Prospecting SME commercial clients on WhatsApp within PECR and the GDPR

Contents

1. PECR covers WhatsApp messages — but not every recipient equally
2. The soft opt-in: narrower than most firms think
3. The LinkedIn-to-WhatsApp handoff
4. Referrals: the channel PECR barely touches
5. Where ORIS fits
6. Frequently asked questions

Commercial brokers have noticed the same thing everywhere: the owner of a twelve-person haulage firm does not answer cold emails, screens unknown calls, but replies to a WhatsApp message inside an hour. The temptation is obvious. So is the trap: the rules on electronic marketing were written channel-neutrally, they cover WhatsApp, and the fines and reputational damage for getting them wrong land on the brokerage, not on the messaging platform. Here is how to prospect SME clients on WhatsApp lawfully — and, just as important, in a way that actually works.

PECR covers WhatsApp messages — but not every recipient equally

The Privacy and Electronic Communications Regulations govern unsolicited electronic marketing in the UK. The ICO's Guide to PECR treats “electronic mail” broadly — the concept extends beyond email to messages delivered to a stored address or account, and the ICO's direct marketing guidance applies the same logic to messages sent over messaging services. Working assumption for any compliant brokerage: a marketing WhatsApp message is electronic mail marketing under PECR.

The crucial nuance for commercial brokers is the distinction between subscriber types:

Prospect	Subscriber type	PECR marketing-consent rule	GDPR still applies?
Ltd company or LLP (message to a company-held number)	Corporate	The consent rule for electronic mail does not apply	Yes — a named person's mobile number is personal data
Sole trader	Individual	Consent or soft opt-in required	Yes
Ordinary (non-Scottish) partnership	Individual	Consent or soft opt-in required	Yes
Director's personal mobile	Usually individual	Treat as consent-required	Yes

So “B2B is exempt” is half true and dangerous. A large share of SME prospects — sole traders, partnerships, and anyone you reach on a personal mobile — sit on the individual-subscriber side of the line. And even for genuine corporate subscribers, the GDPR requires a lawful basis (usually legitimate interests, with a documented balancing test), transparency, and an effective way to object.

The soft opt-in: narrower than most firms think

PECR's soft opt-in lets you market by electronic mail without prior consent only when all of the following hold:

1. You obtained the contact details yourself, in the course of a sale or negotiations for a sale of your services — a quote request qualifies; a bought list never does.
2. The marketing is for your own similar products or services.
3. You offered a simple, free way to refuse marketing when you collected the details, and again in every message since.

Note what this excludes: numbers scraped from websites, contacts inherited from a book purchase without the original refusal opportunity, and prospects who asked about motor fleet being marketed a completely unrelated product. When the soft opt-in genuinely applies — a fleet prospect you quoted in March, messaged in September about renewal season — it is a solid basis. When it is stretched, it is the first thing the ICO will ask you to evidence.

There is also a second rulebook: Meta's own. Business-initiated WhatsApp messages require the recipient's opt-in under WhatsApp Business policy, independent of PECR, and marketing sent without it gets numbers reported, quality-rated down and ultimately blocked. Compliance and deliverability point the same way: get permission first. A clean way to ask is an opt-in request template sent by email or handed over verbally in a call, so the first WhatsApp message is one the prospect agreed to receive.

The LinkedIn-to-WhatsApp handoff

The most effective compliant pattern we see in commercial lines is not cold WhatsApp at all — it is a warm handoff. Connect and converse on LinkedIn, where B2B outreach is expected; when the conversation becomes real (“can you look at our renewal?”), ask explicitly: “Easiest is WhatsApp — happy for me to message you there?” That one sentence does three jobs: it creates a documented opt-in, it satisfies Meta's permission rule, and it filters your pipeline down to prospects with genuine intent. Record the date and channel of that consent in the client record, because two years later nobody will remember it.

From there, the WhatsApp thread should behave like a service channel from day one: the requested quote, the renewal comparison, the answers to their questions — not a drip sequence. Commercial buyers judge a broker on responsiveness during prospecting because it predicts responsiveness during a claim. The playbook in commercial renewals on WhatsApp shows what that service rhythm looks like after the win.

Referrals: the channel PECR barely touches

The cheapest compliant prospecting on WhatsApp is the one your existing clients do for you. A referral works because the message to the new prospect comes from someone they know — you only enter the conversation once the prospect has contacted you or agreed to be contacted, which puts you on safe ground for both PECR and Meta policy. Two rules keep it clean: never message a referred prospect first on the basis of “your mate gave me your number” (that is still unsolicited marketing to a number you did not collect in a sale), and make it effortless for the client — a short forwardable message and a genuine thank-you. The client referrals use case covers the mechanics, timing and wording.

Where ORIS fits

ORIS records the opt-in status of every contact and excludes opted-out numbers from all campaigns automatically. Campaigns carry a marketing or service compliance tag, use only Meta-approved templates, and every conversation that follows lands in a shared inbox where the prospect's history — first consent included — is visible to whoever picks it up. Prospects who reply get flagged as opportunities with a risk and engagement picture, so the pipeline lives where the conversations are, and exports to CSV when you need it elsewhere.

Frequently asked questions

Can I cold-message a limited company's office number on WhatsApp?

PECR's consent rule for electronic mail does not apply to corporate subscribers, but the GDPR still governs any personal data involved, Meta's policy still requires opt-in for business-initiated messages, and an unsolicited WhatsApp to a company number is likely to be reported as spam. Lawful-ish is not the same as wise: use email or LinkedIn for the first touch.

Does the soft opt-in cover prospects who only requested a quote?

Yes — negotiations for a sale are enough; a completed sale is not required. But you must have offered an opt-out when you collected the details, the marketing must concern similar services, and every message needs an opt-out. Miss any leg and the soft opt-in fails.

Are sole traders really treated like consumers under PECR?

For the electronic mail marketing rules, yes — sole traders and ordinary partnerships count as individual subscribers, so consent or a valid soft opt-in is required. A surprising amount of the SME market falls in this category.

Can I buy a list of SME mobile numbers and message them?

No. The soft opt-in only applies to details you collected yourself, consent obtained by a list broker will almost never name your firm specifically enough, and Meta's opt-in requirement fails too. Bought lists are how brokerage numbers get blocked.

How should I evidence a verbal opt-in given in a phone call?

Note the date, time and wording in the client record immediately, then send a first WhatsApp message that references the agreement (“As discussed on the phone, here's the fleet quote…”). The prospect's continued engagement corroborates the record.