Article
Cold Email and GDPR: What B2B Companies Need to ...
leadriver.io
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
For the GDPR side of cold email, the lawful basis almost every B2B sender relies on is legitimate interests under Article 6(1)(f). This is not a loophole. Recital 47 of the GDPR explicitly names direct marketing as a purpose that may qualify as a legitimate interest, so the law anticipates exactly this use. “The necessity test asks whether processing this personal data is actually necessary to achieve it.” In practice, a strong legitimate interests assessment is also your best defence if a complaint ever arises. It shows you thought about proportionality before you pressed send, which is precisely what regulators want to see.
A practical compliance checklist for 2026 “Make sure each contact is genuinely relevant to what you are offering, because relevance is what makes your legitimate interests assessment hold up.” Identify yourself honestly in every message, include a clear opt-out, and suppress anyone who objects before your next send. Keep a permanent do-not-contact list and screen against it every time. Be ready to explain, on request, how you obtained someone's details. And before you enter a new European market, check that country's specific rules rather than assuming the UK position travels.
The EU is not one rule: country differences that matter “GDPR is an EU-wide regulation, but the ePrivacy rules that govern electronic marketing are implemented country by country, so cold email legality varies significantly across Europe.” Germany sits at the strict end. Under its Act Against Unfair Competition, commercial email to businesses generally requires prior consent, which makes pure cold email to German prospects legally risky and pushes most senders towards LinkedIn or warm introductions instead. France is more permissive for B2B prospecting, broadly allowing cold email to professional contacts provided you disclose the source of the data, make the commercial nature of the message clear, and include a working unsubscribe. The Netherlands, the Nordics, and Ireland each sit at different points on that spectrum.