UK Email Guidance
Why ICO Registration Matters for UK Email Senders
It costs £40, takes 15 minutes, and skipping it is a criminal offence. If you send marketing email in the UK and you're not registered with the ICO, this is for you.
What the ICO is
The ICO is the UK's data regulator. They investigate complaints, audit organisations, and issue fines - and they genuinely use those powers. 2025 saw over a million pounds in direct marketing penalties handed out, and plenty of those went to small businesses, not just big corporates. If your company touches personal data - email addresses included - they have authority over you.
Post-Brexit, the UK switched from EU enforcement to the ICO enforcing the Data Protection Act 2018 and the UK GDPR. The rules themselves didn't change much. The enforcement body did.
Do you need to register?
If you're doing any kind of email marketing, yes. Full stop. The moment you're deciding how and why to process personal data, you're a data controller - and controllers are legally required to register and pay the annual fee. Doesn't matter if you're a freelancer with a 50-person mailing list. Doesn't matter if the emails are just a monthly newsletter.
The exemptions are narrow: purely personal use (your own contacts list on your phone), some specific elected representative roles, a handful of others. Running any kind of commercial operation doesn't qualify.
How registration works
Head to ico.org.uk/registration, answer about a dozen questions, pay the fee. Genuinely quick. The 2026 fee bands:
- £40/year - under 10 staff or turnover below £632k (most small businesses)
- £60/year - medium-sized organisations
- £2,900/year - 250+ employees or turnover above £36m
Charities pay £40 regardless. Pay by direct debit, you save £5. You'll get a reference number - stick it in your privacy policy so people can verify it. Renews annually; set a reminder because the renewal email is easy to miss.
What happens if you don't
Non-registration is a criminal offence under the Data Protection Act. Not a civil matter - criminal. Fixed penalty of £400, or up to £4,000 via a magistrates' court. That's the legal end of things.
More practically: if a complaint about your email marketing lands with the ICO and they start looking at your operation, being unregistered is the worst possible first impression. It signals you haven't engaged with data protection at all. That mindset tends to show up in other places too, which only makes things worse.
Registration is a commitment, not a one-off
Once you're on the register, you're publicly stating you handle data properly. That means your lists stay accurate, unsubscribes get processed, and you don't hoard contact data you no longer need. Got a list that hasn't been cleaned since before 2023? That's a real UK GDPR issue - the accuracy principle says personal data should be kept up to date. Old addresses that bounce are a signal you're not doing that.
Verifying addresses at sign-up and running periodic hygiene checks is how you stay on the right side of this. It also creates useful evidence: if the ICO ever asks about your practices, being able to show a history of active list maintenance is far better than explaining why you haven't touched a list in years.
Things to actually do
- Register now if you haven't - ico.org.uk/registration, 15 minutes
- Add your reference number to your privacy policy
- Diarise the renewal date - it's annual and easy to miss
- Verify addresses at the point they come in, before bad data gets into your list
- Review old lists every 6 months - flag anything that hasn't engaged or is bouncing
- Note down the lawful basis for each type of data you hold, even briefly
- Process unsubscribes fast - same day is best, definitely before the month is out
Related reading
MailVerify
UK email verification that doesn't cut corners.
ICO registered (ZC112021), all data on GB servers, never stores your lists. That's not marketing — it's how the API works.