EMM
2. Give a valid contact address so the recipient can respond or opt out. EMM
3. Say where you obtained their details — the Companies House public register. CIGL
4. Explain how to object or opt out of further contact. RPP
5. Keep the message relevant and restrained — proportionate to the interest you documented, not a general sales pitch. LI

When someone objects, opts out or unsubscribes

1. Stop using their data for direct marketing immediately — "there are no reasons that you can use to refuse their objection." RPP
2. Make it free of charge for them to object. RPP
3. Keep only the minimal suppression data you need — "you must not keep more than you need." RPP
4. Honour the objection for the channel they objected to, and extend it further if they've asked more broadly than that.
5. Record the objection on your suppression list so it survives a change of contact details or campaign. RPP

Telling people you're processing their data

Where you didn't collect the data directly from the person — true of almost every Companies House-sourced contact — you must give them privacy information "within a reasonable period and at the latest within a month of obtaining their information." Contact sooner and the deadline moves: "the latest point at which you must provide your privacy information is when you first communicate with that person ... the one month time limit still applies, so it is a case of whichever is sooner." In practice, for a first letter, email or call, your privacy information generally needs to accompany or precede that contact. A disproportionate-effort exception exists, but only if you "assess and document whether there is a proportionate balance between the effort involved ... and the effect of your direct marketing activity" — not a general excuse for skipping the step. ICO, Collect information and generate leads (checked 17 September 2026).

Legitimate interests is not automatic

Direct marketing is listed by the ICO as an example of where legitimate interests "may" apply as a lawful basis — but that word is doing real work. Even where it's a plausible fit, "you must still ... go on to assess the rest of the three-part test": a purpose test, a necessity test, and a balancing test ("Do the person's interests, rights or freedoms override the legitimate interest you've identified?"). None of this is a formality you can skip because the recipient is a business contact. The assessment has to be documented, not just carried out in your head, and relying on legitimate interests for the UK GDPR side doesn't touch the separate PECR question: "you must ensure your direct marketing complies with the Privacy and Electronic Communication Regulations 2003 (PECR) rules on consent." Whatever basis you rely on, the recipient's right to object is absolute — see the suppression checklist above. ICO, What is the legitimate interests basis? (checked 17 September 2026).

What changed under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is commencing in phases, so check the current position before relying on any date. Per the ICO's own summary, the Act: inserts the direct marketing definition quoted above directly into PECR; widens "call" to include attempted, not only completed, connections; widens "communication" to cover a message that has been transmitted, not only one received; adds a charity soft opt-in equivalent to the existing commercial one; and raises the maximum PECR penalty to the UK GDPR level, with fines described by the ICO as "up to £17.5 million or 4% of global turnover under PECR". We haven't verified a commencement date for that penalty change, so none is stated here — check the ICO's summary before relying on the current position. ICO, The Data (Use and Access) Act 2025: summary of the changes — privacy and electronic communications (checked 17 September 2026).

Anti-money-laundering and other professional rules are separate

Client due diligence, anti-money-laundering checks and any rules your professional body sets for approaching prospective clients are separate obligations from the data protection and marketing rules on this page. This guide doesn't cover them. Take that alongside advice from your own compliance adviser or professional body.

When to seek advice

Treat the following as a working list of situations this page doesn't resolve for you:

• You're not sure whether a recipient counts as an individual or a corporate body — for example, an unusual partnership structure or a public body.
• You're considering email or text to a sole trader or non-Scottish partnership and think a soft opt-in exception might apply.
• You're planning automated calls or social-media outreach at any scale.
• You're contacting companies outside England, Wales, Scotland or Northern Ireland, or the recipient may be based overseas.
• You've received an objection, complaint or ICO enquiry and aren't sure how to respond.
• You want a documented legitimate-interests assessment reviewed before you rely on it at scale.

How Launch Register can help

Launch Register records contact and suppression decisions for companies you choose to approach; the channel and lawful-basis decisions above remain the practice's own.