Email marketing is one of the most effective tools a small business can use — but it comes with rules. Get them wrong and you risk complaints, damage to your reputation and potential fines. Get them right and you build a list of people who genuinely want to hear from you.
This guide explains the principles for businesses in the UK, Ireland and Spain. It is a general overview, not legal advice. Rules change, and details depend on your circumstances, so check with a professional if in doubt.
Two layers of rules
In all three countries, email marketing is governed by two overlapping sets of rules:
- Data protection law — the GDPR in Ireland and Spain, and the UK GDPR in the UK — which governs how you collect, store and use personal data.
- Electronic marketing rules — which govern when you can send marketing messages:
- UK: the Privacy and Electronic Communications Regulations (PECR).
- Ireland: the ePrivacy Regulations (S.I. No. 336 of 2011).
- Spain: the LSSI (Ley 34/2002), alongside the LOPDGDD.
The general rule: consent
For marketing emails to individuals, the general rule is that you need their prior consent. Valid consent must be:
- Freely given: not a condition of buying something.
- Specific: clearly about receiving marketing emails.
- Informed: people know who you are and what they are signing up for.
- Unambiguous: an active choice, such as ticking an unticked box or clicking “Subscribe”.
Pre-ticked boxes, buried terms and “by using this site you agree” wording do not count.
The existing customer exception (soft opt-in)
All three countries have a form of exception for existing customers. Broadly, you may be able to send marketing emails without explicit consent if:
- You obtained the person’s details in the course of a sale (or negotiations for a sale).
- You are marketing your own similar products or services.
- You gave them a clear chance to opt out when you collected their details, and you give them one in every message.
The detail varies. Ireland’s rules, for example, include a time limit linked to the original sale. Spain’s LSSI has its own wording for the exception. Check the specifics for your country before relying on it.
Business-to-business emails
Rules for emailing businesses differ between countries. In the UK, PECR’s consent rules generally do not apply to emails sent to corporate addresses, although sole traders and some partnerships are treated as individuals, and you must still identify yourself and offer an opt-out. Ireland and Spain have their own approaches. Whatever the rules, sending relevant, respectful emails with an easy opt-out is good practice.
What every marketing email must include
- Clear identification of who is sending it.
- A working unsubscribe link that is easy to use.
- Honest subject lines that are not misleading.
- A way to contact you.
Process unsubscribe requests promptly and keep a suppression list so people are not re-added.
Data protection essentials
- Privacy policy: explain how you use subscribers’ data and link to it from your sign-up forms.
- Record consent: keep a record of when and how each person signed up.
- Choose compliant providers: use email platforms that handle data appropriately, including international transfers.
- Keep data secure: limit who can access your list.
- Respect rights: respond to requests to access, correct or delete data.
- Clean your list: remove people who have not engaged for a long time.
Things to avoid
- Buying email lists. It is extremely difficult to show valid consent, deliverability suffers and it damages your reputation.
- Adding everyone in your inbox to your newsletter without permission.
- Making it hard to unsubscribe.
- Using personal data for purposes people did not agree to.
Messaging apps too
The same principles apply to marketing via WhatsApp and SMS. Only send promotional messages to people who have agreed to receive them. See our guide to WhatsApp Business in Spain.
Compliance builds better lists
People who have genuinely chosen to hear from you open, click and buy more. Compliance is not just about avoiding trouble — it is the foundation of effective email marketing. Read our email marketing guide for small businesses to get started.
If you are building a website with sign-up forms, our guide to website legal essentials in Spain covers the privacy and cookie requirements. And if you would like help setting up a compliant email system, get in touch.
