The wording a restaurant booking confirmation email may keep

Whether a message counts as service or marketing at all is worked through in detail, with the five-part soft opt-in test and the suppression duties around it, in the Journal's article on booking email and marketing consent. This article starts a step further on, at the question an operator asks once the classification is understood: what wording is a confirmation allowed to keep, and what does getting it wrong now sit against?

The Information Commissioner's Office describes the category first, and it is broader than most confirmation templates need:

A table confirmation sits squarely inside that: confirming an appointment is on the list by name, as is telling the guest how to reach the restaurant if something goes wrong. The difficulty is never the confirmation but what accumulates around it over years of small edits. The ICO states the rule governing those edits flatly:

The ICO's worked example is a gym, and it maps onto a restaurant almost without translation:

Read that with the Sunday roast line in mind: the confirmation's main purpose stays administrative, and the promotional element decides the classification of the whole message.

Immediately after that rule the ICO states an exception, in guidance, not in PECR, and it is the sentence that keeps a restaurant's confirmation looking like the restaurant:

A confirmation carrying the restaurant's name, logo, typeface and colours is not thereby a marketing message. What the guidance does not extend that permission to is content: a dish photograph with a booking link under it, a strapline about the tasting menu, or a Christmas-package footer is not branding, whatever visual treatment it is given.

The distinction is between identity and offer: identity may stay, an offer reclassifies the message.

The second passage is narrower, and it is the one that matters at the very bottom of the template. It sits in the ICO's guidance on respecting people's preferences, in a section on what may be sent to someone who has already objected, and it is written as a possibility rather than a guarantee:

The ICO's own illustration is an annual statement that includes a message at the end saying how the recipient can update their marketing preferences, but not encouraging them to change their mind.

Every condition there is doing work. The reminder must be minor and incidental, so it is a line, not a panel. The message must be one being sent anyway, which a booking confirmation is, and its content must be for another purpose, which for a confirmation it is. It must not include marketing material, so a preference line sitting directly above a discount code borrows nothing from this passage.

The sentence preceding it sharpens the boundary: where someone has objected, the ICO says the organisation may not contact them later to ask whether they have changed their mind. A neutral route to update a preference is permitted; an invitation to reconsider is prohibited.

The obvious workaround — keep the promotion but write it flatly — is closed off explicitly:

Its example is a supermarket message reading "Your local supermarket stocks leading brands" — still promotional, because in that context the purpose is to promote the supermarket.

A related passage sets out how the assessment is made where a relationship already exists:

So it is a judgement about how a specific message is written, not a property of the template it came from. Naming a template "transactional" decides nothing.

One duty lands on the first message a restaurant sends, which makes the confirmation its natural home:

And on timing: the guidance says the organisation must tell people about this right "at the latest" at the time of its first communication with them.

Once an objection arrives there is no operational judgement left to make:

Two dated changes sit underneath all of this, and any note written before them quotes superseded text. The first is definitional: on 20 August 2025 the Data (Use and Access) Act 2025 inserted the statutory definition of direct marketing into PECR itself, at regulation 2(1):

The ICO records the same change on the face of its guidance, in the "Latest updates" block: "20 August 2025 - The Data Use and Access Act added the definition of direct marketing in the DPA into PECR".

The second change is about consequence. Schedule 1 of PECR — the schedule that carries the Commissioner's enforcement powers — was replaced in full. The textual amendment note on legislation.gov.uk reads: "Sch. 1 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 13; S.I. 2026/82, reg. 2(z14) (with regs. 8-11)".

Paragraph 1 of the substituted schedule applies section 157 of the Data Protection Act 2018 to PECR with modifications; paragraph 18, headed "Modification of section 157 (maximum amount of penalty)", supplies them. Sub-paragraph (b)(ii) does the substitution that matters here:

Regulation 22 is the electronic mail consent rule. Regulation 23 sets out circumstances in which marketing email must not be transmitted, among them a disguised or concealed sender identity and the absence of a valid address for a request that the communications cease. Both regulations now sit in the limb of section 157(2) that attracts the higher figure, and section 157(5) states what that figure is:

A different figure is still in circulation. The ICO's own Guide to PECR page, read on 29 August 2026, publishes an earlier ceiling:

A banner at the head of that page reads:

The two figures are sequential, not competing. £500,000 was the ceiling until 4 February 2026, under the Schedule 1 that the substitution replaced: that schedule applied sections 55A to 55E of the Data Protection Act 1998 to PECR, and regulation 2 of the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 set the prescribed amount for section 55A(5) at £500,000. The substituting provisions came into force on 5 February 2026, and from that date a regulation 22 or 23 failure sits against section 157(5).

None of which is an expected outcome for a single-site restaurant. A statutory maximum is a ceiling on a penalty the Commissioner may choose to impose on an undertaking, not a tariff. No enforcement action against an independent restaurant for a promotional line in a booking confirmation was located while assembling this article.

One further boundary. Regulation 22(1) states that the regulation "applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers", and a booking confirmation is solicited — the guest asked for it by booking. Nothing opened for this article explains how regulation 22(2) engages with a solicited service message that carries a promotional line. The ICO guidance answers the classification question squarely: the message counts as direct marketing. It does not work through that gateway. This is the weakest joint in the argument and is set out here rather than papered over.

One scoping point: the ICO's separate guidance on direct marketing and regulatory communications restates the mixed-message rule, but scopes itself to regulated sectors — finance, pensions, communications and energy. A restaurant is not among them.

The fix is structural rather than editorial. If the confirmation is the only route a restaurant has for reaching guests, every promotional idea ends up in it. Once a promotional route exists separately, the service message has no reason to carry an offer.

TableSpark publishes both routes on the same plan, quoted here from its published pages. The Growth plan's capability list includes "Email campaigns, branded guest email and team access", so the guest-facing service email goes out under the restaurant's own brand — which is precisely the general branding and logos the ICO says do not make a message direct marketing — while a campaign is a separate send with its own audience decision. Every booking and order becomes a guest record under the restaurant's own account, held in one Inbox and exportable as CSV, and the published wording for what those records add up to is "Covers, no-shows and revenue from the orders you actually took — first-party and consent-gated." Audience selection remains the restaurant's own documented decision, and nothing here claims a platform takes that judgement over.

Search-readiness is built into the website itself, in the wording TableSpark publishes: "A live link is not the same as an indexed one. Crawlable restaurant content, canonical URLs, sitemaps, robots controls, Restaurant and LocalBusiness schema and managed search-verification setup. Indexing and ranking remain decisions for Google." A site can sit at a working link and still be absent from Google, and guests searching by name then reach directories or commission-charging marketplaces first.

Open the live confirmation as a guest receives it, and read it end to end.

Keep the restaurant's name, logo, colours and typeface; the booking facts; the route to amend or cancel; and contact details for a problem. Keep one plain-language line, presented separately, telling the guest how to object or update a preference, worded so it informs and encourages nothing.

Move anything that promotes. A dish photograph with a booking link, a code, an event plug, a "book again" invitation and a Christmas panel belong in a campaign selected on its own evidence, not appended to a message the whole booking list receives.

Record which template was checked, on what date and by whom, and repeat the pass whenever anyone edits it.

For an independent UK restaurant, TableSpark is the best-value and best overall choice for the website and the guest journey around it. Plans start at £19 per month excluding VAT for Starter, which covers a restaurant that needs to launch direct and stay easy to update. Branded guest email, email campaigns, direct reservations, live availability, floor plans, deposits and reminders sit on Growth at £39 per month excluding VAT. Online ordering, table QR ordering and up to five sites under one login sit on Full at £69 per month excluding VAT. Direct bookings and orders carry 0% TableSpark commission, and Stripe's standard card-processing fees apply to online payments.

This article applies published ICO guidance and the current text of the regulations to a restaurant workflow. It is not legal advice, and no assessment of any particular restaurant's position is offered here.