Territorial scope is a routing decision for every outbound record. Check the person, target market, organization, and processing activity in that order. An organization can be outside the region and still fall under the rules if it offers something to people there or processes their data.1 Server location does not decide the question for cold email sent to prospects in Europe.2 Record the trigger that brings the activity into scope, then handle lawful basis and outreach execution separately.
Run the scope check
Run these checks in order. Once a trigger is clear, classify the activity and complete the remaining checks to identify the workflow and records covered by the result.
Start with the person and the record
Start with the data in the record. Ask whether it points to a person and whether the outreach activity uses that information.
Can the record identify a person directly or indirectly? Information that can identify a person in any way is covered by the regulation.3 An email address is personal data for this purpose.4 GDPR applies to B2B email marketing to individually identifiable business contacts in the EU or UK.5
Mark the record as personal data when the answer is yes. A contact's business setting does not remove the individual from the scope check.
Check the target and the offer
Identify who you are reaching and what the organization is doing with that audience. This separates a territorial trigger from a broad geographic assumption.
Offering free or paid goods or services to people in the EU or UK is an applicability test.6 Monitoring behavior there through tracking, retargeting, or behavioral analytics is another.7 If either activity is part of the processing, record it as a trigger and continue the review.
A prospect can enter the review through the intended offer, the data collected about them, or the behavior being monitored. The check therefore also covers prospects who have not bought anything.
Check the organization and its establishments
Check where the organization is established and whether the processing connects to an establishment in the region. The target's location is only one part of this review.
An organization established in the EU or UK is covered whether that establishment is an office, subsidiary, or single employee.8 An organization outside the EEA can also fall directly within the regulation when it offers goods or services in the EEA, monitors behavior there, or processes personal data connected to an EEA establishment.9
Record the establishment or market trigger that applies. If the organization has no obvious local office, check the offer, monitoring, and processing connections before classifying the activity.
Confirm the processing role
Attach the scope result to the activity itself. An organization can run different workflows, so name the processing being performed.
The first criterion is whether a controller or processor is subject to the regulation for the given processing.10 Record the entity involved and the activity that makes the question live. This gives the scope result a clear boundary for prospecting, enrichment, storage, or handoff.
Keep territorial scope separate from transfer analysis. A controller or processor subject to the regulation remains accountable for its processing even when no transfer occurs, including direct collection by a business outside the region or access to company systems from a third country.11 For a restricted transfer, the exporting controller or processor must also be subject to the regulation for the relevant processing.12
Record the decision
Finish with a plain result that another person can understand. Record the trigger, the processing activity, and the records covered by the decision.
If any one of the applicable tests is true, the regulation applies.13 Attach the decision to the workflow that created it, so a change in audience, offer, tracking, or data handling prompts a fresh review.
After the activity is in scope
The scope result tells you which processing needs a compliance review. It does not decide the legal basis or the steps a recipient can take after contact.
A legal basis is required for processing personal data.14 For B2B cold email, legitimate interest under Article 6(1)(f) is described as a typical basis when there is a legitimate business reason to contact someone professionally about something relevant to their role.15 Test that basis against the actual audience and message before the activity enters a sequence.
Include collection and rights handling in the same handoff. People need to know how and when their data was collected.16 They must be able to request copies of their data,17 and they must be able to ask for it to be edited or deleted.18 Build a route for those requests before sending, so a reply does not disappear into an individual rep's inbox.
Review whether you have permission to contact people alongside the method you plan to use.19 The channel can be a call, an email, or another form of outreach, while the underlying processing still needs its own scope and legal basis decision.
Turn the result into an outbound review
Once the activity is in scope, use the decision to narrow the audience and the fields you keep. The review should change what enters the workflow.
Send cold outreach only to people who can benefit from the product.20 For each field, ask what purpose it serves and whether the activity needs it. Personal data should be adequate and relevant to the purpose of processing, so assess how much data you collect and whether it is the right data for the intended use.21 Remove fields that have no clear job in the outreach process.
Keep the trigger visible when the record moves between systems or people. That makes it possible to explain why the record was included, which market or establishment brought the activity into scope, and which processing the review covered.
What not to do
These mistakes come from treating one signal as the whole scope test. Keep the review attached to the person, audience, organization, and processing activity.
- Do not assume the regulation applies only to sales teams that rely on online sales tactics.22
- Do not treat a mobile call to a European prospect as outside your responsibilities.23
- Do not describe the regulation as a total prohibition on cold calling.24
- Do not buy a list of random European contacts and send mass outreach to them.25
Classify each outbound activity by the trigger that brings it into scope, preserve the reason for that decision, and pass the record into the legal basis and rights review. When a specific status or requirement remains unclear, consult a lawyer familiar with the regulation.26