What is the PECR soft opt-in?

The soft opt-in is a limited exception that can allow electronic marketing about similar products or services to certain existing customers where the required conditions are met, including a clear opt-out opportunity when details were collected and in each message.

Does LeadRestore decide whether I am legally allowed to contact someone?

No. LeadRestore helps prioritise old opportunities and suggests follow-up wording. The business using LeadRestore remains responsible for lawful basis, PECR compliance, retention, suppression and deciding whether contact is appropriate.

UK database reactivation compliance

Can you reactivate old leads under UK GDPR and PECR?

Q: Can I email or text old leads in the UK?

Sometimes, but not simply because their details are already in your CRM. UK GDPR and PECR can both apply. For electronic marketing to individuals, you generally need consent unless the limited soft opt-in conditions are met. You should also check opt-outs and the original context in which the details were collected.

Q: Does legitimate interests mean I can contact every old lead?

No. Legitimate interests can be relevant to direct marketing under UK GDPR, but it does not override PECR where PECR requires consent. The processing also needs to be proportionate and consistent with people's reasonable expectations.

Old enquiries can still contain genuine sales opportunities, but having someone in a CRM does not automatically mean you can market to them again. Before email, SMS or other reactivation outreach, check the original relationship, the contact channel, consent or other applicable rules, opt-outs and the person’s reasonable expectations.

Published 14 September 2026 · LeadRestore practical guide · Not legal advice

The short answer: audit the record before you reactivate it.

UK database reactivation can involve two overlapping rule sets. UK GDPR governs how personal information is processed, while PECR contains additional rules for electronic marketing channels such as email and text messages.

The ICO says organisations need a valid data-protection reason for direct marketing and must also comply with the relevant PECR rules. For electronic marketing to individuals, consent is generally required unless a limited exception such as the soft opt-in applies.

Important: an old enquiry is not automatically an “existing customer” for every purpose. Do not treat the age of the record, the fact that somebody once filled in a form, or the fact that their details remain in your CRM as permission to contact them.

Practical checklist

Seven checks before old-lead outreach.

Identify who the record belongs to.Is this an individual consumer, sole trader, partnership, or a contact at a limited company? The electronic-marketing rules can differ depending on the recipient.

Identify the channel you plan to use.Email, SMS, phone and other channels do not all have identical rules. Decide the channel before deciding whether the outreach is appropriate.

Check how the details were originally collected.Look at what the person enquired about, what privacy information they saw, whether they bought or genuinely negotiated to buy, and what marketing choices were offered at the time.

Check PECR before relying on UK GDPR alone.Legitimate interests can sometimes be relevant to direct marketing, but it does not remove a PECR consent requirement where one applies.

Check consent, soft opt-in and similarity carefully.The ICO describes the soft opt-in as a limited exception for certain existing-customer situations involving similar products or services and required opt-out opportunities. Do not stretch it to cover a record that does not meet the conditions.

Suppress objections and opt-outs first.People have the right to object to direct marketing. Keep suppression information so somebody who has opted out is not accidentally added back into a reactivation list later.

Use human review before anything is sent.Check whether the message is expected, proportionate and relevant to the original context. A strong commercial signal does not turn an unsuitable contact into a suitable one.

What does the PECR “soft opt-in” actually mean?

The soft opt-in is not blanket permission to email or text an old database. The ICO explains that it can apply where a person previously bought, or negotiated to buy, a similar product or service from you and was given a simple way to opt out when their details were collected and in every subsequent marketing message.

For lead reactivation, the safest operational approach is to store enough context to answer the important questions rather than relying on a CRM stage called “old lead”. What was the original enquiry? Was there a genuine sales negotiation? What channel is proposed? Was an opt-out offered? Has the person objected since?

UK GDPR legitimate interests is not a PECR shortcut.

The ICO says direct marketing may sometimes fall within legitimate interests, but the processing still needs to be necessary, proportionate and balanced against the individual’s rights and reasonable expectations.

Crucially, if PECR requires consent for the marketing channel and recipient, choosing legitimate interests under UK GDPR does not cancel that requirement. This is why a lead-recovery process should separate commercial priority from contact suitability.

Commercial question

Does this old enquiry still show signs of unfinished intent, value, relevant timing or a sensible next step?

Compliance question

Do we have an appropriate basis and channel to contact this person, with opt-outs and other restrictions respected?

What about B2B old leads?

There are differences for business-to-business marketing. The ICO notes that the PECR electronic-mail rule does not apply in the same way to corporate subscribers, but UK GDPR can still apply when you process personal information about an identifiable business contact.

That does not mean every B2B database is fair game. You still need to be transparent, have an appropriate lawful basis where personal data is involved, respect objections and distinguish corporate contacts from recipients treated more like individuals under PECR.

How LeadRestore fits

Prioritisation first. Outreach stays under your control.

LeadRestore is designed to help a business review old enquiries, quotes and dormant opportunities and identify which records may deserve another look. It can suggest a possible next action and follow-up message, but it does not decide that contact is legally permitted and it does not automatically send the message.

That separation is deliberate. The useful workflow is: remove obvious exclusions, prioritise the commercially relevant records, review contact suitability and only then decide whether to follow up.

Database reactivation software guide Lead reactivation software How LeadRestore works Security & data handling

Audit My Old Leads for Free

Official UK guidance used for this article.

This page is a practical summary, not legal advice. For decisions about your own data and campaigns, use the ICO’s current guidance and obtain professional advice where appropriate.

Old lead reactivation FAQs.

Can I email or text old leads in the UK?

Sometimes, but not simply because the details are already in your CRM. UK GDPR and PECR can both apply. Check the recipient, channel, original context, consent or any applicable exception, and opt-outs before contacting anyone.

Does legitimate interests mean I can contact every old lead?

No. Legitimate interests can be relevant in some direct-marketing situations, but it does not override PECR where PECR requires consent. You also need to consider necessity, proportionality and reasonable expectations.

Does LeadRestore automatically decide who can legally be contacted?

No. LeadRestore provides lead-recovery decision support. Your business remains responsible for lawful basis, PECR, retention, suppression and the final contact decision.