Marketing emails from an accountancy firm are governed by the Privacy and Electronic Communications Regulations 2003 (PECR) as well as UK GDPR. Sole traders and ordinary partnerships count as individuals, so unsolicited marketing to them needs either consent or the “soft opt in” for existing clients and enquirers, while companies and LLPs can be emailed without consent but must always be able to unsubscribe.

Which emails count as marketing?

PECR now uses the same definition as the Data Protection Act 2018: direct marketing is “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. The ICO says this covers any advertising or promotional material and any electronic message stored for a recipient to collect, including email, text, voicemail and direct messages on social media.

Purely administrative “service messages” are not marketing. A reminder that a client’s tax return is due, a request for missing records or a fee note is a service message. The ICO’s point is that adding advertising or marketing material turns the message into direct marketing. A monthly tax newsletter that promotes the firm’s services, a budget update ending with “book a review”, or an email offering a new bookkeeping package are all marketing. If in doubt, treat the newsletter as marketing and apply the rules below.

Does it depend on what type of client is being emailed?

Yes, and this trips up practices more than anything else. PECR distinguishes:

Recipient PECR category Unsolicited marketing email
Private individual Individual subscriber Consent or soft opt in needed
Sole trader Individual subscriber Consent or soft opt in needed
Ordinary partnership (England, Wales, Northern Ireland) Individual subscriber Consent or soft opt in needed
Limited company, LLP, Scottish partnership Corporate subscriber Allowed without consent, but identity and opt out rules apply

Much of a typical practice’s client base is sole traders, landlords and partnerships, so most of the list is likely to sit in the stricter category. The ICO also confirms the rules apply to generic addresses such as info@: knowing the person’s name is not needed for PECR to apply. The general professional rules on advertising are covered in marketing and advertising rules for accountants.

How does the soft opt in work for existing clients?

Regulation 22(3) allows marketing email to individual subscribers without consent where all of these are met:

  1. the firm obtained the contact details itself in the course of a sale or negotiations for a sale of a product or service;
  2. the marketing is only about the firm’s own similar products and services;
  3. the person was given a simple, free way to refuse when the details were collected; and
  4. a simple way to refuse is given in every later message.

The ICO says “negotiations” include requesting a quote or asking for details of services, so a prospect who asked for a fee proposal can qualify even if they never engaged the firm. The opt out must be offered at the point of collection, for example a clear box on the engagement form or enquiry form; an opt out first offered in a later confirmation email is too late. The ICO also says the soft opt in never covers contact details obtained by someone else, even another company in the same group.

“Similar” is judged by what people would reasonably expect. A self assessment client would reasonably expect emails about tax and accounting services; promoting a partner firm’s mortgage or insurance products falls outside the soft opt in because it only covers the firm’s own services.

What about prospects and contacts from networking?

For individual subscribers with no sale or negotiation, the firm needs consent. The ICO is clear that publicly available contact details, for example on a website or social media profile, do not amount to consent, and that this includes sole traders and ordinary partnerships. A business card collected at an event is not consent either.

Bought or rented lists are rarely usable. The ICO says consent on a third party list is valid only if it named the buying organisation, covered email, and is recorded so the firm can show who consented, when and how; consent to “trusted partners” does not count. Soft opt in never applies to bought lists.

Emails to staff of limited companies do not need consent under PECR, but the named person’s details are still personal data, so the firm needs a lawful basis (usually legitimate interests), must tell them how their data is used and must stop if they object.

What does valid consent look like?

PECR takes its consent standard from UK GDPR: freely given, specific, informed and unambiguous, by a clear affirmative action. The ICO says the request must name the firm and the type of marketing, must be separate from terms and conditions, must not use pre ticked boxes, and should be recorded with who, when and how. Making marketing consent a condition of the engagement is unlikely to be valid.

ICAEW’s lawful basis helpsheet adds practical points for firms: do not bury marketing consent deep in engagement letters, use a separate page or a clearly separate tick box so clients can accept the engagement but not the marketing, and consider renewing consent periodically, yearly where engagement letters are reissued annually. The lawful basis side is explained in lawful basis for processing client data.

What must every marketing email contain?

Regulation 23 applies to all marketing emails, to individuals and companies alike. The sender’s identity must not be disguised or concealed, and there must be a valid address to which the recipient can send a request to stop. The ICO expects a clear unsubscribe link or the ability to reply directly, and says firms should not require people to log in or create an account to unsubscribe.

Tracking pixels that record when an email is opened are covered by PECR’s separate rules on storage and access technologies, not the email rules, so they need their own compliance check.

How does UK GDPR sit alongside PECR?

Where emails use personal data, both regimes apply. The ICO says consent marketing will usually rest on consent as the lawful basis, while soft opt in marketing will usually rest on legitimate interests, supported by a legitimate interests assessment. People have an absolute right to object to direct marketing, and not opting out at the start does not override that. The ICO recommends a suppression list so that someone who unsubscribes is not added back by a later import from the practice management system.

If an agency or platform sends the newsletter, the firm remains responsible as the instigator, and the ICO expects a written contract where personal data is used. That contract should meet Article 28; see data processing agreements with software providers.

What are the penalties?

The Data (Use and Access) Act 2025 brought PECR enforcement into line with UK GDPR. From 5 February 2026, Schedule 1 to PECR applies the Data Protection Act 2018 penalty regime, and a breach of regulation 22 or 23 can attract the higher maximum in section 157: £17,500,000 or, for an undertaking, 4% of worldwide annual turnover if higher.

How might a practice clean up its list?

Illustration only. A firm has 400 email addresses for a newsletter. It splits them into: 250 sole trader and partnership clients whose details were collected at onboarding, but without any opt out, so it cannot use the soft opt in and must seek consent; 90 company and LLP contacts, which it can continue to email with an unsubscribe link and a privacy notice; and 60 networking contacts, whom it removes unless they are company employees. For new clients it adds a clear opt out box to its engagement form and an unsubscribe link to every newsletter.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.