Can you email your customers? GDPR and PECR rules for UK venues

Yes, as long as you have one of two things for each person: their consent, or the soft opt-in, which covers customers whose details you collected yourself while selling to them and who were offered an easy way to say no right then. That's the PECR rule. UK GDPR sits on top of it, so you also have to tell people how you'll use their details and keep records.

This is general information based on the ICO's guidance as it stood in October 2026. It isn't legal advice, and if your setup is unusual (several businesses sharing one list, say, or a cafe run by a charity) talk to a data protection specialist.

#Which GDPR and PECR rules apply to venue email marketing?

Two sets of rules apply, and the Information Commissioner's Office enforces both. PECR (the Privacy and Electronic Communications Regulations) decides whether you can send a marketing email or text at all. UK GDPR covers the personal data behind it: how you collect it, store it and explain what you'll do with it.

The rules bind whoever sends or instigates the marketing, the ICO says. That's you, the venue, even when the email goes out through Mailchimp or similar.

A few definitions clear up most of the confusion. Electronic mail includes texts, picture messages, in-app messages and private direct messages on social media, according to the ICO's definitions, so a promotional Instagram DM to a regular is covered too. A booking confirmation that only gives the date, time and party size isn't marketing. Tack "book your next visit for 10% off" on the bottom, though, and in the ICO's words "the message becomes direct marketing".

Companies are treated differently from people. You can email limited companies and LLPs without consent or the soft opt-in, the ICO says, as long as you say who you are and offer an opt-out. Sole traders and some partnerships count as individuals, though, and UK GDPR still applies when the address belongs to a named person. Handy for emailing local firms about their works do (our guide to filling Christmas party bookings covers that).

#What counts as consent for marketing emails?

Consent has to be a clear, positive action by the guest, freely given, for something specific. The ICO's email guidance spells out what that means, and for a venue most of it comes down to how your tick box is set up:

• The box starts unticked. Pre-ticked boxes, silence and inactivity don't count.
• The wording names your venue and says it's about email. The ICO says that just asking for consent for "direct marketing" won't be specific or informed enough.
• Email and texts get separate choices.
• Nothing depends on it. Consent shouldn't be "bundled up as a condition of service unless it is necessary for that service" (ICO), so your Wi-Fi or loyalty card has to work for people who say no.
• It sits apart from your terms and conditions.
• You keep a record of who agreed, when and how.

Consent doesn't last forever, either. UK GDPR sets no time limit, but the same ICO page says consent "is likely to degrade over time" and suggests reviewing it at sensible intervals. It also lists missing records as one of the things that makes consent invalid. So that spreadsheet somebody built for the pub years ago, with no note of how anyone signed up? I wouldn't touch it. Start a fresh list.

A sign-up line that does the job reads something like: "Tick to get emails from The Wren & Anvil about events, new menus and offers. Roughly twice a month, and you can unsubscribe any time."

#How does the soft opt-in work for a pub or restaurant?

The soft opt-in lets you email existing customers without asking for consent first, but only when all five of the ICO's conditions are met (ICO):

1. You got the contact details directly from the person. Not from a sister company, and certainly not from a list: "There is no such thing as a third-party marketing list that is compliant with the soft opt-in."
2. You got them during a sale or negotiations for a sale. Nobody has to have bought anything, but they must have actively shown an interest in buying, such as asking for a quote. Browsing your website doesn't count.
3. You only email about your own similar products and services, the things they'd reasonably expect to hear about from you. The quiz night and the Sunday menu, yes. Your mate's taxi firm, no.
4. You offered a simple way to opt out at the moment you took their details: a prominent box on the form, or staff asking out loud. An opt-out buried in your privacy policy, or one that first appears in the confirmation email, isn't good enough.
5. Every email after that includes an opt-out too.

#Receipts and party enquiries

A guest who gives an email address for a receipt when they pay is part of a sale, so show the opt-out on screen (or have staff mention it) before the address goes in. Someone asking for a price for a private hire or a works do is negotiating one, as the ICO lists requesting a quote as the kind of interest that counts. Put the opt-out box on the enquiry form.

#Table bookings

This is the grey bit. A booking looks to me like exactly what the soft opt-in was written for (they're arranging to buy a meal), but the ICO doesn't use bookings as a soft opt-in example, and its own restaurant example has staff asking a caller for consent. So put a marketing choice on the booking form, ideally a consent tick, and you're covered however it's read.

If the guest booked through a third-party platform's own app or website, you didn't collect the details directly and the soft opt-in is off the table. Any marketing permission has to name your venue and cover email.

#Wi-Fi sign-ups, competitions and loyalty schemes: can you email them?

Mostly only with consent, because nothing was being sold when you got the address. Here are the common situations side by side.

#Guest Wi-Fi

Logging on to free Wi-Fi isn't buying anything or asking to, so I wouldn't lean on the soft opt-in. Use an unticked consent box on the sign-in page and let people online whether they tick it or not, since emailing them isn't necessary to give them Wi-Fi. (The ICO's guidance has a close example: a charity-run cafe whose Wi-Fi sign-ups didn't qualify for the charity soft opt-in, because getting online showed no interest in the charity's work.) Our guide to building a restaurant email list covers setting up the sign-in page.

#Competitions and prize draws

An entry form gets you permission to run the draw and contact the winner, and nothing more. The ICO's small business guidance says consent given for a prize draw "can't be carried over for anything else" (ICO), and its email guidance uses a competition form with no mention of future emails as a bad-practice example. Add a separate, optional, unticked box for your emails, and let people enter without ticking it.

#Loyalty schemes

A reward for signing up is allowed, within reason. The ICO's consent guidance says a loyalty scheme offering money-off vouchers gives "clearly some incentive to consent to marketing", and that withholding the vouchers from people who don't join "does not amount to a detriment for refusal". Still, keep the marketing tick as its own choice, so a regular can collect stamps without getting the newsletter.

#What must every marketing email include?

Two things, every time, whether you're emailing an individual or a company: who it's from, and a working way to opt out (ICO brief guide).

• Your venue's name, clearly, in the sender name and in the email. You can't disguise or hide who's sending.
• An unsubscribe link, or a reply address that works, in every single email. It has to be free (beyond normal messaging costs), and the ICO says you shouldn't make people log in or create an account to use it.

When someone unsubscribes, stop. For withdrawn consent the ICO says "immediately or as soon as possible" (respect people's preferences), and the right to object to direct marketing is absolute. Don't delete them, though. A suppression list keeps just enough about the person to respect their choice, so they don't sign in to your Wi-Fi next month and land straight back on the list (rightly annoyed). You can send one message confirming the unsubscribe, as long as it doesn't ask them to do anything.

#What records should you keep?

Enough to prove why you're allowed to email each address. The ICO asks for a record of consent covering who, when and how, so for each person I'd keep:

• the date and time they signed up
• where it happened (booking form, Wi-Fi page, the QR card on table six, the till)
• the exact wording they saw, and whether it was a consent tick or a soft opt-in with an opt-out
• anything that's changed since, unsubscribes included

A clipboard on the bar records none of that (and the handwriting is usually a coin toss), so if you build the form inside your email platform, check it stores the time and source of each sign-up.

UK GDPR also requires you to tell people, when you collect their details, what you'll use them for, how long you'll keep them and who you'll share them with (right to be informed). A short line under the form linking to your privacy notice covers it. And since June 2026 every organisation must give people a clear way to raise a data protection complaint and acknowledge it within 30 days (ICO). For a single pub that can be an address in the privacy notice plus someone who checks it.

#What did the Data (Use and Access) Act 2025 change?

For a typical pub, bar, restaurant or cafe, the rules on when you can send marketing emails stayed the same, and the penalties for breaking them went up a lot. Everything is now live: the ICO said in June 2026 that "all outstanding provisions of the Act are now in force" (ICO).

#Bigger fines

The ICO can now fine up to £17.5 million or 4% of global turnover for breaches of PECR (ICO statement, 5 February 2026). The previous maximum was £500,000 (what are PECR?). The higher limits apply to breaches on or after 5 February 2026, and anything earlier is handled under the old rules (Commencement No. 6 Regulations). The ICO has said it will use the new powers "where necessary for the most serious cases" (ICO, June 2026).

#A soft opt-in for charities

Since 5 February 2026, charities can email supporters without consent under a new regulation 22(3A), if they collected the details directly on or after that date, offered an opt-out, and only use it to further their charitable purposes (ICO). It does nothing for an ordinary venue. A charity-run cafe could use it for donation and volunteering emails, but the ICO says a passer-by giving an email for a drinks receipt isn't showing support, so the food and drink emails still need consent or the normal soft opt-in.

#What stayed the same

To email an individual customer you still need consent or the soft opt-in, and every marketing email still needs your name and a free way to opt out; the ICO's email guidance, last updated in April 2026, still sets that out. Once your list is sorted, our email marketing guide for pubs and restaurants covers what to send.