Self Storage Customer Emails and PECR: What You Can Send

As at 16 October 2026, the Information Commission’s Office (the ICO) treats a message that gives a customer information they need as a service message, and one that promotes something as direct marketing, even inside a service message. For a storage operator’s unsolicited offer by email or text, PECR requires consent or the soft opt-in only for individual subscribers, such as sole traders, and for every recipient bars hiding who the sender is and requires a valid opt-out address.

This guide is general information, not legal advice, and no solicitor has read it. PECR is the Privacy and Electronic Communications (EC Directive) Regulations 2003. From 30 September 2026 the Information Commissioner’s functions belong in law to the Information Commission, and the ICO’s news release of that day says the organisation will be referred to as the Information Commission’s Office, or ICO, so this guide says the ICO.

We read the regulations as legislation.gov.uk printed them on 16 October 2026. Where we rely on an ICO page that carries the banner “this guidance is under review”, we say so.

Which emails does a storage customer get, from enquiry to move-out?

A storage customer’s emails run from an enquiry reply, through the agreement to sign, a Direct Debit notice and each invoice, to a fee change and an ending, and only a few have a scheme, a regulation or the agreement behind them.

The figure below follows the customer-email catalogue in StoreBay’s code, so another system’s list will differ. Each step says what stands behind the message or how the ICO’s examples would class it. Steps marked our reading are our own match to an ICO example, and steps marked adviser question are points the sources leave open. On our reading, only the group-message offer is plainly direct marketing, and any step becomes direct marketing if an offer is added.

What is a service message, and what turns it into marketing?

A service message gives a customer information they need as part of their relationship with you, and it becomes direct marketing when it promotes something.

PECR now defines direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”, in words added to regulation 2(1) in 2025. The ICO says PECR doesn’t stop you telling customers “important information that they need to know as part of their relationship with you”, such as appointment reminders and updates to your terms.

The ICO asks three questions: why you want to use the information, why you want to communicate with people, and whether the content is promotional, for example “does it advertise products or services or promote you or your interests?”. A message that actively promotes a particular service, special offer or upgrade is “likely to be direct marketing”.

Four points matter most to a storage operator.

• One offer changes the whole message. If a service message “has elements that are direct marketing, even if that is not the main purpose of your message, then it will count as direct marketing”. Branding and logos do not.
• A neutral tone is not enough. The ICO says “simply using a neutral tone doesn’t necessarily avoid messages being direct marketing”, because the context also matters.
• A payment problem is the ICO’s own example. A gym’s call to say a monthly payment has not worked is not direct marketing, but it becomes so if the gym also outlines its personal training services. Our late fees guide covers the reminder ladder, and the glossary defines dunning.
• Asking for consent is itself marketing. In the ICO’s hotel example an email asking guests whether they want offers contains none, yet “the hotel is still sending it for direct marketing purposes”. Our reading: an email asking customers whether they want offers is not a service message.

One ICO example of a service message by text is a phone company’s note that a customer is nearing a data limit, “likely to be a service message”. The same text would be direct marketing if it encouraged a special offer.

Which messages does the law or the Direct Debit scheme require?

The Direct Debit scheme asks for advance notice before a first collection or a change, and the agreement can add notices of its own, such as notice of a licence fee change. Whether the Consumer Contracts Regulations 2013 or the subscription rules of the Digital Markets, Competition and Consumers Act 2024 (the DMCC Act) reach a storage licence is open, and on 16 October 2026 the Act’s subscription duties were not in force.

If the Consumer Contracts Regulations apply, regulation 13 asks for the Schedule 2 information, and the cancellation form if a right to cancel exists, before the consumer is bound. Regulation 16 asks for confirmation of a distance contract on a durable medium, which regulation 5 says includes email. Whether the Regulations reach a storage licence is an open question that our cooling-off guide sets out.

The DMCC Act would add a reminder notice for some renewal payments, a copy of a contract signed in person and a cooling-off notice for subscription contracts. On 16 October 2026 legislation.gov.uk marked the Act’s subscription-contracts chapter (Part 4, Chapter 2) as containing prospective provisions, so those duties were not in force.

The Prime Minister’s Office said on 9 August 2026 that the new rules “will now come into force in January 2027”. The government’s consultation response of 2 April 2026 anticipates that the regime “will commence in spring 2027”. On 16 October 2026 we found no text in the chapter or those two pages that says whether a self-storage licence is a subscription contract. Our DMCC guide covers the rules.

The Direct Debit advance notice is a rule of the Direct Debit scheme, not an Act. For notice before a first collection or a change of amount, date or frequency, the Bacs FAQ says the default period, “in the absence of any other agreement”, is “a minimum of 10 working days plus postal time”.

The Direct Debit Guarantee says the organisation will notify the payer of a change “(normally 10 working days) in advance of your account being debited or as otherwise agreed”. GoCardless, a payment provider, says that under its terms and conditions customers “agree to a three day notice period”, and that customers “must be notified in advance of each payment”. Our Direct Debit guide sets out the Guarantee.

On 16 October 2026 we found no ICO statement on whether a Direct Debit advance notice is a service message, and none of the ICO pages we saved mentions Direct Debit.

The Service User’s Guide and Rules to the Direct Debit Scheme was open to registered users only on 16 October 2026, so we did not read it and cannot say whether its rules require a notice before every collection or whether a payer can agree to three working days. Ask your payment provider or adviser.

Do the rules differ for individuals, sole traders and companies?

Yes: regulation 22’s consent rule protects individual subscribers, whom the ICO says include people, sole traders and ordinary partnerships, and it does not apply to corporate subscribers such as limited companies.

Regulation 2(1) lists as corporate subscribers a company, a company incorporated by royal charter or letters patent, a partnership in Scotland, a corporation sole and any other body corporate or entity that is a legal person distinct from its members. An individual is “a living individual” and includes an unincorporated body of such individuals.

The ICO’s business-to-business page, which carries the review banner, adds limited liability partnerships and some government bodies to the corporate group, and says sole traders and other types of partnership are individual subscribers, treated the same as individuals.

Our reading of regulation 2(1)(c) and that page is that a partnership in Scotland is a corporate subscriber and a Scottish sole trader is an individual one. The ICO says the email address or telephone number of an employee at a corporate body is a corporate subscriber’s, because the subscriber is the employer, and that if you are not sure you should treat the details as an individual subscriber’s.

A corporate subscriber still has protections. The ICO says you must not disguise your identity in messages to either type of subscriber and must give a valid address for opting out, and data protection law also applies where an address names a person. On a corporate subscriber’s own opt-out, the ICO says you “should comply with a corporate subscriber’s opt-out request”.

StoreBay’s business flag on a customer record is not this test. The schema’s own comment describes it as a VAT flag that answers whether a contact trades, true for a sole trader, a partnership, a limited company and a charity alike. On 16 October 2026 we found no use of that flag, or of the optional legal-form field, in the comms and consent code of the models, dispatcher and API packages, or in the group-message composer.

When can you email or text a customer an offer?

An unsolicited offer by email or text to an individual subscriber needs consent or the soft opt-in in regulation 22(3); the ICO says a corporate subscriber needs neither, and regulation 23 applies to both.

A text is electronic mail for PECR: the definition “includes messages sent using a short message service”. Regulation 22(1) applies to unsolicited messages, and the ICO says marketing is solicited only “when someone specifically asks you to send a particular message or type of information”. So even a customer who has opted in to marketing is sent unsolicited marketing, the ICO says: an opt-in is not a request for a particular message.

Consent must be a real choice. The ICO says you “must not use pre-ticked opt-in boxes, silence or inactivity as evidence of consent” and should ask for each type, such as email and text, separately. Regulation 22(2) calls it consent “for the time being”, so people can withdraw it whenever they want.

The soft opt-in is regulation 22(3). We read it as printed on 16 October 2026, after the changes of 5 February 2026 that added a separate soft opt-in for charities in paragraph (3A). It has three paragraphs:

• (a) the sender obtained the recipient’s contact details “in the course of the sale or negotiations for the sale of a product or service to that recipient”;
• (b) the direct marketing is for the sender’s “similar products and services only”;
• (c) the recipient was given “a simple means of refusing” the use of their contact details for such marketing, “free of charge except for the costs of the transmission of the refusal”, when the details were first collected and, if they did not refuse then, “at the time of each subsequent communication”.

The ICO sets the same conditions out as five requirements on its “How do we comply” page and as four on its business-to-business page, which carries the review banner. Our reading is that the two lists split the same three paragraphs differently.

The ICO’s pages are not worded alike on what counts as a sale or negotiation. Its “How do we comply” page says a person “doesn’t need to actually buy anything from you”, counts “requesting a quote or asking for more details about what you offer”, and says an online enquiry form “may be enough to meet this part of the soft opt-in”.

Its shorter “Guide to PECR: Electronic mail marketing” page, which carries the review banner, says the soft opt-in “does not apply to prospective customers or new contacts (eg from bought-in lists)”. It allows an email or text to “an existing customer who has bought (or discussed buying) a similar product or service from you in the past”.

Its “Previously asked questions” page, which also carries the banner, says in an answer about social media messages that the soft opt-in “applies only to existing customer relationships, not new contacts on social media”.

This guide does not say which of these governs a prospect who only enquired or asked for a quote, whether customers imported from another system meet the soft opt-in, or whether a customer who has moved out still counts as an existing one. All three go to your adviser.

A person can also object. Under UK GDPR Article 21, once someone objects to direct marketing, “the personal data shall no longer be processed for such purposes”, and the ICO says failing to opt out of a soft opt-in “does not override this”. After an objection, the ICO says “you can only send electronic mail marketing if they later give their consent”.

Can you ask for a review or offer a referral reward?

We cannot tell you whether a request for a review is direct marketing, because on 16 October 2026 we found no ICO statement on it; a referral scheme, though, can make you the instigator of your customers’ messages.

On 16 October 2026 we found no ICO statement on whether a request for a customer review is direct marketing, in a welcome email, a one-tap text or any other form. We searched the ICO’s own site for seven phrases, listed under Sources, took the first page of results for each, and read the guidance pages we saved. Three more searches returned an error twice and are not covered.

The nearest ICO text is two sentences: “Genuine market research does not count as direct marketing. However, if a survey includes any promotional material or collects details to use in future marketing campaigns, the survey is for direct marketing purposes and the rules apply”. On 16 October 2026 the second was the only sentence in the ICO guidance pages we saved that links a survey to direct marketing, and neither mentions review requests or satisfaction surveys.

If a review link were held to be promotional, the ICO’s whole-message rule would make the whole welcome email direct marketing. That is our reading, not an ICO statement. Whether a review request would “promote you or your interests” is a question for your adviser.

A referral reward raises a different point. The ICO says asking people to send your electronic mail marketing to friends or family, often called ‘refer a friend’, is likely to make you the instigator of those messages, with or without an incentive. It says the soft opt-ins cannot be relied on for such schemes and valid consent is needed.

Where a page only explains a unique code and leaves the customer to decide whether and how to take part, the company “is not responsible under PECR because they are not instigating those messages”. Which side your scheme falls on is a question for your adviser.

On 16 October 2026 we found no code in the product’s models, dispatcher or API packages that sends a review request, a feedback request or a satisfaction survey. Operators’ own templates are outside that search.

What must every marketing message carry?

A marketing email or text must not hide who sent it and must give a valid address to which the recipient can send a request to stop. A sender relying on the soft opt-in must also offer a simple refusal when it collects the details and in every message.

Regulation 23 bars direct marketing by electronic mail where the sender’s identity “has been disguised or concealed”, or where “a valid address to which the recipient of the communication may send a request that such communications cease has not been provided”. The ICO says these rules cover messages to either type of subscriber, and its Previously asked questions page, which carries the review banner, says they apply “whether messages are solicited or unsolicited”.

For the soft opt-in, the ICO says an opt-out only in an order confirmation email is “not sufficient” at collection, and an opt-out box hidden in a privacy policy “is not a simple way for people to refuse your electronic mail marketing”.

In later messages the ICO suggests a reply or “a clear ‘unsubscribe’ link” or, for a text, a stop message to a code number, and says not to ask people to create an account or log in to unsubscribe. On 16 October 2026 we found no statement in the ICO pages we saved that PECR requires a one-click unsubscribe or a List-Unsubscribe header, which lets a mail app show its own unsubscribe button.

The last two paragraphs of regulation 23 refer to regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002. It asks a commercial communication that forms part of an information society service to be “clearly identifiable as a commercial communication” and to “clearly identify as such any promotional offer”. On 16 October 2026 we found no source among those we read that says whether regulation 7 reaches a storage operator’s marketing email, so that is an adviser question.

What can a breach cost?

On our reading of Schedule 1 to PECR, which regulation 31 applies, with section 157 of the Data Protection Act 2018, an infringement of regulation 22 or 23 for an act or omission on or after 5 February 2026 attracts the higher maximum penalty. That is up to £17,500,000 or, for an undertaking, 4% of its total annual worldwide turnover in the preceding financial year, whichever is higher. Earlier breaches follow the earlier rules.

On 16 October 2026 the ICO’s “What are PECR?” page, which carries the review banner, still gave an older and lower limit, so we cite the legislation.

How should you record who agreed to what?

The ICO says to record the contact details you were given, their source, which methods of direct marketing each person has consented to, and any objection, opt-out or withdrawal, and to put someone who objects on a suppression list “instead of deleting them”.

On consent it says you “should keep a record of the consent (eg who, when, how) so that you can demonstrate it is valid”. Record each channel separately, because the ICO says to ask for consent for each type separately and that an opt-out usually applies to the method used.

For a soft opt-in, our reading is that a record of how and when the details were collected, and of the opt-out offered then and in each message, is what would show the conditions were met.

How do StoreBay’s messages work today?

StoreBay keeps a catalogue of customer emails, records each customer’s marketing consent as yes, no or not asked, and sends a group message as either a service update or an offer, which the operator declares. This section describes what the code and documents do as at 16 October 2026; whether any message is allowed is a question for your adviser.

• The catalogue. It lists 26 switches, and one switch can cover several emails. Two emails start off until the operator switches them on.
• Locked emails. Six switches are locked. The Direct Debit notice, the cancellation-rights email and the licence fee notice give the scheme, the Consumer Contracts Regulations 2013 and the licence’s own notice period as their reasons. The other three, the agreement to sign, the sign-in link and the enquiry reply, stay on because without them the customer cannot sign, sign in or get an answer.
• Emails with no switch. Some emails are not in the catalogue, so no switch exists for them. The catalogue also says six-monthly and annual card plans always get the card collection notice, whatever its switch says.
• The Direct Debit notice. The catalogue describes it as going out at least three working days before each Direct Debit, with the invoice attached. That is shorter than the scheme’s default above, so ask your payment provider whether it suits your customers’ mandate terms.
• Consent. A status changes when someone makes a statement, or when staff correct a yes back to not asked: ticking a box is a yes, saying no is a no, and an unticked box on a public form changes nothing. A statement that moves the status is kept with what was said, where, when and any words the person was shown.
• Who gets an offer. An offer goes to a customer who said yes and to a customer who was never asked, including one who moved in or whose record was imported as a customer. It never goes to someone who said no, or to a non-customer who never said yes.
• What the rule cannot check. It reads only the status and the kind of contact, so our reading is that it cannot itself check the conditions in regulation 22(3). A code comment calls the never-asked case the operator’s judgement as controller, and the decision record says StoreBay cannot know whether the operator offered the chance to opt out when it collected the details.
• Group messages. The operator declares each one a service update (news about their storage or account, with no offers) or an offer (which skips anyone who said no), and an omitted purpose in the API reads as an offer. The decision record says StoreBay does not read the message and that a service update carrying an offer is direct marketing whatever it is called.
• After an unsubscribe. The customer is told they will still get the messages that must be sent about their storage, and a no to offers is recorded for every contact of the operator at that address. That is a design choice, wider than the ICO’s default that an opt-out usually applies to the method used.
• Texts. The product documentation says text messages are included but not switched on today; we did not check any operator’s setting.

What this guide does not cover

• Calls, faxes and cookies. PECR has separate rules for calls, faxes and cookies, and there is a data protection fee. We did not read them.
• UK GDPR beyond the points above. Lawful bases, privacy notices and subject access requests are outside this guide.
• Advertising, mailbox and card rules. We did not check the advertising rules on promotional offers in marketing messages, any rules mailbox providers set for bulk senders, or the card-scheme reminder rule that the product cites for its card collection notice.
• Wording and strategy. This guide supplies no message wording. Where to find customers is in our guide to self storage marketing.

Questions to put to your adviser

• Is a request for a customer review, sent by email or text or as a link in another message, direct marketing on the ICO’s three questions?
• Does a referral reward scheme make you the instigator of your customers’ messages, and does yours leave the sharing to the customer?
• May you send offers under the soft opt-in to a prospect who only enquired or asked for a quote, given that the ICO’s pages are not worded alike?
• Do customers imported from another system meet the soft opt-in, and was an opt-out offered when their details were first collected?
• Does a customer who has moved out still count as an existing customer for the soft opt-in, and for how long?
• Is a waitlist alert, an enquiry thank-you or an enquiry reply solicited, and does adding an offer change that?
• Is a Direct Debit advance notice, a card collection notice or a payment reminder still a service message if it carries a line about another product?
• Which advance notice period applies to your Direct Debits, is a notice due before every collection or only the first and after a change, and can a payer agree to three working days?
• Is a storage licence within the Consumer Contracts Regulations 2013, and if so which of your messages must carry the Schedule 2 information on a durable medium?
• If the DMCC subscription rules start, will a storage licence be a subscription contract, and which notices would follow?
• Does regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002 reach your marketing emails?
• Which of your customers are corporate subscribers, and how do you treat a sole trader who writes from a company address?
• Does an email asking existing customers whether they want offers need a basis of its own?

Sources

All read on 16 October 2026.

• PECR: the Privacy and Electronic Communications (EC Directive) Regulations 2003, with regulation 2, regulation 22, regulation 23, regulation 31 and Schedule 1.
• Penalties and the regulator: the Data Protection Act 2018, section 157; the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026; and the Commencement No. 9 Regulations.
• Other law: the Electronic Commerce (EC Directive) Regulations 2002, regulation 7; UK GDPR Article 21; the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, regulation 5, regulation 13, regulation 16 and Schedule 2.
• Subscription contracts: the Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 2; the Prime Minister’s Office release PM starts roll out of everyday fixes on the cost of living of 9 August 2026; and the government response to the consultation on the new subscription contracts regime, updated 2 April 2026.
• The regulator’s name: the ICO news release ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening of 30 September 2026.
• ICO direct marketing guidance: Identify direct marketing, Plan direct marketing and Respect people’s preferences.
• ICO guidance on electronic mail: Key concepts, How do we comply and What else do we need to consider.
• ICO guide to PECR: Electronic and telephone marketing, Electronic mail marketing and What are PECR.
• Other ICO pages: Business-to-business marketing, Marketing and data protection in detail and Previously asked questions.
• Direct Debit: the Bacs FAQs and glossary, the Direct Debit Guarantee and GoCardless’s What is the Direct Debit Guarantee, last edited September 2025.
• ICO site searches run on 16 October 2026, first page of results each: review request, asking customers to leave a review, customer satisfaction survey marketing, feedback request email PECR, refer a friend, service message and review platform invitation email.

On 16 October 2026 the ICO pages How do we comply, Key concepts and Business-to-business marketing, the Bacs pages and the Direct Debit Guarantee page showed no date of their own, and the ICO’s direct marketing guidance hub shows an update on 28 April 2026.