Get Started

Run a compliant cold-email lead-gen service

Cold email still books meetings for business-to-business sellers, and most of the people doing it are breaking UK law without knowing. Learn to run it as a service, for clients or for yourself: a clean targeted list from public sources, a sequence that gets replies, mail that lands in the inbox, and results you can prove. The rules come first, because this niche is a legal minefield and getting it wrong is how you earn a fine instead of a fee.

146 minIntermediateTools: Free to practise and to build the list. Running it for real: a sending domain and mailbox (about £5 to £15 a month), optional sending software laterStep 1 free
Tested 12 Oct 2026 · Python 3.13.5, Windows 11
A tested list-buildera Python tool that pulls company data from a Companies House search or a CSV, validates and deduplicates the emails, and flags the addresses UK law says you must not cold-email
The compliance you cannot skiphow PECR and UK GDPR apply to B2B cold email, a filled-in legitimate interests assessment and privacy notice, and the one rule that keeps you on the right side of a £17.5m fine
The playbooka four-email sequence that gets replies, the deliverability setup that lands it in the inbox, a results tracker, example pricing, and how to land the first client
Before you start
01/07The service, and the law you must get right first0 done
STEP 01 of 07~18 min

The service, and the law you must get right first

Understand what you're selling, who you're allowed to email, and the UK rules that decide whether this is a business or a liability.

  1. The service is simple to describe and hard to do wellyou find businesses that might buy what a client sells, you email them a short, relevant message, and you book the client qualified meetings. Done properly it is a steady source of pipeline. Done carelessly it is spam that burns a client's domain and breaks the law. The difference is almost entirely in the parts most people skip: the list, the compliance and the deliverability. This mission is built around those.

  2. This is distinct from finding leads for yourselfFind 20 businesses worth pitching and Find UK companies the day they register are about sourcing prospects. This mission is about running outreach as a repeatable, compliant service: the sending setup, the sequence, the reporting and the pricing that a client pays a retainer for.

  3. Now the law, because it governs everything elseTwo sets of rules apply to UK cold email, and you need both.

    • PECR (the Privacy and Electronic Communications Regulations) governs the marketing message itself: email, texts, calls and DMs.
    • UK GDPR governs the personal data you use to send it: a named contact, or a personal-looking email address, is personal data even in a business context.
  4. The rule that makes B2B cold email possibleThe Information Commission's business-to-business marketing guidance ↗ explains that limited companies and LLPs are "corporate subscribers". You may email a corporate subscriber without prior consent, as long as you identify yourself clearly and give a working way to opt out. Sole traders, most partnerships and individuals are "individual subscribers", and emailing them needs consent. So this service sends to limited companies and LLPs, and holds everyone else back. That single distinction runs through the whole course.

    The Information Commissioner's Office business-to-business marketing guidance page, explaining that limited companies and LLPs are corporate subscribers who can be emailed without consent, while sole traders and partnerships are individual subscribers treated the same as individuals
    The regulator's B2B marketing page. The corporate-subscriber rule is the foundation this whole service stands on. It is marked as under review after the Data (Use and Access) Act, so check it each quarter.
  5. What corporate-subscriber status does and does not allow:

    • Allowed: a relevant marketing email to a limited company or LLP at a business address, with no prior consent, as long as you say who you are and offer an opt-out.
    • Still required: a lawful basis under UK GDPR for using the contact's personal data. For prospecting that is normally legitimate interests, which needs the three-part test in the kit's assessment.
    • Not allowed: cold-emailing sole traders, partnerships or an individual's personal mailbox without consent. A name@gmail.com almost always means an individual.
    • Never: buying a list of "decision-maker emails", scraping a site in breach of its terms, or emailing consumers. Each is how people end up reported.
    CarefulThe stakes are real. Under the Data (Use and Access) Act 2025 the regulator can fine up to £17.5 million or 4% of global turnover under PECR ↗, the same ceiling as UK GDPR. Get the list and the opt-outs right and you are nowhere near this. Get them wrong at volume and you are the example everyone cites.
    TipWho this suits: you are organised, you will do the unglamorous list and compliance work every week, and you can give it 6 to 8 hours. Everything to practise is free. Keep your income steady while you land the first client, and treat the law as the product, not the paperwork: "we do this compliantly" is a reason clients pick you.
  6. Everything in this mission is in one kit: open the pieces at kit.md (overview), build_list.py (the list-builder), sequence-template.md, results-tracker.csv and legitimate-interests-and-privacy-notice.md.

✓
CheckpointYou can say in one sentence who you are allowed to cold-email in the UK (limited companies and LLPs, with identity and an opt-out) and who you are not (sole traders, partnerships, individuals, without consent).
If it breaksIsn't all cold email illegal in the UK? + 1 more
Isn't all cold email illegal in the UK?
No. Cold email to a corporate subscriber (a limited company or LLP) is allowed under PECR without prior consent, as long as you identify yourself and offer an opt-out, and you handle the personal data lawfully under UK GDPR. What's effectively off limits is cold-emailing individuals and sole traders, and buying or scraping lists. This mission stays inside the allowed lane.
What about GDPR consent? I thought you always needed it.
Consent is one lawful basis, not the only one. For B2B prospecting the usual basis is legitimate interests, which needs a documented balancing test (the kit has one filled in). PECR separately decides whether the message itself needs consent, and for corporate subscribers it doesn't. You need both to line up, which they do for limited companies and LLPs.
Still stuck? Ask the community
Next mission · Make money with AIBuy, refurbish and resell laptops for profit
→