Cold Calling vs Cold Email: Which Works Better?

Most UK businesses assume cold email is either clearly legal or flatly illegal. Both assumptions are wrong. The answer depends on one distinction most senders never check.

Yes, cold email can be legal in the UK. But it is conditional. Two regulations govern it: GDPR, which controls how you handle personal data, and PECR, the Privacy and Electronic Communications Regulations, which controls when you can send marketing emails. Under PECR's Regulation 22, there is a specific B2B exception. Email a corporate contact at a registered company and you do not need their prior consent. You just need to identify yourself clearly and include an opt-out in every email. That is the lawful route. But there is a catch that trips up most senders.

The B2B exception under Regulation 22 does not apply to sole traders. Under UK law, a sole trader is treated as a consumer, not a business, even if they trade under a company name. The moment your list includes a sole trader, the exception collapses for that contact. To email them lawfully, you need a valid GDPR lawful basis. The most practical route is legitimate interest: a genuine business reason to contact them, proportionate outreach, and their rights not overridden. But legitimate interest is not a rubber stamp. You need to document it with a Legitimate Interest Assessment. Consider a list of fifty contacts in one industry. Some are directors at limited companies. Some are freelance consultants operating as sole traders. The list looks identical. Legally, those two groups sit in entirely different frameworks. Misclassifying even one is a breach. And most purchased lists do not tell you which is which.

Purchased lists are the highest-risk source for exactly this reason. You are buying data from a third party with limited visibility into whether each recipient is a sole trader, a consumer, or a corporate employee. The list broker may not know either. Send to someone who should have been treated as a consumer with no lawful basis, and you are in breach of PECR and potentially GDPR. Both are enforced by the ICO, the Information Commissioner's Office, which has the power to investigate and issue fines. The ICO has taken enforcement action against organisations for unlawful direct marketing. The risk is real. The burden of verifying recipient classification sits with you, not the list provider.

Here is the decision rule. Before you send, ask two questions. First: is this recipient a named contact at a registered company, not a sole trader or individual consumer? If yes, PECR's Regulation 22 applies. No prior consent needed, but you must identify yourself and include a clear opt-out. Second: if there is any doubt, treat them as a consumer. Document a GDPR lawful basis before sending. Legitimate interest is the most practical route, but write it down. Regardless of which framework applies, every cold email must name who you are and give the recipient a simple way to opt out. That is not optional. Quick checklist: confirm the recipient is at a registered company, check for sole trader signals such as personal trading names or Gmail addresses, document your lawful basis, and include your identity and opt-out in every email. Get those four right and you have a lawful, repeatable outreach channel.

If that was of value, subscribe to the channel for one real business question answered every video. For the same clarity in writing, the website and newsletter is at www.fiveminutebusiness.com.