Quick answer
Yes, direct mail can be fully GDPR compliant, and in most cases you do not need consent to send it. Marketing by post is not covered by PECR, the rules that require consent for most marketing emails and texts. Under UK GDPR you still need a lawful basis, and for postal marketing that is usually legitimate interests, backed by a documented legitimate interests assessment (LIA). You must also tell people how you use their data, screen against your own suppression list and the Mailing Preference Service, and stop mailing anyone who objects. The right to object to direct marketing is absolute.
Key takeaways
- The ICO's guidance is clear: direct marketing by post is not covered by PECR, so the consent rules for email and text do not apply to letters.
- The likely lawful basis for postal marketing is legitimate interests or consent. Legitimate interests still needs the three-part test: purpose, necessity and balancing.
- Since the Data (Use and Access) Act 2025, UK GDPR names direct marketing as an example of a legitimate interest. It is not a 'recognised legitimate interest', so the balancing test still applies.
- Anyone can object to direct marketing at any time, and you must stop. You can keep their details on a suppression list so they are not mailed again.
- When you use a mailing house, you are usually the controller and it is your processor. UK GDPR requires a written contract between you.
Does GDPR stop you sending direct mail?
No. Two sets of rules apply to marketing in the UK. UK GDPR (with the Data Protection Act 2018) covers any use of personal data, including names and addresses on a mailing list. The Privacy and Electronic Communications Regulations (PECR) add extra rules for marketing by phone, email, text and other electronic channels. The ICO's direct marketing guidance states that direct marketing by post is not covered by PECR. That means the consent requirements most people associate with GDPR, which actually come from PECR, do not apply to a letter.
| Channel | PECR applies? | Likely lawful basis (ICO) |
|---|---|---|
| Addressed post | No | Legitimate interests or consent |
| Live phone calls | Yes (TPS screening rules) | Legitimate interests or consent |
| Email and text to individuals | Yes (consent or soft opt-in) | Consent or legitimate interests |
| Partially addressed mail and door drops | No | No personal data on the item; customer data used for targeting still needs a lawful basis |
General guidance, not legal advice
This guide summarises ICO guidance and UK legislation as at October 2026. It is not legal advice. For decisions about your own data, take advice from your data protection officer or a qualified adviser.
Legitimate interests for direct mail
UK GDPR offers six lawful bases. For postal marketing the ICO says the realistic choices are consent or legitimate interests. Most organisations use legitimate interests for mailing existing customers or supporters, because a relevant letter has a low privacy impact and is something people would reasonably expect. The ICO's own example is a theatre that mails past customers about its new season under legitimate interests and includes opt-out details.
Legitimate interests is not automatic. The ICO expects you to carry out and record a legitimate interests assessment (LIA) covering three tests:
- 1
Purpose test
Is there a legitimate interest behind the mailing? Telling customers about relevant products, or asking supporters to donate, normally qualifies.
- 2
Necessity test
Is using their personal data necessary for that purpose, and is mailing a reasonable way to achieve it? Using only the data you need helps here.
- 3
Balancing test
Do the person's interests, rights and freedoms override yours? Consider whether they would expect the mailing, how they gave you their details and whether any of them are vulnerable.
The Data (Use and Access) Act 2025 amended UK GDPR to list direct marketing as an example of processing that may be a legitimate interest. The ICO's updated guidance (March 2026) is explicit that you must still do the three-part test, because legitimate interests will not apply automatically. Direct marketing is not one of the new 'recognised legitimate interests' that skip the balancing test.
Cold lists need extra care
Mailing people who have never dealt with you is harder to justify on the balancing test than mailing your own customers. If you buy or rent data, check how it was collected, what people were told and whether it was screened. For prospecting without personal data, look at partially addressed mail.
Privacy information, objections and suppression
Whatever lawful basis you use, people must be told that you will use their details for postal marketing. That normally goes in the privacy notice they see when you collect their data. The ICO's planning guidance asks you to check that people know you want to use their information for postal marketing before you send.
Under Article 21 of UK GDPR, anyone can object to direct marketing at any time, and once they do, their data must no longer be processed for that purpose. Unlike other objections, there are no grounds to refuse. The ICO says organisations must respond within one calendar month.
Data screened and cleaned before anything is printed
PAF validation, de-duplication, gone-away suppression and MPS suppression, carried out in our ISO 27001-certified environment.
Explore the serviceController and processor: working with a mailing house
When you send your data to a mailing house to print and post your campaign, you normally remain the controller: you decide why and how the data is used. The mailing house acts as your processor, using the data only on your instructions. The ICO's guidance uses this exact situation, a firm hired to address, fill and send letters, as an example of a processor.
Article 28 of UK GDPR requires a written contract (or other legal act) whenever a controller uses a processor. The contract must cover, among other things:
| Article 28 requirement | What it means for a mailing |
|---|---|
| Documented instructions | The mailing house uses your list only for the campaign you have specified |
| Confidentiality | Staff handling the data are bound by confidentiality |
| Security (Article 32) | Appropriate technical and organisational measures, such as secure transfer and access controls |
| Sub-processors | No subcontracting without your authorisation, and equivalent terms if it happens |
| Help with rights requests | Support when someone exercises a right, such as an objection |
| Deletion or return | Your data is deleted or returned when the job ends, at your choice |
| Audits | Information to demonstrate compliance, and co-operation with audits |
At Fretwell we are registered with the ICO, certified to ISO 27001 for information security, and happy to sign a data processing agreement. Data comes to us over secure SFTP, is encrypted in transit and at rest, is used only for your campaign and is securely destroyed at the agreed point. Our certifications page has the certificates, and what a mailing house does explains the rest of the process.
Sources
- ICO – Plan direct marketing (postal marketing, MPS and suppression lists)
- ICO – Sending direct marketing: choosing your lawful basis
- ICO – Legitimate interests (updated 23 March 2026)
- ICO – The Data (Use and Access) Act 2025: summary of the changes to data protection
- ICO – The right to object to the use of your data
- ICO – Contracts between controllers and processors
- legislation.gov.uk – UK GDPR Article 21 (right to object)
- legislation.gov.uk – UK GDPR Article 28 (processor)
- DMA – Mail Preference Service
