GDPR and B2B cold email: an operator’s planning guide

This article is an operational planning guide, not legal advice. There is no single rule that makes B2B cold email lawful across Europe: GDPR governs personal-data processing, while ePrivacy and national laws can set additional rules for marketing messages. Before a campaign runs, assess the data, audience, channel and destination markets with qualified local advice where appropriate.

Legitimate interest is a test, not a shortcut

GDPR provides several lawful bases to process personal data. Legitimate interest under Article 6(1)(f) can be relevant to direct marketing, but it is not a default permission slip. The European Data Protection Board’s guidance says the controller must assess and document three cumulative conditions before processing.

Whether consent is needed for a particular marketing email depends not only on GDPR but also on ePrivacy and national law. Do not infer the answer from a recipient’s job title, email format or company size alone.

The assessment asks whether all three conditions are met:

• Purpose: you have a genuine commercial reason to reach this person.
• Necessity: contacting them is a reasonable way to pursue it.
• Balance: your interest does not override their rights and expectations.

Relevance can help explain a purpose, but it does not decide the necessity or balancing tests. The assessment also needs to account for the data source, reasonable expectations, potential impact, safeguards and any more specific marketing rule.

Document the assessment for the processing activity you actually plan to carry out. Revisit it when the audience, data source, country, channel or campaign purpose changes. A short record may be sufficient for a simple case, but completeness matters more than length.

Documentation supports accountability; it does not by itself make a campaign compliant.

GDPR vs the ePrivacy Directive: two laws, not one

Most “is cold email legal” confusion comes from mixing up two rules.

GDPR governs how you handle personal data. The ePrivacy Directive governs electronic marketing messages, and each EU country implements it differently. Cold email touches both.

Dimension	GDPR	ePrivacy (national law)
What it covers	Processing personal data	Sending marketing messages
B2B email default	A lawful basis must be assessed	National implementation can add conditions
B2C email default	A lawful basis must be assessed	Consent is commonly required, subject to local rules
Who sets the detail	EU-wide regulation	Each member state
The opt-out rule	Right to object	Unsubscribe must be honored

Practical takeaway: consider both regimes together. A GDPR assessment does not override a more specific ePrivacy or national marketing rule.

Country rules require current, local review

National rules, regulator guidance and enforcement positions differ and can change. Do not classify a country as simply “B2B-friendly” or “consent-leaning” in an operating playbook. For every destination market, record the local rule you relied on, its source and date checked; ask qualified counsel to review uncertain or high-volume cases. For the UK specifically, the ICO’s B2B marketing guidance distinguishes organisation types and communication rules, which illustrates why audience details matter.

Operational controls to validate before launch

These controls are useful operational checks, but they are not a substitute for a legal review or a local-law determination.

Targeting you can defend

• Define a documented audience and a legitimate, specific campaign purpose.
• Minimise data to what is necessary; record the source and why it was selected.
• If the targeting rationale cannot be explained and reviewed, pause the campaign.

Identity and transparency

• Identify the sender and campaign purpose accurately.
• Provide the information required for indirectly collected data, including a workable privacy route.
• Ensure the privacy information and objection route are usable in the recipient’s context.

Opt-out and suppression

• Make the objection or unsubscribe path clear and test that it works before launch.
• Route objections to a controlled suppression process across the systems in scope.
• Define who owns exceptions, timing and evidence of completion.

Data minimization and retention

• Set a documented retention and deletion process appropriate to the data and campaign.
• Keep suppression information only as needed to prevent renewed marketing after an objection.
• Test access, correction, deletion and objection handoffs before relying on them.

Example launch checklist

1. Map the campaign. Record controller, audience, data source, countries, purpose, channel, vendors and intended retention.
2. Assess before processing. Document the GDPR lawful-basis analysis and obtain a current country-rule review for every destination market.
3. Validate transparency and objection handling. Review the message, privacy information, unsubscribe/objection route and suppression handoff end to end.
4. Assign accountable owners. Name the person responsible for approvals, rights requests, complaints and vendor controls.
5. Keep evidence. Retain the assessment, source records, approvals, send log and suppression events according to the documented policy.

Treat an unverified claim of compliance, a missing country review, a broken objection path or an unowned rights request as a launch blocker. A commercial campaign should not promise regulatory outcomes; it should demonstrate the controls it has actually implemented.

The 5 mistakes that actually get you in trouble

Avoid these five failure modes:

• Treating the EU as one rule set. Verify the local marketing rule as well as GDPR.
• Fragmented suppression. An objection must reach every relevant sending path.
• No evidence trail. Record the assessment, source and decision owner before launch.
• Excess data or unclear relevance. Reduce the data and pause where the necessity case is weak.
• An untested rights route. Verify the recipient’s path to object or exercise rights.

Before sending B2B marketing email, document the specific GDPR assessment, check the applicable ePrivacy and national rules, minimise data, make transparency and objection handling operational, and obtain professional advice for the campaign’s markets. This guide is not a substitute for that advice.