UK GDPR and postcards to your customers: consent, objections and the MPS

Why the email rules don't apply to postcards

The Privacy and Electronic Communications Regulations (PECR) set the consent rules for marketing by email, text and phone. The ICO’s own summary lists postal marketing as “not covered by PECR”. So the soft opt-in question you ask for email does not arise for a postcard. Post falls under UK GDPR, and for marketing by post the ICO names legitimate interests or consent as the likely lawful basis.

Legitimate interests: the three-part test

UK GDPR Article 6(1)(f) lets you process personal data for your legitimate interests, unless the person’s interests override them. Since 5 February 2026, Article 6(11)(a) names “processing that is necessary for the purposes of direct marketing” as an example of a legitimate interest. That is an example under the existing test, not an exemption from it. The ICO asks you to show three things:

Purpose: you have a real interest, such as selling to past customers.
Necessity: posting to them is a reasonable way to pursue it.
Balance: your interest is not outweighed by theirs. A customer with a recent order expects to hear from you; someone who never bought, or a child, is a different case.

Write the assessment down and keep it. The ICO’s worked example is a theatre that posts its summer programme to past attendees who have not objected: it decides the impact is minimal, includes details of how to opt out, and relies on legitimate interests.

Tell customers before you post

Your privacy notice, given when you collect a customer’s details, should say that you may send marketing by post and that they can object at any time. UK GDPR Article 21(4) and CAP Code rule 10.13 ask you to bring the right to object to the person’s attention explicitly, set apart from other information, no later than your first communication with them. A short line on the card does that job, for example: “Prefer not to get post from us? Email hello@yourbrand.co.uk and we’ll stop.”

An objection is final

Under Article 21(2) and (3), anyone can object to direct marketing at any time, and you must stop. In the ICO’s words: “There are no reasons that you can use to refuse their objection”, and objecting must be free. Keep the person’s details on a do-not-mail list rather than deleting them, so a later import cannot bring them back.

An email unsubscribe stops email. If the person told you to stop all marketing, treat that as an objection to post as well. If you are not sure which they meant, leave them out of the postcard send.

The Mailing Preference Service

The Mailing Preference Service (MPS), run by the Data & Marketing Association, lists people who do not want unsolicited addressed mail. Its own FAQ says registering “will not stop mail from companies that you are a customer of, nor if you have requested their mailings”. For mailers, the MPS says “all mailers should ensure that their non customer mailing lists are screened” against its file, and that screening is a condition of the DMA Code and the CAP Code. CAP Code rule 10.10 asks marketers to run databases against relevant suppression files before use. The ICO says you should check names against the MPS, adding that it is not a statutory service.

In practice: posting to your own customers is outside what the MPS blocks; any list of people who have not bought from you needs screening before you mail it. CAP Code rule 10.11 also asks you to stop mailing anyone reported to you as having died.

How TouchDrop handles your list

TouchDrop mails the audience you choose and applies your sending rules on top. As built today:

It mails only the people in the segment, list or trigger you pick. It does not read email consent or unsubscribe status from Klaviyo or Omnisend, so choose audiences you are allowed to post to.
A do-not-mail flag per person, checked before every print batch. To add someone, email support@touchdrop.com.au with their email address and we flag them.
A 45-day cooldown after each card, shared across your campaigns, and a cap of 3 cards per person in 90 days. Both are defaults you can change per campaign.
One card per person per campaign, however often they re-enter a flow.
Address checks before print; parcel lockers and collection points are removed.
It does not screen against the MPS or any deceased register. Screen non-customer names yourself before you upload them, and send us anyone reported as deceased.
Your customer data is never sold and is shared only with our print partner to produce your cards.

A checklist before your first UK send

Confirm everyone on the list bought from you or asked for your mail.
Write a short legitimate interests assessment and file it.
Check your privacy notice mentions marketing by post and the right to object.
Add an opt-out line to your card artwork.
Remove anyone who objected or asked you to stop all marketing, and send TouchDrop that list.
Screen any non-customer names against the MPS before you upload them.
Remove anyone reported to you as deceased.

Frequently asked questions

Can I send a postcard to a customer who unsubscribed from my emails?

Often yes. An email unsubscribe stops email, and post follows UK GDPR rather than PECR. If the person asked you to stop all marketing, though, that is an objection, and you must not post to them either. This is not legal advice.

Do I have to screen my customer list against the MPS?

The MPS says registration does not stop mail from companies the person is a customer of, and that non-customer lists are what must be screened. The ICO advises checking names against the MPS before sending, and some industry codes require it. If your list mixes customers and non-customers, screen it.

Do I need to put an opt-out on the postcard?

Article 21(4) of UK GDPR and CAP Code rule 10.13 ask you to make the right to object clear no later than your first communication. A one-line opt-out on the card covers that, and the ICO's worked example includes one.

Does TouchDrop share my customer list with anyone?

No one buys it. TouchDrop shares your recipients' details only with its print partner, to produce your cards.

Sources checked 7 October 2026: ICO, legislation.gov.uk, the CAP Code and the Mailing Preference Service, linked below. The ICO says its direct marketing guidance is under review after the Data (Use and Access) Act and may change.