UK GDPR and PECR rules for hospitality email marketing

Under UK GDPR and PECR, a restaurant, hotel or club can send marketing emails or texts to individuals only with their consent or under the soft opt-in. The soft opt-in covers people whose details you collected while they were buying, or negotiating to buy, from you, provided you market only your own similar products and services and gave them a simple way to opt out when you collected their details and in every message since. You also need records showing how each person joined your list, and an unsubscribe that works.

Hospitality businesses collect contact details in many places: booking widgets, guest Wi-Fi, membership forms, gift vouchers and the host stand. Which rule applies to an address depends on where and how it was collected.

Which laws cover hospitality email marketing?

Two sets of rules apply together. The Privacy and Electronic Communications Regulations 2003 (PECR) control when you can send electronic marketing, and the ICO reads 'electronic mail' broadly enough to include texts, picture and video messages, voicemails, in-app messages and social media direct messages as well as email. UK GDPR governs how you use the personal data behind those messages, including your lawful basis, what you tell people and their right to object.

The consent and soft opt-in rules apply to individual subscribers, which includes sole traders and ordinary partnerships. Marketing to corporate email addresses, such as a company's events team, does not need consent under PECR, although you must still identify yourself and give a way to opt out. Data protection law still applies where the address belongs to a named employee.

What counts as valid consent for marketing emails?

PECR uses the UK GDPR standard: consent must be freely given, specific, informed and unambiguous, and given by a clear affirmative action. Pre-ticked boxes, silence and inactivity do not count. Consent also has to cover the channel you plan to use, so ask separately for email and SMS if you want both.

Keep marketing consent optional. Under UK GDPR, consent is unlikely to be freely given if a booking or Wi-Fi access depends on agreeing to marketing the service does not need. If you want to market on behalf of sister venues or partner brands, name them when you ask.

People can withdraw consent at any time, so keep a record of who consented, when, how and what they were shown at the time, and update it when they change their mind.

When can a venue use the soft opt-in?

Regulation 22(3) of PECR lets you send marketing emails without consent when three conditions are met:

• You collected the person's contact details yourself, in the course of a sale or negotiations for a sale of a product or service to them.
• You are marketing only your own similar products and services.
• You gave them a simple way to refuse marketing, free of charge apart from the cost of sending the refusal, when you collected their details and in every message since.

The ICO's guidance says the person does not have to complete a purchase. Negotiations are enough if they actively express an interest in buying, for example by requesting a quote or asking for details of what you offer, while a query that is not about buying does not count. A table booking, a room reservation or a private hire quote request is likely to qualify. The ICO also says entering a prize draw is agreement to the draw and nothing more, and a newsletter form or a guest Wi-Fi login involves no purchase, so get clear consent in those places.

The opt-out has to be offered at the point of collection. The ICO says a line in a privacy policy, or an opt-out first offered in a later order confirmation, is not enough, and staff taking bookings by phone should ask the question directly. Details collected by another company, including a sister company in the same group, cannot be used under the soft opt-in.

Since 5 February 2026, charities have had a separate soft opt-in for marketing their charitable purposes, which commercial venues cannot use.

What must every marketing email include?

Every marketing email or text must make clear who it is from and give a valid address for opting out. Under the soft opt-in, each message must also offer a simple way to refuse further marketing, which an unsubscribe link or a reply-to-unsubscribe option provides. Act on opt-outs promptly. You can send one message straight away confirming the unsubscribe and explaining how to resubscribe, as long as it does not ask the person to do anything to confirm the opt-out. After that, any reminder of how to update preferences should be a short line in a message you were already sending, such as an order confirmation, and must not encourage them to change their mind.

People have an absolute right under UK GDPR to object to direct marketing, and once they do you must stop. The ICO recommends moving their details to a suppression list, holding just enough information to make sure they are not contacted again, instead of deleting them.

Booking confirmations and reminders with no promotional content are service messages and fall outside these rules. The ICO says a routine message with marketing elements is direct marketing, so adding an offer to a confirmation email changes its status.

What records should a venue keep for email marketing?

• For consent: the wording shown, the date and time, the channel, and how the person gave consent, for example a website form or a booking flow.
• For the soft opt-in: when and how the details were collected, the purchase or booking involved, and how the opt-out was offered.
• A suppression list of everyone who has unsubscribed or objected, screened against every campaign audience.
• A separate record of each choice where marketing preferences differ by channel or brand.

Check audiences before every send. A guest who appears in a segment, such as 'booked twice in the last year', is not automatically someone you can email; their consent status or soft opt-in record decides that. Our guide to customer segmentation for restaurants and hotels has examples of segments worth building.

What did the Data (Use and Access) Act 2025 change?

Most of the Act's data protection and PECR changes took effect on 5 February 2026, and a new duty on handling data protection complaints starts on 19 June 2026. The changes most relevant to venues are:

• PECR fines now match UK GDPR levels, up to £17.5 million or 4% of global turnover, for breaches on or after 5 February 2026.
• Charities gained their own soft opt-in. The soft opt-in for businesses keeps the same three conditions.
• Some cookies, such as those that collect statistics used to improve a website, can now be set without consent, provided users get clear information and a simple, free way to object.
• The Act clarifies that direct marketing can be a legitimate interest under UK GDPR. That helps with the lawful basis for soft opt-in emails, while PECR still decides whether you can send them.
• From 19 June 2026, organisations must make it easy for people to complain about how their personal data is used, for example with an electronic complaint form, and acknowledge each complaint within 30 days.

The ICO updated its guidance on direct marketing using electronic mail on 28 April 2026 to cover the charity soft opt-in. Check the current guidance before changing your approach.

In Tiquo, each customer profile has separate opt-in settings for email marketing and SMS, and campaign emails go only to customers who have opted in, even when a list or segment includes others. When someone unsubscribes, their opt-in is updated automatically, while operational emails such as booking confirmations continue.

This is general information. Check the ICO's current guidance on PECR and direct marketing, or take advice, before relying on the soft opt-in for a campaign.