{"id":1859,"date":"2026-04-25T14:51:52","date_gmt":"2026-04-25T13:51:52","guid":{"rendered":"https:\/\/www.duport.co.uk\/blog\/?p=1859"},"modified":"2026-04-25T15:11:48","modified_gmt":"2026-04-25T14:11:48","slug":"can-i-add-contact-form-leads-to-my-mailing-list-uk-gdpr","status":"publish","type":"post","link":"https:\/\/www.duport.co.uk\/blog\/can-i-add-contact-form-leads-to-my-mailing-list-uk-gdpr\/","title":{"rendered":"Can I Add Contact Form Leads to My Mailing List? UK GDPR"},"content":{"rendered":"

Can I Add Contact Form Leads to My Mailing List? UK GDPR<\/h1>\n

Short answer: no, not unless they specifically opted in to marketing at the time they contacted you.<\/p>\n

It\u2019s a mistake a lot of small UK businesses make, often without realising. And once you spot it, it\u2019s usually straightforward to put right.<\/p>\n

Does filling in a contact form give permission for marketing emails?<\/h2>\n

No, a contact form submission just gives you permission to reply to that enquiry, nothing more (even though it can feel like a warm lead).<\/strong><\/p>\n

When someone fills in your contact form, asking for a quote or more details, they\u2019re expecting a reply to that specific question. Their lawful basis under UK GDPR is \u2018legitimate interests\u2019. Yours is to reply; theirs is to get an answer. That basis only covers the response. It doesn\u2019t extend to adding them to your newsletter, sending follow-up offers, or dropping them into an automated email sequence. As soon as you move beyond replying and start sending marketing emails, you\u2019ll need separate, explicit consent.<\/p>\n

The full picture of what UK GDPR requires for your contact form is in How to Make Your Small Business Website GDPR Compliant.<\/a><\/p>\n

What does proper consent for email marketing look like?<\/h2>\n

In simple terms, consent needs to be a clear, active choice, not something implied or buried in small print.<\/strong><\/p>\n

In practice, that usually means adding a simple, unticked checkbox with clear wording. Something like: ‘Tick here if you’d like to receive marketing emails from us.’ It must be separate from the submit button. The person actively ticks it. You\u2019ll need a record of when and how they opted in. Consent can be withdrawn at any time, so every marketing email needs an unsubscribe link.<\/p>\n

Bundled consent doesn\u2019t meet this standard, even though you\u2019ll still see it on plenty of websites. Writing ‘by contacting us you agree to our terms’ does not give you permission to email people for marketing purposes.<\/p>\n

I’ve already been adding people to my list without consent. What do I do?<\/h2>\n

First, stop adding new contacts without consent. Even if you\u2019ve been doing it for a while, it’s better to fix it now than later. Then decide what to do with the people already on your list.<\/strong><\/p>\n

In reality, it usually comes down to two options. First, send a re-permission email. Tell them you are reviewing your mailing practices and what you will be sending. Ask them to click a link to confirm they want to stay on the list. If they ignore it, you\u2019ll need to remove them \u2014 which often surprises people. Second, if you have recent customers who bought similar services, you may be able to rely on the ‘soft opt-in’ rule under PECR. This allows you to email existing customers about similar services. For example, you might follow up a company formation purchase with related compliance services. Every message must include a clear opt-out. Speak to a data protection specialist if you are unsure which route applies.<\/p>\n

Does legitimate interests cover email marketing?<\/h2>\n

For most small businesses, no. Legitimate interests isn\u2019t a safe basis for marketing emails. It\u2019s where people tend to run into trouble.<\/strong><\/p>\n

The ICO generally takes the view that direct marketing by email requires consent, except in the limited soft opt-in case. The Data (Use and Access) Act 2025 introduced a seventh lawful basis, ‘recognised legitimate interests’, but it covers specific purposes like fraud prevention and network security. Commercial marketing is not included. If your current approach relies on legitimate interests to justify marketing emails, it needs to change.<\/p>\n

Can I ask for marketing consent on the same form as the enquiry?<\/h2>\n

Yes, and for most small businesses, this is by far the simplest way to handle it going forward.<\/strong><\/p>\n

Add a separate, optional, unticked checkbox to your contact form: ‘Yes, I’d like to receive occasional emails from [your business name].’ Keep it separate from the main submit action. Make it genuinely optional, not ticking it must still allow the enquiry to go through. It\u2019s a small change, but it makes a big difference. You\u2019ll clearly see who agreed to hear from you.<\/p>\n

For the exact wording to use near your form and when different form types need different approaches, Do I Need a GDPR Checkbox on My Contact Form? has the details.<\/a><\/p>\n

While you are reviewing your mailing list setup, it is worth checking the rest of your site too. Your website should include a privacy policy, cookie notice, terms and conditions, and your business details in the footer. Most DIY builders like Wix or Squarespace provide templates, but they won\u2019t tell you if something important is missing.<\/p>\n

If you already have a website, a quick compliance check can show you what\u2019s missing.<\/p>\n

Check your website now \u2192<\/a><\/p>\n

Want a website built with the right consent mechanics from day one?<\/h2>\n

At Duport, we build websites for UK small businesses with the compliance side handled from the start. So things like consent and legal pages aren\u2019t left as an afterthought. Every site includes properly set up contact forms, legal pages drafted for your business, and a cookie notice that works from launch.<\/p>\n

Duport’s website build<\/a> starts from \u00a3360. Mention this article when you get in touch and we’ll honour the \u00a3144 rate.<\/p>\n

This article is for general guidance. For advice specific to your mailing practices and data processing, speak to a qualified solicitor or data protection specialist.<\/p>\n

\n

FAQs<\/p>\n