The UK's Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025.1 Its changes have been switched on in stages, and most of the data protection provisions came into force on 5 February 2026.2 For teams running outbound campaigns into the UK, the headline is not a new set of rules for B2B outreach. It is that breaking the existing rules has become far more expensive.
This article is general information, not legal advice. Take specialist advice on your own programmes.
What changed
Much larger fines for marketing breaches
Marketing calls, emails and texts in the UK are governed by the Privacy and Electronic Communications Regulations (PECR). Under the new Act, the maximum penalty for a PECR breach rises from £500,000 to £17.5 million or 4% of global annual turnover, bringing it into line with UK GDPR.1
B2B marketing rules were not tightened
The government considered applying PECR's consumer-style consent rules to marketing aimed at businesses, but decided not to, partly because of concerns about the effect on businesses and their marketing.1 The existing B2B framework therefore continues.
Other changes worth knowing
- A legal definition of direct marketing has been added to PECR and UK GDPR: communication of advertising or marketing material directed at particular individuals.1
- Consent is no longer required for certain non-essential cookies, such as those used to compile statistics to improve a website. The EU has not made the same change, so sites serving EU visitors still need to follow EU rules.1
- Personal data breaches under PECR must now be reported to the ICO within 72 hours of becoming aware of them.1
The B2B rules as they stand
The ICO's B2B marketing guidance sets out the position. The ICO notes that the guidance is under review following the new Act, so check it for updates.3
| Activity | What the ICO guidance requires |
|---|---|
| Email and text to companies (corporate subscribers) | Consent is not required under PECR, but you must identify yourself, give a valid address for opting out, and honour opt-outs. |
| Email and text to sole traders and some partnerships | Treat them as individuals: you need consent unless the "soft opt-in" applies. |
| Live sales calls | Screen numbers against both the TPS and the Corporate TPS, plus your own do-not-call list. Identify the caller and allow your number to be displayed. |
| Automated (recorded) calls | Require specific prior consent. |
| Business contacts' personal data | UK GDPR still applies to a named person's details at work. You need a lawful basis, usually legitimate interests, must provide privacy information, and must always respect an objection to direct marketing. |
A practical checklist for outbound teams
- Screen every calling list against TPS and CTPS before each campaign, not once a year.
- Keep one suppression list across all campaigns and clients, so an opt-out recorded on one programme is respected on the next.
- Separate sole traders and partnerships from limited companies in your data, because different email rules apply.
- Document your legitimate interests assessment for B2B outreach and keep your privacy notice easy to find.
- Know where your data comes from. Ask any data supplier how contacts were sourced and when they were last verified.
- Don't assume UK rules work in Europe. EU countries apply their own e-privacy laws, and several are stricter about B2B email than the UK.
With penalties now on a par with GDPR, sloppy list hygiene has become a material business risk rather than an administrative one. The good news is that the steps that keep a campaign compliant, such as accurate data, careful targeting and respecting opt-outs, are the same ones that make it perform better.