Marketing automation in the UK: the PECR rules that matter

Short answer: Marketing automation means software that sends the follow-up, reminder or offer a UK small business would otherwise forget to send, triggered automatically by what a customer does. It is worth it for most small businesses with an existing customer list, because the return comes from bookings and sales that would otherwise slip through, not from new leads. The part most guides skip is that PECR, not UK GDPR, decides whether you are even allowed to send the message in the first place, and since 5 February 2026 getting that wrong carries the same maximum fine as a serious UK GDPR breach: up to £17.5 million or 4% of global turnover.

Most small businesses in the UK already have the customer list that would make marketing automation pay off. What they do not have is time to act on it. A hairdresser knows which regulars have not rebooked in ten weeks. A plumber knows which quotes went quiet after the second call. A physiotherapist knows which patients never came back for the follow-up session that was recommended. None of that requires new customers or a bigger advertising budget. It requires someone, or something, to notice and send a message at the right moment, every time, without being reminded.

That is the entire job marketing automation does. It is not a bigger version of email marketing, and it is not the same thing as advertising. It is a small number of triggered messages, set up once, that keep firing on their own. For a UK small business, the part that decides whether any of this is legal to run sits in a different piece of law to the one most people reach for first. This guide covers what automation actually means, why PECR rather than UK GDPR governs whether you can press send, the soft opt-in exemption most small businesses already qualify for, a worked example, real platform choices, and what it costs to run properly. For the traffic side of this, see our guide to SEO, AEO and GEO in the UK, and for the enquiry-handling side, our guide to AI lead generation in the UK covers the moment before a contact even joins your list.

What marketing automation actually means for a UK small business

Strip away the software marketing and there are really only four things worth automating for most small businesses: a welcome sequence when someone becomes a customer, a reminder when a booking or renewal is due, a nudge when someone has gone quiet, and a request for a review once a job is finished. Each is triggered by an event, not a calendar date, which is what separates automation from a newsletter. A newsletter goes out to everyone on a schedule you set; an automated sequence goes out to one person because they did something, whether or not you remembered.

This matters because the value is concentrated in moments that are easy to lose in the day-to-day. A salon that reminds a regular client at exactly the point their usual gap between visits has passed will win back appointments that a monthly newsletter never would, because the timing is personal to that client rather than generic to the whole list. The same logic applies to a tradesperson chasing a quote, a clinic booking a follow-up, or a shop asking a first-time buyer to come back for a second purchase.

None of this needs to be complicated on day one. A single welcome message and a single re-engagement nudge, built properly, will outperform an elaborate ten-step sequence that nobody has checked against the rules below.

PECR, not UK GDPR, decides whether you can press send

This is the point most small businesses get backwards. UK GDPR governs the personal data itself: the lawful basis for holding it, how long you keep it, and what rights the person has over it. PECR, the Privacy and Electronic Communications Regulations, governs something different: the channel, whether you are allowed to contact someone by email, text or automated call for marketing at all. The ICO enforces both, but they are separate tests, and a business can be compliant with one and not the other.

In practice a sequence has to clear two hurdles. UK GDPR asks whether you have a lawful basis to hold the data and are handling it properly. PECR asks a narrower, more immediately dangerous question for most small businesses: do you have consent, or a valid exemption, to send this specific message through this specific channel. A business can hold a customer’s email address entirely lawfully under UK GDPR and still breach PECR the moment it sends a marketing message without consent or an exemption.

Most compliance attention goes to UK GDPR, a cookie banner, a privacy policy, a retention note. PECR gets skipped because it feels like the smaller, older piece of law. It is not smaller in consequence. It decides, message by message, whether the automation you are about to switch on is something you are actually allowed to do.

The soft opt-in exemption, and how to actually use it

Full marketing consent, a separate tick box asking someone to agree to receive marketing, is the clean route but not the one most small UK businesses run on. Most rely, correctly, on the soft opt-in exemption in PECR regulation 22, which applies when three conditions are all true at once.

First, the contact’s details were obtained in the course of a sale, or negotiations for a sale. A customer who booked a service, bought a product, or got as far as a quote before dropping out all qualify. A name bought from a list broker does not.

Second, only similar products or services to the ones involved in that original sale are being marketed. A salon that sold someone a haircut can email them about colour treatments or a loyalty scheme, but cannot use the same basis to promote an unrelated sideline it has just started selling.

Third, the customer was given a clear, working opt-out both when their details were collected and in every message sent since. This is the condition automated sequences most often fail, not because the first message lacks an opt-out, but because message three or four of a chain gets built from a template that quietly drops it. A five-message sequence with an opt-out on the first message and none on the rest does not satisfy regulation 22, even though it looks, at a glance, like it should.

Get all three right and a small business can run a genuinely useful sequence to its whole existing customer base without a separate consent campaign. Get the third wrong and the whole sequence loses its legal basis. For how the rule sorts a real contact list, with sole traders, bought lists and texts included, see who you can email and text under PECR.

What a defensible consent record looks like under PECR

Having a valid basis to market to someone and being able to prove it later are two different things. A defensible record needs four pieces held together, not scattered across systems.

The first is a timestamp of exactly when the contact was added. The second is the specific source, a sale, an enquiry, a sign-up form, recorded precisely rather than as a general note. The third is the exact wording shown to the person at that moment, including any consent or opt-out text, ideally kept as a screenshot rather than paraphrased months later from memory. The fourth is a live log of opt-outs, updated the instant someone unsubscribes, because continuing to message someone who has opted out is its own separate breach.

Most CRM and email platforms hold the first, second and fourth automatically once set up correctly. The third, the exact wording shown at the point of collection, is the one businesses most often forget, because the sign-up form gets redesigned months later and nobody kept a copy of what it said when the customer agreed to it.

The ICO’s fine exposure since 5 February 2026

This is the change that should move PECR from a background item to something a small business owner actually checks. The Data (Use and Access) Act 2025 raised the maximum fine for serious PECR breaches, from 5 February 2026, to match the existing UK GDPR maximum: up to £17.5 million or 4% of annual global turnover, whichever is higher. Before that date, PECR penalties sat in a materially lower bracket, which is part of why a lot of small business automation was set up and never revisited.

The point that matters for a five-person business rather than a large enterprise is not the headline figure, which will never realistically apply at that scale. It is that enforcement and the size of a proportionate fine both scale with the size of the breach and the harm caused, not the size of the business committing it. A small business running an automated sequence without a working opt-out on every message is not shielded by being small; it is simply less likely to attract attention until a complaint is made, and one complaint is enough to trigger a look at the whole sequence.

The practical response is to audit once. Pull up every sequence running, check its legal basis against the soft opt-in test above, and confirm every message carries a working opt-out. That is a half-day task for most small businesses, and skipping it is now a materially larger gamble than it was a year ago.

What to switch on first

Do not build the full sequence set on day one. Start with the message that has the clearest legal basis and the highest return.

For most UK small businesses that is the re-engagement nudge to an existing customer who has gone quiet: a client who has not rebooked, a buyer who has not returned, a patient who missed a follow-up. The legal basis is usually the cleanest of any automation, because the contact came directly from a sale and the message concerns the same or a similar service. The return is usually the fastest to see too, because you are recovering revenue you would otherwise have lost, not generating something new.

Once that is running and proven, add a welcome sequence for new customers, which carries the same clean legal basis. Only after both are settled should a business add anything closer to general marketing, because that is where the soft opt-in test needs the most careful checking, and genuine consent may be the safer basis to collect from the outset for anything beyond the original relationship.

A worked example: a Leeds salon closes its follow-up gap

A six-chair hair and beauty salon in Leeds had a customer database of around two thousand clients, almost all of it collected at the till during booking. Rebooking relied entirely on clients remembering to call, and the salon could see, from its own booking software, that a meaningful share of regulars drifted off after eight to twelve weeks without anyone noticing until they had gone quiet for months.

The first automation built was a single triggered message: when a client passed their usual gap between visits without a new booking on the calendar, they received a short message offering an easy way to rebook. The legal basis was straightforward soft opt-in: every contact came from an actual booking, the message concerned the same haircut and colour services the client already bought, and the salon added a clear opt-out to its booking confirmation text as well as the automated message itself, closing the gap regulation 22 requires across every message.

Within the first two months, a noticeable share of clients who received the nudge rebooked within a week, recovering appointments that would otherwise have lapsed. The salon then added a second sequence: a review request sent two days after a visit, resting on the same clean basis because it concerned the service just received. Nothing more elaborate was added until both were running smoothly and the opt-out records were confirmed working.

Picking a platform: HubSpot, Klaviyo or Brevo

Three platforms come up repeatedly for UK small businesses, and they suit different situations rather than competing head to head on the same job.

HubSpot combines CRM, a sales pipeline and marketing automation in one system, suiting a business that wants a single place to manage customers and the sequences that follow, particularly one managing quotes and follow-ups alongside marketing. Its pricing scales with contact count and feature tier, so cost it out at the list size you expect to reach in a year.

Klaviyo is built around purchase and browsing behaviour, the stronger fit for a business selling through an online shop, particularly one running on Shopify, because its automation triggers from cart activity and purchase history rather than a CRM record.

Brevo, formerly Sendinblue, suits a smaller business on a tighter budget that mainly needs email, SMS and straightforward automation without paying for a full CRM it will not use. It operates EU data centres by default, which matters under UK GDPR’s rules on transferring data outside the UK, since data held within the EU faces a simpler transfer position than data held solely in the US. Check where any shortlisted platform’s data centres sit and what transfer safeguards it offers before committing.

None of the three removes the PECR question. A platform can have an excellent opt-out mechanism built in and a business can still send the wrong message to the wrong list if the underlying consent basis was never checked. For a fuller comparison, including the UK-built option and the data transfer and VAT checks, see which marketing automation platform suits a UK small business.

What marketing automation costs in the UK

Entry-level platforms typically run £15 to £100 a month, depending mainly on list size rather than features, since most price by contact count once you pass a free-tier threshold. A done-for-you setup, someone else building and configuring the sequences rather than you piecing them together, usually costs £1,200 to £3,500 as a one-off, depending on how many sequences are built and how much existing data needs cleaning up first. Ongoing management, paying someone to maintain and improve the sequences rather than running them in-house, commonly adds £300 to £800 a month.

One cost that catches small businesses out is VAT. If turnover sits below the registration threshold and the business has not registered voluntarily, VAT charged on a subscription cannot be reclaimed, so the advertised price is the real price in a way it is not for a larger, VAT-registered competitor. To test these prices against your own hours and jobs, see whether marketing automation is worth it in the UK.

What to check once the automation is live

Three numbers matter once a sequence is running: the response rate to the trigger, the share who rebook, reply or buy, which shows whether it is recovering the revenue it was built to recover; the opt-out rate, which should stay low and stable, since a rising rate on a soft opt-in sequence often signals the messaging has drifted from “similar products or services” into general marketing; and whether every message in every active sequence still carries a working opt-out, checked periodically rather than assumed, since platform updates have a habit of quietly breaking this.

Revenue recovered justifies the investment. The other two keep it legal.

Mistakes that quietly undo the return, or the compliance

The most common mistake is building a long sequence from a template without checking that every message, not just the first, carries a working opt-out. The soft opt-in exemption is tested message by message, and a single missing opt-out several messages in can undo the legal basis for the whole sequence.

The second is drifting from similar products into general marketing without noticing. A salon promoting the same haircut services it always has, then adding a retail range under the same sequence without checking whether that still counts as similar, has moved outside the basis it started with.

The third is treating a platform’s built-in compliance features as sufficient on their own. A tool can offer a one-click unsubscribe and still be sending to a list where half the contacts never should have been added under a soft opt-in basis. It enforces what you configure; it does not check whether the underlying consent basis was ever valid.

The fourth is never automating anything because the legal side feels too complicated. A single, correctly built sequence with one working opt-out is safer, and more valuable, than no automation built out of caution that was never tested against the rules.

Who this suits, and who should wait

This is worth doing now for a business with an existing customer list of a few hundred contacts or more, a repeat-purchase or repeat-booking pattern, and a visible gap between how often customers should return and how often they actually do. Salons, clinics, trades businesses, shops and professional services firms with recurring client relationships tend to fit this shape closely.

It is worth waiting on if the list is very small, under a hundred contacts, where a personal message from the owner will outperform any automated sequence. It is also worth pausing on if the business cannot say, with confidence, where its customer data came from and whether it has records to support a soft opt-in basis, because building automation on an unclear consent position multiplies the compliance risk. Spend the half-day sorting the records first; the automation is the easy part once that foundation is in place. If you are still deciding where AI fits in your marketing more broadly, our guide to AI marketing for UK small businesses sets out what pays first and what to skip. This is the same groundwork we check before setting up AI automation for a client, and it pairs naturally with digital advertising for businesses that need new enquiries feeding the list.

Frequently asked questions

What is marketing automation, and is it worth it for a UK small business? Marketing automation is software that sends the follow-up, reminder or offer you would otherwise forget to send, triggered by something a customer does, such as buying, enquiring or going quiet. It is worth it for most UK small businesses with an existing customer list and a repeat-purchase or repeat-booking pattern, because the return comes from bookings and sales that would otherwise be forgotten. The catch is it only pays off if it is built on a proper PECR basis from the first message, not bolted on afterwards.

Does sending an automated marketing email require consent under PECR? For most business-to-consumer marketing by email or SMS, yes, PECR requires either consent or a specific exemption. The main exemption a small business can rely on without collecting separate consent is the soft opt-in under PECR regulation 22, which applies when the contact came from a genuine sale, only similar products or services are marketed, and a clear opt-out was offered at collection and in every message since.

What is the soft opt-in exemption under PECR regulation 22? It lets a business market its own similar products or services to an existing customer without a separate consent tick box, provided three conditions hold together: the details were collected during a sale or sale negotiation, only similar products or services are being marketed, and the customer was given a clear, working way to opt out both at collection and in every message since. Miss any one of the three and the exemption does not apply.

How much can a PECR breach cost since 5 February 2026? Up to £17.5 million or 4% of annual global turnover, whichever is higher. That figure comes from the Data (Use and Access) Act 2025, which raised the maximum fine for serious PECR breaches, from 5 February 2026, to match the existing UK GDPR maximum. Before that date PECR breaches sat in a lower fine bracket, which is why a lot of small business automation was never audited properly.

What should a defensible consent record include? A timestamp of when the contact was added, the specific source such as a sale, an enquiry form or a newsletter sign-up, the exact wording shown at that point including any opt-out text, and a record of whether and when they later opted out. Screenshots of the sign-up form or checkout step, kept alongside the record, close most of the gap between having consent and being able to prove it if the ICO ever asks.

What does marketing automation cost for a UK small business? Entry-level platforms typically run £15 to £100 a month depending on list size. A done-for-you setup, built and configured by someone else, usually costs £1,200 to £3,500. Ongoing management, if you pay someone to run it rather than running it in-house, commonly adds £300 to £800 a month.

Which platform should a UK small business choose, HubSpot, Klaviyo or Brevo? There is no single right answer, because the three suit different situations. HubSpot suits a business that wants CRM, sales pipeline and automation in one place and can absorb its pricing as the list grows. Klaviyo suits an e-commerce business selling through Shopify, because its automation is built around purchase behaviour. Brevo suits a smaller business on a tighter budget that mainly needs email, SMS and simple automation, and it holds EU data centres by default, which UK GDPR transfer rules treat more simply than a US-only host.

---

Want your existing customer list checked against PECR before you switch on a single automated message? Get a free marketing audit. No jargon, no pressure.