Cold email to EU contacts can be lawful when the sender meets the required conditions.1 An email address is personal data, so outreach needs a lawful basis.2 That basis is only one part of the check. Transparency duties, the right to object, national ePrivacy rules, the audience, and the message context also affect legality.3 Before sending, identify the data, choose the basis, check the channel rules, and make the message and opt-out path easy to defend.
Run the check in order
Work through these checks before approving copy or launching a sequence. Stop when you cannot explain the decision in plain language.
First identify whose data you are using and which jurisdiction governs the contact. Anyone who decides to process data must consider whether personal data are involved and identify the obligations that follow.4 If you send cold emails to prospects in Europe, or your company is based there, GDPR applies regardless of where your servers are located.5
Ask which person, address, and country are in scope. Record the answer with the planned message so the basis and jurisdiction stay connected to the send.
The basis should explain why the outreach is allowed and why this recipient belongs in the send. A label alone is weak, so the reasoning should stand up to a direct question. Consent and legitimate interests are commonly used lawful bases for marketing and lead generation.6 Consent means the individual has explicitly agreed to receive the communications.7
Legitimate interest applies when processing is necessary for a business or organisation's interest and the individual's interests do not override it. Write down both parts of that judgment.8 The GDPR's Recital 47 states that processing personal data for direct marketing can be a legitimate interest of the controller.9 A relevant and proportionate relationship between the person and the organisation can support that interest.10
Ask why this message is relevant to the recipient, why using the data is necessary, and what would make the individual's interests take priority. If you cannot answer, pause the send and revisit the basis.
Check electronic marketing separately from the GDPR basis. The same contact can pass one question and still require a different answer under the rules for the channel. The EU ePrivacy Directive covers electronic communications and privacy, including consent for marketing communications.11 The ePrivacy Directive and PECR set specific standards for processing personal data through electronic communications and other marketing tactics in the EU and UK.12
Ask which national ePrivacy rule applies to the recipient, channel, and message. Keep that answer with the campaign record. General GDPR approval does not tell you which local electronic marketing requirement applies.
Give the recipient enough context to understand the contact and a practical way to stop future messages. Cold emailing under GDPR conditions includes providing a clear opt-out link and protecting the data.13 Build this into the message before sending, and honor opt-outs when they arrive.14 The recipient should be able to see how to object without searching for an answer, and the process receiving the request should be able to act on it.
Compliance continues after the message is sent. Review how the data entered your process, how your team uses it, and which records support the decision. Personal-data processing must be lawful, fair, and transparent.15 Before launch, review website and landing-page form language, data transfer procedures, lead capture processes, and the related documentation.16
Another person on the team should be able to explain where the data came from, why it is being used, and which decision supports the send. If that is unclear, fix the process before adding more contacts.
What not to do
These shortcuts create avoidable problems in a European outbound motion.
- Assume cold email is forbidden under GDPR.17
- Treat a CAN-SPAM-compliant list as automatically valid for European marketing.18
- Treat an available address as proof of consent. Consent requires the individual's explicit agreement to receive communications.7
Approve a send only when you have a written reason for the basis, a jurisdiction check for the recipient, and a working opt-out route. When a specific status or requirement remains uncertain, consult a lawyer familiar with the regulation.19