Home / Resources / UK GDPR and PECR for AI marketing automation

UK GDPR and PECR for AI marketing automation: a practical guide for UK businesses

AI makes it easy to send more follow-ups to more people. UK rules decide who you are allowed to send them to. Here is the practical version.

Two sets of rules

• UK GDPR (with the Data Protection Act 2018) covers how you collect, use and store personal data: lawful basis, transparency, minimisation, security and individuals’ rights.
• PECR covers electronic marketing by email, text and calls, and cookies and similar technologies.

The ICO regulates both. The Data (Use and Access) Act 2025 is changing parts of these rules, including some PECR provisions, so check the ICO’s current guidance before you rely on any detail.

Email and SMS marketing

• To individuals, electronic marketing generally needs prior consent.
• The soft opt-in can allow marketing to existing customers about your own similar products or services, if they were given a clear chance to opt out when you collected their details and in every message.
• Every message needs a simple way to opt out, honoured promptly.
• Business-to-business email to corporate addresses is treated differently from email to individuals, but UK GDPR still applies to named people.

Cookies and analytics

Non-essential cookies and tracking generally need consent under PECR, with a banner that makes refusing as easy as accepting. Some exemptions exist and are being widened, so follow current ICO guidance rather than old templates.

AI tools that touch personal data

• Know which tools process personal data, where, and whether they use it to train models.
• Have a data processing agreement with each vendor and check international transfer arrangements.
• Do a data protection impact assessment for higher-risk uses, such as profiling or automated decisions.
• Tell people in your privacy notice how you use AI with their data.

A compliant automation set-up

1. Capture consent or soft opt-in status at the point of collection, and store it with a timestamp.
2. Sync that status to every tool that sends messages.
3. Suppress opted-out contacts everywhere, automatically.
4. Keep records of what was sent, to whom and on what basis.

This article is general information, not legal advice. Rules change; check current guidance from the relevant regulator.

How we approach it

Reckona AI scopes UK automation around UK GDPR and PECR from day one and tells you up front which personal data a workflow touches. See Reckona AI in the UK.

Frequently asked questions

Do I need consent to send marketing emails in the UK?

To individuals, generally yes under PECR, unless the soft opt-in applies to existing customers for similar products or services, with a clear opt-out offered at collection and in every message.

What is the soft opt-in?

A PECR exception that can allow marketing to existing customers about your own similar products or services, provided they had a simple chance to refuse when their details were collected and in every message since.

Can I use AI tools on customer data in the UK?

Yes, if you have a lawful basis, are transparent, have agreements in place with vendors, check international transfers and assess higher-risk uses. Check whether the tool uses your data for training.

Are the UK rules changing?

Yes. The Data (Use and Access) Act 2025 changes parts of UK data protection and PECR. Check the ICO’s current guidance before relying on older advice.