Cold email law in Ireland: when an outbound agent may send

Allowed

Regulation 13(11) of S.I. No. 336/2011 lets you email an existing customer without fresh consent only where you market your own product or service 'of a kind similar to that supplied to the customer', the customer was 'clearly and distinctly given the opportunity to object, in an easy manner and without charge' when the details were collected and in each message, and the sale (or your last marketing email) was within the past 12 months.

Footer must include: State clearly who the sender is (do not disguise or conceal the identity of the person on whose behalf the email is sent); include a valid address at which the sender can be contacted; include a valid address or link to which the recipient can send a request to stop, offered clearly, easily and free of charge in every message; for named individuals also give or link to GDPR privacy information including the right to object.

Next step: Confirm the sale or last marketing email was within 12 months, that this offer is similar to what they bought, and that an opt-out was offered at sign-up; if any of these fails, treat as consent needed.

(b) the product or service being marketed is of a kind similar to that supplied to the customer in the context of the sale by the person, (c) the customer is clearly and distinctly given the opportunity to object, in an easy manner and without charge

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(11)

Checked on 17 October 2026

Allowed

Under Regulation 13(4) of S.I. No. 336/2011, unsolicited marketing email to 'a subscriber or user other than a natural person' is prohibited only 'where the subscriber or user has notified the person that the subscriber or user does not consent'. A company's shared mailbox is a subscriber that is not a natural person, so the email is lawful until the company objects; the Data Protection Commission prosecuted Viking Direct for emailing a business address after an objection.

Footer must include: State clearly who the sender is (do not disguise or conceal the identity of the person on whose behalf the email is sent); include a valid address at which the sender can be contacted; include a valid address or link to which the recipient can send a request that such communication shall cease; honour any objection permanently.

Next step: Check your suppression list for any prior objection from this company or domain before sending, and stop permanently if they object.

to send an unsolicited communication for the purpose of direct marketing by means of electronic mail, to a subscriber or user other than a natural person, where the subscriber or user has notified the person that the subscriber or user does not consent to the receipt of such a communication

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(4)

Checked on 17 October 2026

Allowed

Irish law permits this either way: if the business is a company, Regulation 13(4) of S.I. No. 336/2011 allows unsolicited marketing email to 'a subscriber or user other than a natural person' until they object; if it is a sole trader, Regulation 13(2) takes the email outside the natural-person consent rule because the address 'reasonably appears to the sender to be an email address used mainly ... in the context of their commercial or official activity' and the message 'relates solely to that commercial or official activity'. Keep the message strictly about their business.

Footer must include: State clearly who the sender is (do not disguise or conceal the identity of the person on whose behalf the email is sent); include a valid address at which the sender can be contacted; include a valid address or link to which the recipient can send a request that such communication shall cease; honour any objection permanently.

Next step: Check your suppression list for any prior objection, keep the email solely about the recipient's business activity, and stop permanently if they object.

an electronic mail to an email address that reasonably appears to the sender to be an email address used mainly by the subscriber or user in the context of their commercial or official activity and the unsolicited communication relates solely to that commercial or official activity

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(2) and 13(4)

Checked on 17 October 2026

Allowed

Under Regulation 13(2) of S.I. No. 336/2011, an email to an address that 'reasonably appears to the sender to be an email address used mainly by the subscriber or user in the context of their commercial or official activity', where the message 'relates solely to that commercial or official activity', is not treated as unsolicited marketing to a natural person, but it remains subject to the objection rule in Regulation 13(4). A work address published on the organisation's own site or a business directory meets the first limb; your pitch must meet the second.

Footer must include: State clearly who the sender is (do not disguise or conceal the identity of the person on whose behalf the email is sent); include a valid address at which the sender can be contacted; include a valid address or link to which the recipient can send a request that such communication shall cease; because this is a named person, give or link to GDPR privacy information (who you are, why you hold their work email, where you got it, their right to object) and honour objections permanently.

Next step: Confirm the address is on a business domain and was published in a business context, keep the pitch solely about their work, check your suppression list, and send GDPR transparency information no later than your first email.

an electronic mail to an email address that reasonably appears to the sender to be an email address used mainly by the subscriber or user in the context of their commercial or official activity and the unsolicited communication relates solely to that commercial or official activity

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(2)

Checked on 17 October 2026

Consent needed first

A named person is a natural person, and Regulation 13(1) of S.I. No. 336/2011 bans unsolicited marketing email to a natural person 'unless the person has been notified by that subscriber or user that he or she consents'. A bought list gives you no such notification, no way to show the address reasonably appears to be a work address, and under Regulation 13(14) the onus of proving unambiguous consent lies on you; each email is a separate criminal offence.

Next step: Do not send; obtain consent directly, or source the address from the organisation's own website so the work-address rule in Regulation 13(2) can apply, and meet GDPR Article 14 transparency duties for bought data.

a person shall not use or cause to be used any publicly available electronic communications service to send to a subscriber or user who is a natural person an unsolicited communication for the purpose of direct marketing by means of ... electronic mail, unless the person has been notified by that subscriber or user that he or she consents

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(1)

Checked on 17 October 2026

Consent needed first

Regulation 13(1) of S.I. No. 336/2011 requires a natural person's prior consent for unsolicited marketing email, and Regulation 13(14) puts 'the onus of establishing that the subscriber or user concerned unambiguously consented' on the sender. An automated scrape cannot show that this address reasonably appears to be a work address used mainly for the person's commercial activity, so the Regulation 13(2) route is not made out on these facts.

Next step: Do not send from the scraped list; verify the address on the organisation's own website (then re-check as a published address) or obtain consent.

the onus of establishing that the subscriber or user concerned unambiguously consented to receipt of the communication or call lies on the defendant.

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(14)

Checked on 17 October 2026

Consent needed first

If this mailbox belongs to a company, Regulation 13(4) of S.I. No. 336/2011 would allow the email until the company objects, but we cannot confirm the business is a company rather than a sole trader (a natural person), and the work-address rule in Regulation 13(2) needs a message that 'relates solely to that commercial or official activity', which has not been shown.

Next step: Either confirm the business is a company (CRO company number, or Ltd, DAC, plc or CLG in its name) or make and record a pitch that is solely about the recipient's business, then re-check.

an electronic mail to an email address that reasonably appears to the sender to be an email address used mainly by the subscriber or user in the context of their commercial or official activity and the unsolicited communication relates solely to that commercial or official activity

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(2) and 13(4)

Checked on 17 October 2026

Consent needed first

Regulation 13(1) of S.I. No. 336/2011 prohibits unsolicited marketing email to 'a subscriber or user who is a natural person' unless they have notified you that they consent, and on the facts available we cannot bring this address within the work-address rule (Regulation 13(2)) or the business-subscriber rule (Regulation 13(4)). Each unlawful email is a separate offence prosecuted by the Data Protection Commission.

Next step: Obtain consent, or establish that the address is a company mailbox or a published work address and that your pitch relates solely to the recipient's business, then re-check.

a person shall not use or cause to be used any publicly available electronic communications service to send to a subscriber or user who is a natural person an unsolicited communication for the purpose of direct marketing by means of ... electronic mail, unless the person has been notified by that subscriber or user that he or she consents

S.I. No. 336/2011 (Irish ePrivacy Regulations), Regulation 13(1)

Checked on 17 October 2026