PECR and UK GDPR Compliance

1. Who this guide is for

This guide explains the main UK rules that apply when you use Mira Novum data for business outreach by email, telephone, messaging and post. It summarises the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR) as they apply to B2B contact, and the tools we provide to help you comply.

It forms part of the obligations you accept in our Terms and Conditions. You remain responsible for deciding how the law applies to your own outreach, and for checking the guidance of the Information Commissioner’s Office (ICO), which is the UK regulator.

2. Your role: independent controller

When you unlock, export or receive records through our API, you become an independent controller of that data. You decide who to contact, why, how and how often, so the law treats those decisions as yours. We are responsible for compiling and supplying the database lawfully; you are responsible for every message, call and letter you send.

3. Our lawful basis

We process business-context contact data under legitimate interests, supported by a legitimate interests assessment, transparency (see Data Sources and Your Rights), suppression lists, sales exclusions chosen by verified owners and a verified removal process. Data is compiled from public business websites, the structured data published on those websites, official business registers and AI analysis.

4. Your lawful basis under UK GDPR

Where your outreach involves personal data (for example a named email address, a sole trader or a partnership), you need a lawful basis. For B2B outreach this is usually legitimate interests, which needs a three-part test: a genuine business interest (for example offering a relevant product or service), necessity (the contact is a reasonable way to pursue it) and a balancing test (your interest is not overridden by the person’s rights, considering what they would reasonably expect).

Record your assessment, keep it with your campaign records and review it when your purpose changes. Where PECR requires consent, legitimate interests is not enough for the marketing itself, and you must have the person’s prior consent.

5. Telling people where you got their details

Article 14 of the UK GDPR requires you to tell people whose data you obtained from someone else who you are, why you are using their data, your lawful basis, the source (for example, “public business information supplied by Mira Novum”), how long you will keep it and their rights, including the right to object. You must do so within a reasonable period and at the latest within one month, or in your first communication with them if that is sooner.

A short notice in your first message with a link to your privacy notice is usually the practical way to do this. Giving this notice is your duty as the controller, not ours. For example: “We found your business details in public business information supplied by Mira Novum. We are contacting you because [reason]. Our privacy notice at [link] explains how we use your details and your rights, including how to object. Reply STOP and we will not contact you again.”

6. Corporate subscribers

Under PECR, unsolicited marketing emails to corporate subscribers (limited companies, limited liability partnerships, Scottish partnerships, public bodies and similar organisations) do not need prior consent, as long as you identify yourself, give a valid contact address, offer a simple opt-out and stop when asked.

Even so, a named employee’s email address (such as jane.smith@company.co.uk) is personal data, so the UK GDPR still applies to it: you need a lawful basis, must give the Article 14 information and must honour objections. Messages should be relevant to the recipient’s role and business.

7. Individuals, sole traders and partnerships

Sole traders and some partnerships are treated as individuals under PECR. Electronic marketing to them (email and text messages) generally needs their prior consent unless the soft opt-in applies, which is only where you obtained their details in the course of a sale or negotiation with them, you market your own similar products or services, and you gave them a chance to opt out when you collected their details and in every message.

Our records do not tell you reliably whether a business is a company or a sole trader. Where the record shows no company registration, treat it as a possible sole trader or partnership and use a channel and approach that is lawful for individuals, for example post, or a relevant first contact through the business’s own contact form where its terms allow it.

Campaign check. When you start an email campaign from your records, our tools look for recipients that may be sole traders or partnerships: the register shows that legal form, or there is no company number and the address looks personal. Before the campaign starts you choose to leave them out, or you record that you hold their consent, and we keep that choice with its time and the user who made it. The check is cautious and can be wrong in both directions, so it supports your own assessment and does not replace it.

8. The Can I email this? label

Each record can show a “Can I email this?” label to help you apply these rules: “Yes, with an opt-out” for a corporate subscriber in a country whose law allows marketing email to businesses with an opt-out; “Consent needed” for a likely sole trader or partnership, or for a country that needs prior consent even for business addresses; “Check” where we cannot tell, for example because we hold no legal form or have not reviewed the country’s rules; and “Do not contact” where the address is on a suppression list. We work out the legal form from register details where we hold them, and otherwise from an automated estimate that can be wrong.

The label is guidance, not legal advice, and it describes only the electronic marketing rule. Even with “Yes, with an opt-out”, the UK GDPR applies to a named person’s address, you need your own lawful basis and Article 14 notice, and anyone who objects must not be contacted again. Our campaign check uses the same rule as the label, so the two never disagree; you remain the person who decides whether to send.

9. Open and click tracking

Tracking pixels that record whether an email was opened access information on the recipient’s device, and the ICO’s guidance on storage and access technologies treats them, and similar tracking in links, as covered by regulation 6 of PECR. That generally needs the recipient’s consent unless it is strictly necessary for a service they asked for. Cold B2B email rarely has that consent, so our open and click tracking is off unless you switch it on: leave it off unless you have a lawful basis for it, and tell recipients about any tracking in your privacy notice.

10. Named and free webmail addresses

Some businesses publish a free webmail or named address as their main contact. Such an address can be personal data even when the business published it, and it often belongs to a sole trader. We flag these addresses as free or named so you can exclude them with the company email filter. If you use them, you need a lawful basis and, for a sole trader, usually consent for marketing email.

11. Telephone marketing, TPS and CTPS

Live marketing calls are allowed to numbers that are not registered with the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), as long as the person has not told you they object. You must not make a live marketing call to a registered number unless that person or business has specifically told you that they agree to receive your calls for the time being.

Screen every list against TPS and CTPS before calling, and screen again at least every 28 days during a campaign, because registrations change. We do not screen numbers against these registers; where we show a line type or validity check, it is not a register check. Screening is your responsibility and is carried out at your own cost through a licensed screening service.

Automated calls with recorded messages need prior consent. When you call, say who you are, give your number if asked, display your number, and keep your own do not call list of anyone who objects.

Recording calls is your own processing. If you record or monitor calls, tell the other person at the start that the call may be recorded and why, have a lawful basis for the recording, keep it secure and delete it when you no longer need it. Interception and monitoring are also governed by the Investigatory Powers Act 2016 and the regulations made under it. Outside the UK the rules differ, and some countries and US states require every party to agree to a recording. Our tools do not record calls.

12. Text and messaging apps

Text messages and most messages sent through messaging apps count as electronic mail under PECR, so the email rules apply: consent is generally needed for individuals, sole traders and partnerships, and every message must identify you and offer a simple opt-out. Messaging apps also have their own business policies, which usually require the recipient’s opt-in before you start a conversation by automated message.

Our messaging integration sends automated template messages only to numbers on your own opt-in register and treats a “stop” reply as an opt-out. Manual messages are your responsibility.

The Messenger, Instagram and WhatsApp connections are for answering people who contact you, inside the reply window Meta allows, and for approved templates to people who opted in. They are not a channel for cold outreach: a first message to a business on social media is a manual task you carry out yourself, under that platform’s terms and the rules in this guide.

13. Post

Business to business marketing by post does not need consent under PECR, but the UK GDPR still applies to letters addressed to named people or sole traders. Use the business address for business purposes only, and never use a full address to visit or contact anyone at home.

14. Objections and suppression

When anyone asks you to stop, stop straight away across every channel unless they say otherwise, and add their email addresses, phone numbers and domain to your suppression list. Do not delete them entirely: keep the minimum needed to make sure you do not contact them again. An objection to direct marketing is absolute and must always be honoured.

Upload your suppression list to your account so those businesses are excluded from future exports and never charged. Opt-outs recorded in our outreach tools and the Outreach Desk are added to your account automatically.

15. Business owner labels

Verified business owners can choose labels such as “No Sales Pitches”, “Partnerships Only”, “No Cold Calls” or “Existing Suppliers Only”. We leave those businesses out of every export and campaign made on our platform. Check labels before each campaign and respect any preference a business gives you directly, including for records you obtained earlier.

16. Contacting businesses outside the UK

The law of the recipient’s country also applies. In the European Union, the ePrivacy rules are applied differently by each country, and several require prior consent for marketing email even to business addresses. In the United States, the CAN-SPAM Act requires accurate header information and subject lines, identification of the message as an advertisement where applicable, a valid physical postal address, and a working opt-out honoured within 10 business days, and calls and texts are subject to separate federal and state rules. Canada and Australia generally require consent for commercial electronic messages, which can be implied only in limited cases.

Check the rules for each country before you contact businesses there. If in doubt, ask for consent first.

17. AI and automated tools

If you use AI to draft messages or choose audiences, you remain responsible for what is sent. Check AI drafts for accuracy, unfair or misleading claims and personal data before sending, and do not let automated tools send to people your lawful basis does not cover. Our scores are indicators for prioritising leads; do not use them to make decisions about individuals.

The same applies when Vela Novum or an AI agent prepares or schedules outreach for you: you are the sender. Reply labels set by AI help you find objections quickly, but an objection counts from the moment it arrives, whatever label it was given, so check labels and honour every request to stop.

18. Records and accountability

Keep records of your legitimate interests assessment, your sources (including the date and export you obtained the data from), the notices you gave, consents where you rely on them, TPS and CTPS screening dates, objections and how you handled them. Respond to access and other rights requests within one month. Keep the data secure, accurate and no longer than you need it, and delete data you no longer use.

19. Tools we provide

Company, free webmail and bad email labels and filters; email verification with the check result and date; suppression list uploads and automatic exclusion of records you already own; exclusion of businesses removed at their request and of businesses whose owners chose no-sales labels; unsubscribe links, one-click unsubscribe headers, automatic stop on reply, unsubscribe or bounce, daily limits and sending windows in our outreach tools; an opt-in register and stop handling for business messaging; opt-out scopes on the Outreach Desk; local time and call windows; and logs of your exports and confirmations.

These tools support your compliance. They do not replace your own assessment and records.

20. Enforcement

The ICO can investigate complaints, issue enforcement notices and impose substantial fines for breaches of PECR and the UK GDPR, and individuals can claim compensation. Breaches of our rules also lead to suspension of your account under our Acceptable Use and Anti-Spam Policy.

21. Contact

Questions about compliance or about this guide: compliance@miranovum.com.