GDPR and business cards in the UK Keeping the card is one law. Emailing is another.

A name on a work email address is personal data. The ICO says so directly in its business-to-business marketing guidance: “If you can identify an individual either directly or indirectly it will constitute personal data even if they are acting in their business capacity.” So jordan.hale@company.co.uk is covered by UK GDPR, even though it belongs to a company.

PECR is narrower. It only bites when you send unsolicited direct marketing by electronic mail, and it treats people differently depending on whose address it is.

The ICO’s guide to legitimate interests breaks it into three questions: are you pursuing a legitimate interest, is using the information necessary for it, and do the person’s interests override yours? The deciding factor is usually expectation. In the ICO’s words, their interests are likely to override yours if “they wouldn’t reasonably expect you to use their information” that way.

Someone who hands you a card at an event expects you to save it and get in touch about the conversation. They probably do not expect to be added to a mailing list, sold to a third party or kept on file for ten years. The basis covers the first and not the rest.

• Write it down. The ICO recommends a short legitimate interests assessment, which it describes as a light-touch risk assessment. For one person keeping contacts from events it can be short.
• Tell them. The right to be informed says privacy information is given “at the time you collect their personal data”, with exceptions, including where they already have it.
• Stop if they object to marketing. The ICO’s legitimate interests guide says the right to object to direct marketing is absolute. Keep a note so they are not emailed again.

The corporate route is wider than people expect and narrower than they hope. The ICO’s electronic mail guidance lists corporate subscribers as “a company, Scottish partnership, limited liability partnership or government body”. But the key concepts page puts sole traders and ordinary partnerships with individuals, so a plumber trading under their own name at a Gmail address gets the full protection. And UK GDPR still applies to a named person at a company, so an objection still has to be honoured.

Regulation 22(3) of PECR allows marketing email to an individual where you got their details “in the course of the sale or negotiations for the sale of a product or service” to them, the marketing is about your “similar products and services only”, and they were given a simple way to refuse when the details were collected and in every message since.

The ICO’s compliance guidance gives examples of negotiations: asking for a quote, asking for more details about a product, signing up for a free trial. It does not mention business cards or networking events. Handing you a card is not, on its own, on that list; asking you what you would charge for the job they described is closer to it.

The condition people miss at events is the first opt-out. It has to be offered when you collect the details, not only in the first email. If you want to rely on the soft opt-in, offer the choice then, and write down that you did.

When someone sends you their details through the Save sheet on your card page, the form tells them: “Your details go to [your name] and are stored in their Cardr contacts. You can ask us to delete them at any time.” That is privacy information given at the moment of collection. It is not consent to marketing, and there is no marketing tick box on it.

Our terms are direct about the rest: “If you use Cardr to gather other people’s details, you are a data controller for those details and the law applies to you.” Every contact can be exported to CSV or vCard and deleted, on the free plan. The Pro follow-up reminder goes to you, not to them, and an AI draft is a draft you read and send yourself. What goes in it is your decision under the rules above.

For what to actually write, our UK follow-up email templates are built around the thing you promised, which is the most defensible reason to write there is. The wider picture of cards is on our digital business cards guide.