B2B Research and Marketing Data: The 2026 Rule Changes

Three things changed for B2B research and marketing data in 2026, and only one of them is widely understood. Maximum fines under the Privacy and Electronic Communications Regulations rose to UK GDPR levels on 5 February 2026. The regulator issuing them stopped being the Information Commissioner’s Office on 30 September 2026 and became the Information Commission. And the guidance on legitimate interests — the lawful basis most B2B list building actually relies on — was rewritten in March 2026. None of this changes the underlying method, but it does change the cost of getting the method wrong.

What commenced, and when

The Data (Use and Access) Act 2025 was never going to arrive in one piece. The Government’s own plans for commencement of the Data (Use and Access) Act 2025, last updated 12 October 2026, set out a staged timetable. The dates that matter for research and marketing practice are:

• 5 February 2026 — the majority of the Part 5 data protection and privacy provisions, brought in by the Commencement No. 6 and Transitional and Saving Provisions Regulations 2026 (SI 2026/82).
• 19 June 2026 — the requirement for controllers to have a complaints procedure.
• 30 September 2026 — abolition of the Information Commissioner’s Office and transfer of its functions to the Information Commission.

The regulator’s own statement on the commencement of the Data (Use and Access) Act, published 5 February 2026, confirms the headline number: it can now “issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations”. That is a structural change in exposure. PECR penalties were previously capped far lower, and the cap was the main reason electronic-marketing compliance was treated by some organisations as a commercial risk rather than an existential one. The same statement notes new powers to compel witnesses to attend interviews and to request technical reports.

Why this lands on B2B harder than it looks

B2B practitioners often assume PECR is a consumer problem. It is not, for two reasons that methodologists should hold onto.

First, PECR distinguishes corporate subscribers from individual subscribers, and the consent rules for electronic mail bite differently across that line. Sole traders and unincorporated partnerships do not sit on the corporate side of it. Any list assembled from a mixed universe of limited companies, partnerships and one-person consultancies is therefore a list with two compliance regimes running through it, and the only way to manage that is to record subscriber type as a field at the point of acquisition rather than infer it later. The ICO’s guidance on direct marketing using electronic mail sets out which rules apply to which subscriber type; it was last updated on 28 April 2026 to reflect the Act’s new soft opt-in for charitable purposes in regulation 22(3A) of PECR.

Second, named business contacts are still identified individuals. A personal work email address is personal data regardless of who pays the bill, so UK GDPR obligations on lawful basis, transparency and the right to object apply independently of whatever PECR permits. PECR tells you whether you may send the message; UK GDPR tells you whether you may hold the record at all.

The legitimate interests rewrite

For most B2B research panels and prospect files, the lawful basis is legitimate interests. The ICO revised its legitimate interests guidance on 23 March 2026. The Data & Marketing Association’s summary, ICO updates legitimate interests guidance after DUAA changes, dated 1 April 2026, records the material points: the regulator accepts that in “most cases it’s likely that direct marketing can be a legitimate interest” where PECR does not require consent, subject to conditions — the use must be proportionate, have minimal privacy impact, and not be something people would be surprised by or likely to object to. The three-part test and the balancing exercise remain. The right to object to direct marketing remains absolute.

Two refinements are worth building into process. The DMA summary notes the ICO now describes a legitimate interests assessment as a “light-touch risk assessment”, which is an invitation to do it consistently rather than an invitation to skip it; and it records that the regulator explicitly recognises legal, ethical and industry standards as shaping what legitimate direct marketing looks like, with the consequence that some marketing may fail the test because it breaches those standards.

A related trap: the Act introduced a short list of “recognised legitimate interests” that do not require a balancing test. Published analyses of the ICO’s March 2026 recognised legitimate interest guidance list those conditions as responding to public task disclosure requests, national security and defence, emergencies under the Civil Contingencies Act 2004, crime prevention and detection, and safeguarding. Commercial research and marketing are not among them. If a vendor’s documentation claims a recognised legitimate interest for list building, that is a reason to look harder at the rest of the documentation.

What enforcement actually looks like

The pattern of enforcement has not shifted towards novel theories; it has stayed on volume, consent provenance and identification. The penalty against TMAC Ltd, entered on 3 February 2026, is instructive: a £100,000 fine and an enforcement notice for breaches of regulations 21 and 24 of PECR, after the company made 260,332 unsolicited direct marketing calls between 8 February and 24 September 2024 to subscribers whose numbers were on the register kept by the Commissioner, and failed to give recipients the required particulars. Note the shape of it — a screening failure and a disclosure failure, both of which are process defects rather than judgement calls.

The regulator’s new form

On 30 September 2026 the Information Commission succeeded the ICO as the UK’s data protection regulator. The new body is a body corporate rather than a corporation sole, with executive and non-executive members sharing collective responsibility, under a governance model set by the Data (Use and Access) Act 2025. Interim Chief Executive Paul Arnold leads it alongside seven newly appointed non-executive members, with recruitment for a permanent Chair continuing. The Government’s statement is clear that the transition “does not change the regulator’s role, responsibilities or powers”, and Arnold’s own line was that “the day-to-day work that people rely on from us continues”.

For practitioners the implication is administrative but not trivial: privacy notices, data processing agreements, panel terms and internal policies that name the Information Commissioner’s Office as the supervisory authority now name a body that no longer exists in that form. That is a document-review task, not a methodological one, but it is the kind of thing that surfaces awkwardly in a client due-diligence questionnaire.

One more date to watch

The cookie and similar-technology rules also moved. The Government’s factsheet on the PEC Regulations records that section 112 and Schedule 12 of the Act replace regulation 6 of PECR with a new Schedule A1 of exceptions, keeping existing exceptions such as consent and strictly necessary storage while adding new ones — including collecting statistics on how an organisation’s own online services are used in order to improve them. For anyone measuring questionnaire drop-out, that exception is worth reading closely rather than assuming. The factsheet also notes the Secretary of State may amend or add exceptions by secondary regulations after consulting the regulator.

Frequently asked questions

Do I need consent to send B2B marketing email in the UK as of October 2026? It depends on whether the recipient is a corporate subscriber or an individual subscriber such as a sole trader or unincorporated partnership. Check the ICO guidance on which rules apply to which subscriber type, and record subscriber type at acquisition.

How large can a PECR fine be now? The regulator stated on 5 February 2026 that it can issue PECR fines of up to £17.5 million or 4% of global turnover.

Is direct marketing a “recognised legitimate interest” under the DUAA? No. Published analyses of the March 2026 guidance list the recognised legitimate interests as public task disclosure responses, national security and defence, emergencies, crime, and safeguarding. Marketing must still rely on ordinary legitimate interests, with the full three-part test.

Does the ICO-to-Information Commission change invalidate existing guidance? The Government’s statement says the transition does not change the regulator’s role, responsibilities or powers, and that guidance and enforcement work continue. Treat existing published guidance as live, but update documents that name the old body as your supervisory authority.