Direct Mail and Data Protection: What’s Allowed Under Legitimate Interests?
If you’re planning a direct mail campaign, one of the first questions to ask is whether you’re allowed to send it. The answer, in most cases, is yes. But you need to be able to show why you’re allowed to, and that means understanding how UK data protection law treats postal marketing.
The rules have been in the news lately, thanks to the Data (Use and Access) Act 2025, whose data protection provisions the ICO says are now all in force. Here’s what it means for anyone sending addressed mail.
Postal marketing and PECR: the key difference
Many marketers confuse the two main pieces of legislation.
- PECR (the Privacy and Electronic Communications Regulations) covers electronic marketing: phone calls, emails, texts and similar. These channels often require specific consent.
- The UK GDPR and the Data Protection Act 2018 cover how you use personal data in general, including names and addresses used for mailing.
The ICO is clear that PECR’s marketing rules don’t apply to mailshots, but that you must still comply with the UK GDPR when you send them. In practice, that means you need a valid lawful basis for using people’s details to send addressed direct mail. For postal marketing, the ICO’s guidance says the lawful basis will usually be either consent or legitimate interests.
For many businesses, legitimate interests is the more practical choice, which is why it’s worth understanding properly.
What are ‘legitimate interests’?
Legitimate interests is one of the six lawful bases for processing personal data under the UK GDPR. It applies when you use someone’s data for a genuine business purpose, and your use of it isn’t outweighed by the individual’s own interests, rights and freedoms.
The ICO breaks this down into a three-part test:
- Purpose: Is there a legitimate interest behind what you’re doing? Marketing your products or services can be one.
- Necessity: Is using personal data actually necessary to achieve that purpose, or could you reasonably do it another way?
- Balancing: Do the individual’s interests, rights or freedoms outweigh your interest? You need to consider what they’d reasonably expect, and how much of an impact the mailing could have on them.
The Data (Use and Access) Act 2025 has made it clearer that direct marketing can be a legitimate interest. It now appears in the legislation as an example of a purpose that may qualify. That removes some of the previous ambiguity, but it isn’t a blanket permission. You still have to carry out the balancing test and be able to show that you did.
What this means in practice
Document your assessment. Keep a short written record (often called a Legitimate Interests Assessment, or LIA) showing what the purpose is, why mailing is necessary, and how you weighed up the individual’s interests. If anyone, including the ICO, asks why you mailed a particular list, you’ll have an answer ready.
Think about expectations. A mailing to existing customers about products similar to those they’ve bought is easier to justify than a mailing to people who’ve had no contact with you and wouldn’t expect to hear from you. The further you move from an existing relationship, the more carefully you need to weigh things up.
Be transparent. Your privacy notice should explain that you use personal data for direct marketing, what lawful basis you rely on, and how people can object. If you’ve obtained data from a third party, you also need to ensure individuals are told about this.
Respect the right to object. For direct marketing, the right to object is absolute. If someone tells you they don’t want your mail, you must stop using their data for marketing purposes. There’s no balancing test and no exceptions. Make sure you can act on requests quickly and that suppressions are applied to every future campaign, not just the next one.
Bought and rented lists: take extra care
Using a third-party list doesn’t pass the responsibility on to someone else. If you’re mailing rented or purchased data, you should check:
- Where and how the data was originally collected
- Whether individuals were told their details could be used for third-party marketing
- That the data is up to date and has been screened against suppression files
- That the list owner can demonstrate compliance
Reputable list providers should be able to answer these questions straightforwardly. If they can’t, treat that as a red flag.
Suppression: the Mailing Preference Service and your own lists
It’s good practice (and a cornerstone of responsible direct marketing) to screen consumer data against the Mailing Preference Service (MPS), the free service run by the Data & Marketing Association that lets people opt out of unaddressed and addressed advertising mail. You should also suppress against your own opt-out lists and, where relevant, deceased and gone-away files.
Suppression isn’t just about compliance. Every piece that goes to someone who doesn’t want it is wasted print and postage, and it can harm your brand. We cover this in more detail in our guide to keeping your data clean. [See: How to keep your Direct Mail data clean]
B2B mailing
Marketing by post to a named individual at a business is still personal data processing, so the UK GDPR applies. Legitimate interests is usually the most appropriate lawful basis, provided the mailing is relevant to the person’s role and you’ve carried out the balancing test. Mail addressed generically to a company or job title rather than a named person is less likely to involve personal data, but it’s worth checking exactly how your data is held.
Where does your mailing house fit in?
As a mailing house, we typically process your data on your behalf and under your instructions, so the decision about lawful basis, and responsibility for it, sits with you as the organisation sending the mail.
What we can do is help you get the practical side right: cleaning and formatting your data, applying suppression files, and keeping your records tidy, ready to be presented in the most professional manner. We can also offer a returns data-capture service to deal with mail returned to us as either a ‘goneaway’ or removal request (both of which should be removed from your dataset).
A quick checklist before you mail
- Have you identified and recorded your lawful basis?
- If relying on legitimate interests, have you completed and kept an assessment?
- Does your privacy notice cover direct marketing, and is it easy to find?
- Have you screened against MPS, your own opt-outs and other relevant suppression files?
- If using third-party data, have you checked where it came from and what people were told?
- Can you act promptly if someone objects?
Talk to us
Getting your data right before a campaign protects your budget as well as your reputation. If you’d like help preparing your data or scheduling a campaign, our team is here to help.
This article is intended as general guidance and isn’t legal advice. If you’re unsure about your obligations, speak to a qualified professional or consult the ICO’s guidance at ico.org.uk.