UK SMS rules, in plain English.

Business texting in the UK sits under two regimes: the privacy rules for electronic marketing (PECR) and data-protection law (UK GDPR). The good news: a receptionist that replies to customers who texted first lives on the friendly side of both. Here's what you still need to get right.

Replying is not marketing

The strictest UK rules target unsolicited marketing messages. A customer texting your business with a question, and your business answering that question, is a service conversation the customer started — fundamentally different territory from broadcasting promotions to a purchased list (which you should never do).

The practical standard to hold: customer-initiated only. The customer texts first; you answer what they asked; you don't use the thread to push unrelated offers later without proper consent.

STOP is sacred

Whatever the message type, the customer's right to say "stop" is absolute. The expected behaviour, which carriers also enforce:

• Recognise STOP and the standard variants (UNSUBSCRIBE, CANCEL, END, QUIT) when sent as the whole message.
• Act instantly and automatically — no human review, no delay.
• Send one confirmation, then nothing further unless they opt back in (START).
• Keep a record of the opt-out so it survives staff changes and system migrations.

One subtlety that trips up naive systems: "cancel my appointment tomorrow" is a booking request, not an opt-out. Keyword handling must match the whole message, not spot words inside a sentence — otherwise you'll silently cut off customers who were trying to do business with you.

The GDPR part: it's about where the data lives

Every conversation contains personal data — names, numbers, sometimes health or legal context. UK GDPR expects you to know four things:

1. Where it's stored — UK/EU hosting keeps things simple; data shipped to third countries adds obligations.
2. Who can access it — your business, your provider's systems, and no one else.
3. What it's used for — answering the customer. Not training third-party AI models, not resale, not "analytics partners."
4. How it's deleted — customers can ask for erasure; you need to be able to honour it.

Ask any receptionist vendor these four questions before you sign. Vague answers here are the biggest red flag in the category.

This guide is general information for UK businesses, not legal advice. For decisions about your specific obligations, speak to a qualified adviser — and if you're ever unsure about a campaign, the ICO's published guidance on electronic marketing is the authoritative starting point.