GDPR Cold Email: Prospect Within the Rules

B2B prospecting by email is common, legal in many situations and still one of the easiest ways for a business to get privacy rules wrong. GDPR cold email questions come up constantly: can we email people who never signed up? What must we tell them? What happens when they object? The answers depend on where recipients are, whether they are individuals or companies, and how their data was collected. This guide explains the main GDPR principles that apply to B2B outreach, how email marketing rules sit alongside them, and the practical controls that keep prospecting within the rules. It is general information, not legal advice; take advice for your specific markets.

Two sets of rules apply

Cold email in Europe and the UK is usually governed by two layers of law:

• Data protection law, such as the GDPR, which covers collecting, storing and using personal data, including names and work email addresses of individuals
• Electronic marketing law, such as the UK's Privacy and Electronic Communications Regulations (PECR) or national laws in EU countries, which set specific rules for sending marketing emails

You need to satisfy both. Meeting GDPR requirements does not automatically make an email lawful under marketing rules, and the reverse is also true. Rules for B2B emails differ between countries, so check each market you target.

Lawful basis for GDPR cold email

Under GDPR, every use of personal data needs a lawful basis. For B2B prospecting, the basis most often considered is legitimate interests. Article 6 of the GDPR allows processing that is necessary for the legitimate interests pursued by the controller, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject. Recital 47 adds that processing for direct marketing purposes may be regarded as carried out for a legitimate interest.

"May be" matters. Relying on legitimate interests requires a genuine balancing exercise. Document it:

• Why you are contacting this type of person, and what benefit it offers them
• Why the contact is relevant to their role
• What data you hold and why each item is needed
• How you minimise intrusion, such as limiting frequency and offering easy opt-out

Prospecting a procurement manager about procurement software is far easier to justify than emailing everyone at a company about anything.

Tell people where their data came from

When you collect someone's data from a source other than them, such as a data provider or public website, Article 14 of the GDPR requires you to provide certain information. It must be given within a reasonable period, and at the latest within one month, and if the data is used to communicate with the person, at the latest at the time of the first communication.

In practice, the first email should identify your company, explain briefly why you are contacting them, and link to a privacy notice that covers the source of the data, the purposes, the lawful basis, retention and the person's rights.

Respect the right to object

Article 21 gives people the right to object to processing for direct marketing at any time. It states that where someone objects, their personal data shall no longer be processed for such purposes, and that the right must be explicitly brought to their attention at the latest at the first communication.

This is absolute for direct marketing: you cannot weigh it against your interests. Practical consequences:

• Every message needs a clear way to object or opt out
• Objections must stop all marketing to that person across every tool and team
• Keep a minimal record of the objection so the person is not re-added from another source

Our guide to the email suppression list covers keeping opt-outs in sync across outreach tools and the CRM.

UK rules on emailing businesses

In the UK, the ICO's guidance on electronic mail marketing distinguishes between types of recipient. It says you can email or text any corporate body, such as a company, limited liability partnership or government body, while sole traders and some partnerships are treated as individuals and need consent or a qualifying existing customer relationship. It also recommends keeping a "do not email" list of businesses that object, and notes that data protection implications may still apply when emailing employees at personal corporate addresses.

Rules outside Europe

Other countries have their own regimes. In the United States, the FTC's CAN-SPAM compliance guide states that the law makes no exception for business-to-business email, requires a valid physical postal address in messages, and requires opt-out requests to be honoured within 10 business days. Check the rules in each country you target.

Worked example: GDPR cold email controls

The table below shows a hypothetical set of controls for a company prospecting into the UK and EU. It is illustrative and should be reviewed with your own legal adviser.

RequirementControlOwnerEvidenceLawful basisLegitimate interests assessment per campaign typeMarketing leadSigned assessment on fileData minimisationCollect name, role, work email, company onlyData ownerField list in CRMSource recordedSource and date stored on every contactOperationsCRM fields populatedPrivacy informationShort notice in first email plus privacy page linkMarketingTemplate approvalRight to objectOpt-out link and reply handling in every messageSales operationsSuppression logSuppression across toolsDaily sync of opt-outs between outreach tool and CRMOperationsSync reportRetentionDelete unresponsive prospects after a set periodData ownerScheduled job logSole tradersExcluded unless consent is heldOperationsList filter rule

Controls like these make compliance part of the process rather than a last-minute check.

Keep data accurate and limited

GDPR's principles also require accuracy and storage limitation. For prospect data:

• Verify contacts before use and remove people who have left the company
• Do not collect more than you need, such as personal phone numbers or home addresses
• Set a retention period for prospects who never respond, and delete them when it passes
• Restrict access to prospect lists to the people who need them

Our guide to marketing automation compliance covers consent records, retention and audit trails across marketing systems.

Common GDPR cold email mistakes

• Assuming B2B email is outside GDPR because recipients are at work
• Buying lists without knowing how the data was collected
• No privacy information in the first message
• Opt-outs handled in one tool but not synced to others
• Keeping unresponsive prospects indefinitely
• Using one approach for every country without checking local rules

Frequently Asked Questions

Is cold email legal under GDPR?

It can be, if you have a valid lawful basis such as legitimate interests, provide privacy information, respect objections and also meet the electronic marketing rules in each country.

What must the first cold email include?

Who you are, why you are contacting the person, where you got their data or a link to a notice explaining it, and a clear way to object to further marketing.

Can we email any business contact in the UK?

The ICO says you can email corporate bodies, but sole traders and some partnerships are treated as individuals. Data protection rules still apply to named employees' personal work addresses.

How quickly must we act on an opt-out?

Under GDPR, marketing must stop once someone objects. In the US, CAN-SPAM requires opt-outs to be honoured within 10 business days. Acting immediately is the safest practice.

Prospect with confidence

We build prospecting workflows with source tracking, suppression sync, retention rules and CRM integration, so compliance is built in. See our B2B lead mining and prospect verification engine, or talk to us about compliant outreach.

About the Author

Manav Sharma is the founder of Insyrge and a CRM solutions architect. He works across Zoho, Salesforce, HubSpot, Odoo and more, designing the CRM setups, integrations and automations that keep sales and operations teams working from the same data.