GDPR Compliance Requirements for B2B Cold Email Outreach
Legitimate interest lets you reach B2B prospects legally if you document it properly first.
GDPR compliance for B2B cold email outreach depends on a documentable process. Teams can contact EU prospects legally when they establish a lawful basis, meet the applicable national sending rules, explain their use of personal data, and manage that data responsibly. Compliance must be built into the campaign before the first message leaves.
Why GDPR does not ban B2B cold email but does impose real obligations
GDPR prohibits processing personal data without a lawful basis. It does not prohibit cold email as a channel. A named work address such as jane.doe@company.com identifies an individual and therefore counts as personal data, while a generic address such as info@company.com typically does not. Most prospect lists enter GDPR’s scope as soon as they contain named contacts.
The sender’s location does not remove these obligations. US-based outbound teams selling into Europe must account for GDPR when processing the personal data of EU or EEA prospects. The practical problem is often that teams cannot explain why their outreach qualifies for a lawful basis. That gap leads some to abandon outreach unnecessarily and others to send without the documentation needed to defend it.
Two separate legal instruments govern every cold email sent to EU recipients
GDPR governs whether a team may collect, store, and use a contact’s personal data. The national law implementing the ePrivacy Directive governs whether it may send the marketing message. These are separate tests, and both must pass. A sound justification for holding an email address does not automatically authorize its use for unsolicited advertising.
The ePrivacy Directive takes precedence as lex specialis for the act of sending electronic marketing. Its national implementations make the recipient’s country an essential campaign variable. A vendor’s claim that a list is “GDPR-compliant” addresses, at most, the data layer and does not establish whether the marketing message may be sent. A campaign may therefore have a valid legitimate interest basis under GDPR and still need prior consent under national communications law.
How the legitimate interest basis actually works and what makes it defensible
Article 6(1)(f) sets out the legitimate interest basis that teams often use for B2B prospecting. GDPR Recital 47 makes clear that direct marketing can be a legitimate interest, but teams still need to show that it applies to their campaign. The basis requires a three-part test covering purpose, necessity, and balancing. Teams must apply it before sending.
Purpose means identifying a specific business reason to contact this recipient. Pitching sales automation to a Head of Sales has a clear connection between the offer and the person’s role. Pitching office cleaning services to a software engineer does not. Necessity then asks whether email is a reasonable and proportionate way to pursue that purpose. An ordinary business communication channel can support that case, but it cannot repair an irrelevant offer.
Balancing asks whether the recipient’s rights and reasonable expectations outweigh the sender’s interest. A VP of Sales can reasonably expect pitches about sales tools, while pitches that have no link to the role are harder to justify. Professional relevance is the central distinction here. An approach to a Head of Procurement about supply chain software presents a different case from the same pitch to a private individual. Sole traders require particular caution because several jurisdictions treat independent consultants, freelancers, and one-person businesses as private individuals.
What a Legitimate Interest Assessment is and why teams need one per campaign
A Legitimate Interest Assessment, or LIA, records how a campaign passed the three-part test. GDPR does not expressly require a document with that name, but accountability requires evidence supporting the chosen lawful basis. An undocumented assertion offers little to examine during an investigation. For most B2B cold email campaigns, a single page can record the necessary reasoning.
That page should state the specific purpose, such as “offering a sales engagement tool to sales leaders at mid-size SaaS companies.” It should explain why email is necessary and proportionate, then describe why the recipients’ privacy rights do not override the outreach interest. The assessment must be campaign-specific. A campaign targeting CFOs about financial software needs its own reasoning, separate from one targeting IT Directors about security tools.
The non-negotiable content requirements every compliant cold email must contain
The LIA documents the decision to process data before sending. The email itself must make that processing transparent to the recipient. Each message needs the sender’s full name, company name, business address, and a way to make contact. An anonymous identity, generic sender name, or no-reply address does not provide the required identification and contact route.
The message should explain how the recipient’s data was obtained and why the offer is relevant to their professional role. This explanation serves a different purpose from the internal assessment. It gives the recipient enough context to understand the approach. A one-click privacy policy link should lead to an explanation of the data held, the purpose of processing, and legitimate interest as the legal basis. The policy itself need not be reproduced in the email.
Every message also needs a clear, easy opt-out. An unsubscribe link or a “reply STOP to be removed” instruction provides a direct route, with automated unsubscribe preferable at scale. Recipients have this right even when the sender still thinks the offer is relevant. Once the recipient opts out, further outreach defeats the control the message promised. These requirements apply to follow-ups as well as the first approach.
Data sourcing, retention, and the obligations that apply before you hit send
RevOps and SDR managers own the operational decisions needed to keep a prospect list compliant. Article 5(1)(d) requires personal data to be accurate. A legitimate interest assessment does not cure outdated or invalid records. Teams must be able to explain where each contact came from and when, whether the source was a public business register, company website, professional profile, or reputable B2B database.
When teams buy data, they must check the provider’s lawful basis. The buyer’s obligation does not disappear when a vendor supplies the records. Teams should use work addresses rather than personal accounts and remove sensitive enrichment data, including religion, health, political views, and sexual orientation, before contact. Enrichment services, email platforms, and CRMs also introduce processor or sub-processor documentation and due-diligence obligations.
Retention needs a defined endpoint for inactive contacts. A 12-to-24-month period is a reasonable outer limit to consider, with some national guidance allowing three years specifically for B2B prospect data. Teams must keep opt-outs on a permanent global suppression list that covers all campaigns and channels. Teams also need a process for data subject access requests, or DSARs. That process must bring together requests from individual inboxes so teams can give access, make corrections, and delete data within the applicable legal deadline.
How EU country rules diverge and which markets require extra caution
The European Commission withdrew its proposed replacement for the ePrivacy Directive in February 2025. Teams will therefore have to work with rules that differ from country to country for the foreseeable future. Country segmentation is not merely a targeting choice. It determines which sending rules the campaign must satisfy.
Under Germany’s Section 7 of the Unfair Competition Act, or UWG, email advertising without prior express consent is unreasonable harassment for both B2B and B2C. The German Federal Court of Justice has ruled that single opt-in is insufficient evidence of consent, making double opt-in the de facto standard. A single unlawful email can also prompt an Abmahnung, a formal cease-and-desist letter from a competitor or consumer body, typically with legal fees attached. This exposure is separate from regulatory fines. Teams that target a large German market should consider an inbound motion or LinkedIn outreach instead, while keeping GDPR controls in place for contact data.
Italy also generally requires prior consent for B2B email. It needs a separate consent review rather than a standard legitimate interest workflow alone. The UK, meanwhile, operates under UK GDPR and the Data Protection Act 2018, with enforcement by the ICO. Its framework is closely aligned with, but distinct from, EU GDPR. Campaign planning must also confirm the applicable implementation in Denmark, Sweden, and Finland rather than treating a regional label as sending permission.
What the EU AI Act's Article 50 requirements add for AI-assisted outreach
The EU AI Act entered into force in August 2024, with Article 50’s transparency requirements applicable from August 2026. These add a layer for AI-assisted outreach alongside GDPR and ePrivacy. Teams must distinguish the applicable AI transparency obligation from the existing justification for processing contact data. Disclosure does not authorize an otherwise unlawful send.
The “obvious from context” exemption cannot simply be assumed for a personalized email arriving from a named salesperson at an unfamiliar company. That differs from a clearly labelled AI chatbot. For applicable machine-readable marking requirements, a header or metadata field is one implementation path, although most commercial sending platforms do not yet implement this natively. Teams should ask vendors about their implementation roadmap. AI enrichment and sequencing also add model APIs and other services that handle EU personal data to the processor chain, and teams must keep the required documentation for each one.
The enforcement reality and what it costs
Maximum GDPR fines can reach €20 million or a percentage of global annual revenue, whichever is higher. Cold email enforcement has also produced penalties in the tens of thousands to hundreds of thousands of euros. The maximum is not the only meaningful exposure.
CNIL fined Orange SA in November 2024 and made the decision public in December 2024, notably because it had placed advertisements between users’ emails without consent. The conduct was more specific than ordinary cold outreach. It nevertheless shows the consequences of treating access to an inbox as permission to advertise. The Irish DPC’s October 2024 action against LinkedIn also addressed behavioral advertising practices, reinforcing the importance of a defensible basis for using personal data.
These cases should not be mistaken for penalties against every imperfect sales email. The broader enforcement pattern concerns undocumented data sourcing, consent failures, ignored deletion requests, and repeated disregard of opt-outs. Documentation and execution must agree with each other. A campaign-specific LIA supports the processing decision, sourcing records explain the list, and suppression controls make the recipient’s objection effective.
A practical compliance process teams can build into their outbound workflow
Compliance must be a campaign gate owned by RevOps and outbound teams, with documentation in place before legal concerns arise. Much of the supporting setup is reusable. Before each launch, the team should complete the campaign-specific LIA, review source records and accuracy, remove sensitive data and personal email addresses, and confirm national sending rules. German and Italian recipients need separate review rather than automatic inclusion in a general EU sequence.
Message templates should then incorporate the identification, sourcing explanation, relevance statement, privacy link, and opt-out requirements. Teams should also check any AI disclosures they need to include. After launch, every opt-out should enter the global suppression list immediately. A defined retention schedule and DSAR process should cover the systems where contact data lives, while vendor reviews should include data processor agreements for enrichment providers, email platforms, CRMs, and AI APIs.
Smartlead automates one-click unsubscribe and physical address insertion, while its SmartProspect feature supplies verified prospects to reduce bounce rates and support data accuracy. Derrick offers GDPR-conscious B2B enrichment with data that is publicly available and publishes guidance on data subject rights and how to keep enrichment in line with the rules. These functions support the workflow without replacing the campaign’s legal assessment. Compliant outbound is operationally achievable and can compete effectively by avoiding the enforcement and deliverability risks that accumulate when teams skip these controls.
