What Laws and Regulations Apply?
If you send marketing mail addressed to a named individual, you must comply with UK data protection law —specifically, the UK GDPR and Data Protection Act 2018 (DPA 2018) . Simply addressing mail to “the occupier” or “the homeowner” does not avoid this obligation, since you are still processing personal data. The Privacy and Electronic Communications Regulations (PECR) —which cover electronic marketing—do not apply to postal mail marketing. ( ICLG Business Reports, Wikipedia, ICO)
How to Comply with Data Protection Law
- You must have obtained the recipient’s contact details fairly and lawfully , and transparently explain that you will use these details for marketing.
- Mail must not be sent to someone who has objected or opted out.
- While not a statutory requirement, consulting the Mailing Preference Service (MPS) is considered best practice and is mandated under industry standards like the DMA Code and the CAP Code . ( Data8)
- If you’re sending unaddressed bulk mail in an area without knowing the specific recipients, you are not processing personal data , and the DPA does not apply. However, other marketing regulations still do. ( ICO)
What Are the Risks of Non-Compliance?
The ICO (Information Commissioner’s Office) enforces compliance. Breaches can result in:
- Enforcement notices
- Criminal prosecution
- Fines , with severity depending on the breach
Under current UK GDPR guidelines (effective since 2018), fines can reach up to £8.7 million or 2% of global turnover for less serious breaches, and £17.5 million or 4% of global turnover for serious violations—whichever is higher. ( ICO) Although rarely, the ICO may issue fines for improper direct marketing; for instance, some companies were fined a total of £170,000 for illegal direct marketing activity. ( IAPP, MyData-TRUST)
Recent Legal Developments
The Data (Use and Access) Act 2025 , effective June 19, 2025, has modernized parts of data protection law relevant to marketing. It clarifies the scope of legitimate interests as a lawful basis for direct marketing—particularly useful for reaching new audiences or enriching customer profiles. ( Greenberg Traurig, marketreach.co.uk)
Additional Resources
- Data Act 2025 overview: scope and impacts ( Greenberg Traurig)
- DMA Code and MPS guidance : opt-outs and best practices ( Wikipedia, Data8)
- ASA/CAP Code Section 10 : rules on using personal data in marketing ( ASA)
Summary at a Glance
| Area | Updated 2025 Guidance |
|---|---|
| Applicable Laws | UK GDPR / DPA 2018—PECR does not apply to mail marketing |
| Compliance Requirements | Fairly obtained data, opt-out honor, consult MPS, disclose for marketing purposes |
| Non-compliance Risks | ICO can impose enforcement notices, prosecution, and fines up to £17.5M |
| 2025 Update | Data Act clarifies legitimate interest basis for direct marketing |
| Best Practice Tools | MPS registration, DMA Code adherence, ASA/CAP Section 10 guidance |