Finding a motivated owner is only half the job. The other half is approaching them lawfully and well. Cold outreach about property in the UK sits under two regimes, UK GDPR for personal data and PECR for electronic marketing, and getting this right protects both the owner and you. This article walks through the distinction that matters most, how legitimate interest actually works, what a defensible first approach looks like in practice, the mistakes that get people into trouble, and what to do before you send anything. It is a practical overview, not legal advice; when in doubt, take your own.
Are business contacts treated the same as consumer contacts?
No, and this is the first distinction that matters. Contacting a named director at a company about that company's property is business-to-business outreach, which is treated differently from marketing to a private individual. A great deal of commercial property is held in companies, which is precisely why the public record, Companies House and HM Land Registry, is the right starting point. Approaching a sole individual at their home address about their own home is a different, more sensitive situation and should be handled with far more care, or avoided altogether.
PECR, the rules that govern electronic marketing such as email, treats corporate subscribers differently from individuals. Two practical points follow. First, a director's name combined with a work email is still personal data under UK GDPR, so the data-protection rules apply even when the relationship is business-to-business. Second, the marketing-consent rules under PECR are lighter for corporate contacts than for individuals, but lighter is not the same as absent. You still need a lawful basis to process the contact's personal data, and you still have to honour an objection. The safe mental model is that B2B gives you more room than B2C, not a blank cheque.
How does legitimate interest work in practice?
For B2B outreach you will usually rely on legitimate interest as your lawful basis under UK GDPR, rather than consent. That is defensible, but it is not a free pass. It requires that your interest is real, that the contact is relevant to their role, and that you have balanced your interest against the person's reasonable expectations and rights. The practical test: could you explain, in one honest sentence, why you contacted this specific person about this specific property? If you can trace it to a dated public record, such as a Gazette notice or a Land Registry title, you can.
The way to make this concrete is a legitimate interests assessment, which is simply a short written note covering three things: the purpose of the contact, why it is necessary, and the balance between your interest and the individual's. You do not need a lawyer to draft a paragraph that says you are contacting a named director, in their capacity as director, about a commercial asset their company owns, because a dated public record shows a reason they may wish to consider a sale, and that the contact is a single, low-pressure, easy-to-decline business enquiry. Keep that note on file per source or per campaign. If anyone ever asks why you wrote to someone, you can answer in a sentence and show your working.
What does a good first approach contain?
- A clear, honest reason for contact, tied to public information, not a claim that you know their private intentions.
- Who you are and how to opt out, immediately and easily. Honour any objection on the first request, and suppress that contact permanently.
- No pressure and no overclaiming. Never state or imply that the owner is in trouble, must sell, or is guaranteed anything.
- A relevant business contact route. Email to a work address for a B2B approach is generally the more defensible channel. Keep records of why each person was contacted and what source the contact came from.
A worked example helps. A defensible opener to a company director might read: we buy commercial freeholds in your area and noticed your company owns one nearby. If a quick, clean offer would ever be useful, I am happy to talk; if not, reply once and I will not contact you again. That message is honest, names no private circumstance, gives an instant way to decline, and is tied to a public ownership record. Compare it with we saw your company is in financial difficulty and thought you might need to sell fast, which references information you cannot lawfully assume, applies pressure, and is exactly the kind of approach that draws complaints. Same lead, completely different risk.
What should you avoid?
- Scraped consumer data and unsourced distressed lists. If you cannot trace a contact to a lawful, dated source, do not use it.
- Marketing to individuals as if they were businesses. The line matters, and the regulator cares about it.
- Implying financial advice or guaranteed outcomes. You are making an enquiry, not giving advice.
- Ignoring objections. One clear opt-out should end all further contact, across every channel and every future campaign.
- Referencing someone's distress in the message itself. Even where the signal is public, leading with it is both poor practice and a complaint magnet.
What should you do before you send anything?
Build a short checklist and run every approach through it. Confirm the contact is a business contact about a company asset, not a private individual at home. Confirm you can name the public source that justifies the contact and write your one-sentence reason. Confirm the message identifies you and offers an immediate, easy opt-out. Confirm you have somewhere to record the source, the date, and any objection so suppression actually happens. If any box is unticked, fix it before you send. This is slower than buying a list, and that is the point: a smaller, sourced, documented list outperforms a large, untraceable one and keeps you on the right side of the rules.
Done this way, a first approach is something you can stand behind: the right person, contacted for a reason you can evidence, with a clear way to say no. That is the standard DealBrief is built around. Every surfaced contact is traceable to a public record, and the suggested approach is written to be defensible rather than pushy. For the authoritative position on the rules themselves, the Information Commissioner's Office is the primary source, and you should take your own advice on anything specific to your situation.
This article is general information, not legal advice.