GDPR and Cold Email: What B2B Senders Must Do

Cold email to a business contact is lawful under the GDPR across most of Europe. The GDPR is only half the test. A second law, each country's ePrivacy implementation, decides whether you may send at all, and the answer changes at the border. Germany requires prior consent. The United Kingdom does not.

That split is the part most outbound programmes get wrong. Teams read the GDPR, conclude that legitimate interest covers them, and send into seven markets where a national statute says otherwise. Cresco publishes the country-by-country position we work to, and we built a market checker so a prospect can test it before they talk to us.

Does the GDPR ban cold email?

No. The GDPR is a data protection regulation. It governs how you collect, store and use personal data, including a work email address that identifies a person. It does not, by itself, prohibit sending a commercial message.

Article 6 lists the lawful bases for processing personal data. Direct marketing normally relies on 6(1)(f), legitimate interests. Recital 47 says plainly that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. That is the clause every compliant B2B outbound programme in Europe rests on.

What legitimate interest actually requires

Legitimate interest is a test, not a declaration. Three parts, all of which you should be able to show on request:

• Purpose. You have a real commercial interest in contacting this person. Selling a service they plausibly buy qualifies. Building a list for its own sake does not.
• Necessity. Contacting them directly is a reasonable way to achieve it. If a public signup would do, direct marketing is harder to justify.
• Balance. Your interest does not override their rights. A role-targeted message to a facilities manager about facilities work sits very differently from a personal address contacted about something unrelated to their job.

A worked example of the balancing test

Take a commercial cleaning contractor writing to a named facilities manager at a 400-person office, about office cleaning. The purpose is commercial and real. Direct contact is a reasonable route, because facilities managers do not browse for contractors in public. The balance favours the sender: the message concerns the exact thing this person is paid to manage, it arrives at a work address, and the opt-out ends it in one click.

Now change one variable. The same contractor writes to a personal Gmail address found on a membership directory, about a service unrelated to the recipient's role. Purpose is unchanged. Necessity is weaker. The balance now runs the other way, because the recipient had no reason to expect commercial contact at that address about that subject.

Nothing about the sender changed. The targeting did, and the targeting is what the test is actually measuring. This is the useful part of the rule: tight targeting and legal defensibility turn out to be the same work.

The second law most senders miss

Here is the part that catches people. Satisfying the GDPR does not give you permission to send. Each country also implements the ePrivacy Directive, and that national law governs unsolicited electronic marketing directly.

Three examples of how far apart they sit:

• United Kingdom. PECR treats limited companies, LLPs and public bodies as corporate subscribers, so B2B email is lawful without prior consent. Sole traders are not, and we exclude them.
• Germany. Consent is required before emailing a business, and German law gives business recipients no exemption at all.
• France. B2B is permitted where the message genuinely relates to the recipient professional role.

Three countries, three different answers, one regulation shared between them. Any guide that gives you a single European rule for cold email is describing the GDPR and ignoring the law that actually decides the question.

GDPR or ePrivacy: which one applies to you?

Both, at the same time, for different things. The distinction is worth holding clearly because it determines what a complaint would be about.

A sender can be fully GDPR-compliant in how they built the list and still be sending unlawfully, because the second question has a different answer in their target market.

Where your list came from matters

Provenance is the quietest failure point in outbound, and the one that turns a single complaint into a broader problem. The GDPR requires that where personal data was not obtained from the person directly, you tell them its source. A recipient who asks where you got their address is exercising a right, not being difficult, and a sender who cannot answer has a documentation problem rather than a legal one.

Two practical consequences for how a list gets built:

• Record the source per record, not per campaign. "Scraped from the web" is not an answer. "Company website, published contact page, collected on this date" is.
• Treat bought lists as higher risk. You inherit whatever basis the seller had, and you usually cannot verify it. If a vendor cannot tell you how each record was collected, you cannot tell a recipient either.

Your privacy notice has to be reachable from the message and has to describe the category of source honestly. This is cheap to do at setup and expensive to retrofit across a list of thousands.

What belongs in every compliant B2B cold email

Across every market where sending is permitted, three requirements hold. They are not onerous, and they are the first thing a regulator looks for.

1. Honest identification. Your real company name and a contact address. No disguised sender, no misleading subject line about who is writing.
2. A working opt-out. One that functions the first time, is honoured promptly, and does not require the recipient to log in or reply to a monitored-only address.
3. Role relevance. The message relates to what the recipient does at work. This is a legal point in France specifically, and a balancing-test point everywhere else.

Where we will and will not send

We publish our position because most agencies do not, and because a client who asks the question deserves an answer they can check. Our live market checker gives the verdict and the named legal basis for each market we work in.

In short form: we run email and LinkedIn into the United States, the United Kingdom, Ireland, the Netherlands, Sweden, Norway and Finland. France is conditional, permitted where the message genuinely relates to the recipient's professional role. Germany, Austria, Spain, Italy, Poland, Belgium and Denmark are LinkedIn only. We route those markets to LinkedIn and do not send email, because consent is required first and we will not expose a client to a complaint to save a step.

That constraint costs us work. We think declining seven markets in writing is a better signal than a compliance page nobody reads, and it is the clearest way we know to show how our outbound programmes are actually run.

What to establish before you buy outbound

If you are evaluating an outbound provider, four questions separate the ones who have thought about this from the ones who have not.

• Which markets will you send email into, and which will you not? A provider who says "all of Europe" has not read the national laws. Ask them to name a market they decline.
• What is the lawful basis, in writing? Legitimate interest is a reasonable answer. "Everyone does it" is not.
• How is each record sourced, and is that recorded? If they cannot tell you, you cannot tell a recipient who asks.
• Who holds the risk if a complaint lands? The complaint goes to the sender on the envelope, which in most arrangements is you.

Not legal advice. Where your situation is borderline we will say so and recommend you take advice first. If you want the specifics for a market you are targeting, the checker covers fifteen of them, and you can bring us the rest.