Building your own customer email list legally in a UK pub

An email list is the one bit of marketing you own. Facebook can change what people see. Google can move you down the page. Your own list stays yours, and you can tell your regulars about the quiz, the Sunday dinner or the match in one go.

But there are rules. Get them wrong and you can end up in trouble with the Information Commissioner's Office (ICO), the UK's data regulator. Get them right and they're not hard.

This isn't legal advice. It's a plain summary of the ICO's published guidance, with links so you can read it yourself. If you're unsure, ask a professional.

Two sets of rules

There are two pieces of law to think about.

• UK GDPR covers collecting and using people's personal details, including their email address.
• PECR, the Privacy and Electronic Communications Regulations, covers sending marketing by email and text.

You need to follow both. In practice, for a pub, it comes down to a few habits.

Get proper consent for marketing emails

The ICO says organisations "normally must have consent" before sending marketing emails to individuals. Consent has to be a clear, positive choice.

That means:

• Nothing pre-ticked. The ICO is clear that pre-ticked boxes, silence or inactivity don't count as consent. The customer has to tick the box themselves.
• Keep it separate. Consent should be unbundled from other terms and conditions. Don't hide "and you agree to receive offers" inside the rules of a competition.
• Don't make it a condition. The ICO says consent shouldn't be a condition of a service unless it's needed for that service. If someone wants to enter your quiz, they should be able to play without agreeing to marketing emails.

A good set-up looks like this. One box for the email address. A separate, empty tick box that says something like "Email me offers and events from [your pub]. You can unsubscribe at any time." The customer chooses.

What about the "soft opt-in"?

You might hear about a "soft opt-in" that lets businesses email customers without consent. It exists, but it's narrow. The ICO's conditions include that you got the details "while selling or negotiating to sell a product or service", that you only market your own "similar products and services", and that you gave people a chance to opt out when you collected their details and in every message after.

Someone typing their email into a quiz sign-up isn't obviously buying anything from you. Don't lean on the soft opt-in for that. Ask for consent. It's simpler and it's cleaner.

Tell people what you'll do with their details

UK GDPR gives people the right to be told what you're collecting and why. Keep a short privacy notice that says:

• Who you are (the pub, and the business behind it)
• What you collect, such as name and email
• What you'll use it for, such as sending offers and event news
• How long you'll keep it
• How they can get their details removed

Link to it from the sign-up form. One clear page beats three paragraphs of legal waffle.

Make it easy to leave

The ICO says you must give people the chance to opt out "in every subsequent message". Every email you send needs a working unsubscribe link. When someone unsubscribes, stop emailing them. Don't make them log in or ring you.

Under UK GDPR, people must also be able to withdraw consent easily at any time. If a regular asks at the bar to be taken off, take them off.

Say who it's from

The ICO says you "must not disguise or hide your identity" in marketing messages. Send from your pub's name, not a vague brand or a personal email, so people know who's writing to them.

Keep a record

The ICO lists keeping records to demonstrate consent as one of the conditions. For each person, keep:

• When they signed up
• Where they signed up, such as the quiz page or the website
• What the tick box said at the time

If anyone ever questions it, you can show them exactly what they agreed to.

Don't buy lists or borrow them

Don't buy email lists. Don't add the people from your mate's pub. Don't paste in every email from your booking system and start sending offers. Only email people who chose to hear from you.

Keep the list safe

An email list is personal data. Keep it in a proper email tool or a password-protected system, not a spreadsheet on the bar laptop. Only let the people who need it see it.

Sources

• ICO: How do we comply with the PECR electronic mail marketing rules?
• ICO: What is valid consent?
• ICO: Right to be informed

We checked every source on 23 October 2026. Rules change, so check the latest version before you act. Nothing here is legal advice.