GDPR Lawful Basis Legitimate Interest: B2B Cold Email Guide

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. The four inputs that decide your balancing test# “Public professional sources and vendor databases with disclosed provenance are defensible.” Role relevance. Targeting by job function is the strongest signal that you had a reason to contact this person rather than 40,000 random people.

   In Lead source provenance

2. Lawful basis Realistic B2B use Effort to rely on Right to object? Verdict for cold outbound Consent — Art. 6(1)(a) Newsletter sign-ups, gated content, event lists High — granular capture, timestamped proof, easy withdrawal Withdrawal, any time Only works for inbound-generated contacts Contract — Art. 6(1)(b) Onboarding, billing, support for existing customers Low No Never covers prospecting Legal obligation — Art. 6(1)(c) Tax records, KYC, statutory retention Low No Irrelevant to marketing Vital interests — Art. 6(1)(d) Life-or-death emergencies N/A No Not applicable Public task — Art. 6(1)(e) Public authorities only N/A Limited Not applicable Legitimate interests — Art. 6(1)(f) Cold email, enrichment, lead scoring, account research Medium — documented LIA + Art. 14 notice + opt-out Absolute for direct marketing (Art. 21(2)) The only workable basis, if you do the work “your suppression list has to be a system of record, not a spreadsheet somebody forgets to import.” What is the three-part test, exactly?#

   In System of record design