Do I need an opt in before posting a letter to a business?

No. There is no opt in requirement for postal marketing in the UK. There is a right to object, which is absolute: once someone tells you to stop, you must stop.

Direct mail and the law

Do you need consent to send direct mail to a business in the UK?

Q: Is B2B direct mail GDPR compliant?

It can be. If the letter is addressed to a job title at a company address it contains no personal data and UK GDPR does not apply. If it names a person, you need a lawful basis, and legitimate interests normally fits, provided you have written down your reasoning, you tell them where you got their details, and you stop when asked.

Short version: no, not in the way you need it for email. Longer version below, because the reason matters more than the answer.

Request an invite Do I need to screen against MPS?

Written August 2026. General information, not legal advice.

The short answer

You do not need consent to post marketing to a business in the UK. The rules that demand consent, PECR, apply to electronic marketing such as email, text and phone calls, and they do not cover post. Postal marketing sits under UK GDPR alone, so if you are writing to a named person you need a lawful basis, and legitimate interests is normally the right one. You must tell them where you got their details, and you must stop if they ask you to.

Why everyone gets this wrong

Search this question and you will get the ICO's guidance on business to business marketing, which is excellent, and almost entirely about email. That is not the ICO being unhelpful. It is that the strict consent regime everyone remembers comes from the Privacy and Electronic Communications Regulations, and the clue is in the name. Electronic. Post is not electronic. It never has been.

So the mental model most marketers carry, the one that says you need a tick box before you can contact anyone, was built for a different channel and quietly applied to all of them. Post has always worked differently, and still does.

What actually applies to a letter

Two things. First, whether you are handling personal data at all. A letter addressed to The Facilities Manager, Acme Ltd at a company address contains no personal data, so UK GDPR does not apply to it. A letter addressed to Priya Shah, Head of Facilities does, because that is a living identifiable person.

Second, if it is personal data, you need a lawful basis. For B2B prospecting the answer is almost always legitimate interests, which means you have to be able to show you thought about it properly rather than just asserting it.

The test in plain English. Is there a real business interest in writing to this person? Is post a proportionate way to pursue it? Would this person be surprised or annoyed to receive it? If the third answer is yes, the first two do not save you.

What you have to do

Write down your reasoning once. A legitimate interests assessment is a short document, not a project. Purpose, necessity, balance. Keep it with your marketing records.
Tell them where you got their details. If you did not get the data from the person themselves, UK GDPR expects you to tell them the source, normally within a month or at your first communication with them. On a letter, one line at the foot does it.
Give them a way to object, and honour it. The right to object to direct marketing is absolute. There is no balancing test once someone says stop. Suppress them permanently, do not just delete the record, or you will simply mail them again next time you buy a list.
Keep the sourcing clean. Where the data came from matters more than the format it arrived in. Companies House and a company's own website sit very differently from a scraped file of unknown origin.

The bit that catches people out

Sole traders and partnerships. For electronic marketing they are treated as individuals rather than businesses, and while post is not governed by PECR, the same instinct is a good one. A letter to a sole trader is very often a letter to somebody's house, and that changes the balancing test. We wrote that one up separately.

Where Rockkt sits in this

Rockkt finds and verifies a business postal address, writes the letter and prints it, so the compliance questions land on you as the sender, as they should. What the software can do is make the boring parts automatic: keeping the source line on the letter, keeping a suppression list that survives your next list purchase, and flagging addresses that look residential before anything gets posted.

This page is general information about how the rules work, not legal advice, and it was written by a software company rather than a solicitor. Read the ICO's guidance on direct marketing and take proper advice before a large campaign.

Questions people actually ask

Is B2B direct mail GDPR compliant?

It can be, easily. If the letter is addressed to a job title at a company address it contains no personal data and UK GDPR does not apply. If it names a person, you need a lawful basis, and legitimate interests normally fits, provided you have written down your reasoning, you tell them where you got their details, and you stop when asked.

Does PECR apply to postal marketing?

No. PECR covers electronic marketing: email, text message, telephone and fax. Postal marketing is not electronic and is not covered. That single point is what most articles on this subject miss, because they were written about email.

Do I need an opt in before posting a letter?

No. There is no opt in requirement for postal marketing in the UK. There is a right to object, which is different and stronger: once someone tells you to stop, you must stop, and no business justification overrides it.

What should the privacy line on the letter say?

Enough for the reader to understand who you are, why you are writing, where you got their address and how to stop hearing from you. One or two lines at the foot of the letter, plus a link or QR code to your privacy notice, is normal practice.

Does MPS apply to B2B post? Posting to a sole trader's home Finding a postal address Rockkt pricing