GDPR and SMS marketing for UK trades: what you can send, when, and how (2026)
Updated August 202613 min readBy TextBack Pro
Many UK tradespeople avoid sending SMS to customers because they are not sure if it is legal. The reality is that the rules are straightforward, and most of the messages you would want to send (missed call replies, job updates, quote follow-ups, review requests) are fully lawful without needing to collect a tick-box consent from every customer.
This guide explains exactly what you can send, to whom, and under which legal basis, so you can use SMS confidently to grow your business without worrying about ICO enforcement.
Important: this guide is an educational overview of how UK GDPR and PECR apply to tradespeople sending SMS. It is not legal advice. If you have specific compliance concerns, consult a qualified data protection professional or the ICO's own guidance at ico.org.uk.
98%
SMS open rate vs 21% for email
21x
more likely to convert a lead when responding within 5 minutes
£500k
maximum ICO fine for serious PECR breaches (rare for legitimate trade businesses)
The short answer for tradespeople
If a customer called your business number, booked a job, or made an enquiry, you can legally send them SMS about that enquiry or booking without asking for separate consent. This covers the messages that matter most for winning and retaining trade customers.
The two regulations you need to understand are:
UK GDPR: governs how you collect, store, and use personal data (including phone numbers).
PECR (Privacy and Electronic Communications Regulations): governs the specific rules for sending electronic marketing messages, including SMS.
Together they determine what you can send, when, and what you must include in every message.
The 4 lawful bases that apply to trades SMS
UK GDPR requires a lawful basis for processing personal data. For tradespeople sending SMS, four bases are relevant depending on the type of message.
Basis 1 (most common)
Legitimate interest
Applies to missed call replies, job updates, booking confirmations, and appointment reminders. The customer initiated contact or has an active booking, so texting them is reasonably expected and does not override their rights.
Basis 2
Contract performance
Applies when you need to contact the customer to carry out a job they have booked. Access instructions, delay notices, and completion confirmations all fall here.
Basis 3 (soft opt-in)
PECR soft opt-in
Applies to review requests and referral asks sent to recent customers. Allowed without explicit consent as long as the message relates to similar services and includes an opt-out route.
Basis 4 (requires action)
Explicit consent
Required for cold marketing SMS to people who have never contacted you. Cannot be bundled into terms and conditions. Must be freely given, specific, informed, and unambiguous.
What you can send without explicit consent
These message types are lawful for UK tradespeople without needing a separate consent tick-box.
Missed call replies (legitimate interest)
When a customer calls your business number and you miss the call, sending an automated SMS reply is lawful under legitimate interest. The customer chose to call you, creating a clear expectation of business contact. Your reply is directly connected to their inbound action. This is the most valuable SMS a tradesperson can send and it is also the safest from a compliance standpoint.
Booking confirmations and job updates (contract performance)
Once a customer books a job, texting them to confirm the booking, update them on arrival time, or confirm the job is complete is lawful under contract performance. These are service messages, not marketing, and carry no consent requirement beyond the booking itself.
Appointment reminders (legitimate interest)
Reminding a customer about a booked appointment 24 to 48 hours before the job is a legitimate interest communication. It serves both parties and the customer has a clear expectation of pre-appointment contact when they make the booking.
Review requests (PECR soft opt-in)
Asking a recent customer to leave a Google review is permitted under the PECR soft opt-in rule, provided: the customer engaged with your business directly (enquiry or booking); the request relates to the same type of service; and the message includes a clear opt-out. You should send review requests within 30 days of the completed job for the soft opt-in to apply cleanly.
Quote follow-ups (legitimate interest)
Following up on a quote you sent is lawful under legitimate interest. The customer requested a quote, which created a legitimate ongoing commercial relationship. Two to three follow-up messages over seven to ten days is a reasonable approach. Beyond that, the legitimate interest basis becomes harder to rely on.
What requires explicit consent
Two categories of SMS require explicit consent before you send them.
Cold marketing SMS
Sending a promotional SMS to someone who has never contacted your business requires explicit consent collected in advance. This includes buying a list of numbers, texting people who have only seen your van, or messaging contacts you acquired from a third party. Do not do this without documented consent for each number.
Ongoing promotional newsletters or offers by SMS
If you want to send regular promotional messages (seasonal offers, price changes, referral campaigns) to a general list, you need explicit opt-in consent collected at the point of customer contact and documented clearly. A checkbox on your booking form or a clear verbal confirmation works if you record it.
8 GDPR-compliant SMS templates
Every template below includes the lawful basis it relies on and the compliance requirement it satisfies. Copy and adapt them for your trade.
Send: automatically within 5 seconds of every missed call
Hi, thanks for calling [Business Name]. Sorry I missed your call, I am on a job. I will call you back shortly. If it is urgent, reply here. To stop these messages, reply STOP. [Your Name]
The "reply STOP" line is required under PECR for any automated SMS. Including it on the first message is best practice and demonstrates compliance. TextBack Pro adds this automatically so you never forget it.
Hi [Name], your booking with [Business Name] is confirmed for [day] [date] at [time]. Reply here with any questions or access details. See you then. [Your Name]
A service confirmation message does not legally require an opt-out clause, but including "reply here" for questions is good practice and opens the conversation before the job starts.
Hi [Name], just a reminder that [Business Name] is visiting you tomorrow for the [job] at [time]. Any changes or access details, reply here. [Your Name]
Appointment reminders reduce no-shows by 40 to 60% and are clearly in the customer's interest as well as yours, which strengthens the legitimate interest basis.
Template 4: Job completion (contract performance)
Template 4 of 8
Lawful basis: contract performance
Send: same day as job completion
Hi [Name], the [job] is complete. If you notice anything that needs attention, reply here in the next few days and I will sort it. Thanks for your business. [Business Name]
Completion messages are service communications and do not need an opt-out. Sending this before you leave the site while the job is fresh also sets up the review request you will send a few days later.
Template 5: Review request (PECR soft opt-in)
Template 5 of 8
Lawful basis: PECR soft opt-in (recent customer)
Send: 3 to 5 days after job completion
Hi [Name], hope the [job] is all looking good. If you are happy with the work, a Google review would really help us: [link]. Takes 30 seconds. Reply STOP to opt out. [Business Name]
The soft opt-in basis requires an opt-out in every marketing message. "Reply STOP to opt out" satisfies this. Send this within 30 days of the completed job. After 30 days the soft opt-in basis becomes weaker.
Template 6: Quote follow-up (legitimate interest)
Template 6 of 8
Lawful basis: legitimate interest
Send: 48 to 72 hours after sending a quote
Hi [Name], I sent over the quote for [job] on [day]. Just checking you received it. Happy to discuss or adjust. Reply STOP to opt out. [Your Name] at [Business Name]
Quote follow-ups are legitimate interest because the customer asked for the quote. Include opt-out on follow-up messages as best practice, even though legitimate interest does not strictly require it for non-marketing service messages.
Hi [Name], I called round for the [job] today but was unable to get an answer. Happy to rearrange at a time that suits. Just reply here or call me. [Your Name] at [Business Name]
Contacting a customer who missed a confirmed appointment is lawful under both legitimate interest and contract performance. Keep the tone neutral to maximise the chance of rescheduling.
Template 8: Referral ask (PECR soft opt-in)
Template 8 of 8
Lawful basis: PECR soft opt-in (recent customer)
Send: 7 to 14 days after a completed job
Hi [Name], glad the [job] went well. If you know anyone who needs a reliable [trade] in [area], I would really appreciate a mention. Reply STOP to opt out. [Your Name]
Referral asks are marketing under PECR because you are promoting your services. The soft opt-in covers this if the customer had a recent booking. Always include the opt-out line. Limit to one referral ask per completed job.
Send compliant SMS automatically, every time
TextBack Pro fires your missed call reply within 5 seconds, adds opt-out wording automatically, suppresses STOP numbers instantly, and handles your full follow-up sequence. GDPR compliance built in.
Under PECR, you must stop sending marketing messages to any number that replies STOP (or any similar opt-out signal such as "unsubscribe", "remove me", or "do not contact"). The requirements are:
Process opt-outs within 28 days at the latest. Best practice is instant suppression.
Add the number to a suppression list and never message it again for marketing purposes.
Keep the suppression list indefinitely so you can demonstrate compliance if the ICO investigates.
You may still send essential service messages (confirming an existing booking they have not cancelled) but nothing promotional.
If the same person contacts you again later and makes a new enquiry, their soft opt-in resets for that new enquiry only.
Do not ignore STOP replies. Sending marketing SMS after an opt-out is a PECR breach that can result in an ICO fine. TextBack Pro automatically suppresses any number that replies STOP and flags it in your dashboard so you always have a clear audit trail.
Voicemail vs instant SMS: compliance and conversion
Factor
Voicemail
Automated SMS (TextBack Pro)
GDPR lawful basis
Legitimate interest
Legitimate interest (same basis)
Consent required for missed call reply
No
No
Opt-out required by law
No (one-way)
Best practice (STOP reply)
Open rate
~30%
98%
Lead conversion rate
8 to 12%
50 to 65%
ICO complaint risk
Very low
Very low (when opt-out is included)
Audit trail
None
Full message history logged
From a compliance standpoint, automated SMS and voicemail sit under the same legitimate interest basis. SMS is not riskier than leaving a voicemail. It is simply more effective, which is why it is worth setting up correctly.
ROI: compliant SMS vs no SMS for UK tradespeople
Consider a gas engineer who misses 6 calls per week with an average job value of £350. The table below compares the monthly revenue from those missed calls across three approaches.
Approach
Compliance status
Conv. rate
Jobs/month
Monthly value
No SMS or follow-up
N/A
4%
1
£350
Manual SMS (1 to 3 hrs later)
Compliant (legitimate interest)
38%
9
£3,150
Instant automated SMS (TextBack Pro)
Compliant (legitimate interest)
65%
15
£5,250
Compliant automated SMS generates approximately £4,900 more per month than no SMS at all in this example. TextBack Pro costs from £47/month. There is no scenario where the compliance cost outweighs the revenue benefit.
GDPR compliance checklist for tradespeople sending SMS
Before you send any automated SMS, confirm each of these:
You have identified a lawful basis (legitimate interest, contract, or soft opt-in) for every type of message you send.
Every automated or marketing SMS identifies your business by name.
Every marketing SMS includes a clear opt-out mechanism (reply STOP).
STOP replies are processed instantly and the number is added to a suppression list.
You are not sending cold marketing SMS to people who have never contacted your business.
Review requests and referral asks are sent only to customers with a recent booking (within 30 days).
Your privacy policy mentions that you send SMS as part of your service and follow-up communications.
You keep a message log so you can demonstrate compliance if the ICO or a customer asks.
TextBack Pro handles all of the above automatically. Opt-out wording is added to every automated message, STOP replies suppress the number instantly, and every message is logged with a timestamp and delivery status. Your compliance audit trail is built in.
Frequently asked questions
Can a UK tradesperson send automated SMS without consent?
Yes, in specific circumstances. An automated SMS in response to a missed inbound call is lawful under legitimate interest. Booking confirmations and job updates are lawful under contract performance. Review requests to recent customers are covered by the PECR soft opt-in rule. Cold marketing SMS to people who have never contacted you is the only category that requires explicit consent.
What is the PECR soft opt-in rule for tradespeople?
The soft opt-in rule allows you to send marketing SMS to existing customers without explicit consent if: their contact details were collected during a sale or enquiry; the message relates to similar services; and every message includes a clear opt-out option. This covers review requests and referral asks sent to customers within roughly 30 days of their last booking.
How long do I need to keep records of SMS opt-outs?
Keep suppression lists indefinitely. There is no fixed retention period in UK GDPR, but you need to be able to prove you honoured an opt-out if the ICO or the customer challenges you. An indefinite suppression list is the safest approach and costs nothing to maintain. TextBack Pro keeps your suppression list permanently.
What happens if a customer replies STOP?
You must stop sending marketing messages to that number immediately. Add it to your suppression list and ensure it is never messaged again for promotional purposes. You may still send essential service messages for an existing booking they have not cancelled. Ignoring a STOP reply is a PECR breach. TextBack Pro processes STOP replies automatically and instantly.
Does the ICO fine tradespeople for SMS marketing breaches?
The ICO can fine any business for PECR breaches, including sole traders. Fines up to £500,000 are possible for serious breaches, though enforcement tends to target mass-spam operations rather than individual tradespeople messaging their own customer list. The bigger practical risk for a trade business is the reputational damage from a customer complaint or ICO warning. Compliant SMS costs nothing extra and removes all risk.
