Is B2B cold email legal under GDPR?

GDPR does not prohibit it, but you need a lawful basis such as legitimate interests or consent, transparency about how you obtained and use the data, and an easy way to object. National ePrivacy laws may additionally require prior consent, which varies by country.

Do I need consent to send B2B cold emails in the UK?

Not for corporate subscribers such as limited companies, under PECR, provided you identify yourself and offer an opt-out. Sole traders and some partnerships count as individual subscribers and generally require consent. UK GDPR still applies to the personal data you process.

Can I rely on legitimate interest for cold outreach?

Often, where national law does not require consent. You must show a genuine interest, that outreach is necessary for it, and that it does not override the recipient's rights. Document a legitimate interests assessment, target relevant roles, provide transparency, and honour objections immediately.

B2B Cold Email and GDPR: What the Rules Mean

GDPR does not ban B2B cold email, but it applies whenever you process personal data such as a named work email. You need a lawful basis, usually legitimate interests or consent, plus transparency and an easy opt-out. National marketing laws add rules: some EU countries require prior consent, while the UK permits emails to corporate subscribers.

Why GDPR applies to B2B email

The General Data Protection Regulation covers personal data, meaning any information relating to an identifiable person. A work email address such as a first name and surname at a company domain identifies a person, so collecting, storing, and emailing it is processing personal data. Generic addresses, such as a sales or info mailbox, may fall outside GDPR, but national marketing rules can still apply. This guide is general information, not legal advice.

Two layers of rules

Cold email in Europe is governed by two layers. GDPR sets rules for processing personal data: lawful basis, transparency, data minimisation, and individual rights. The ePrivacy Directive, implemented through national laws, sets rules specifically for electronic marketing, including when consent is required before sending marketing emails. In the UK, the equivalent laws are UK GDPR and the Privacy and Electronic Communications Regulations, PECR.

Lawful basis: legitimate interests or consent

Under GDPR, B2B cold outreach typically relies on legitimate interests or consent. Legitimate interests requires a genuine business interest, a necessity test, and a balancing test showing the outreach does not override the recipient's rights and expectations. Documenting this in a legitimate interests assessment, targeting people whose role makes the message relevant, and keeping volumes reasonable all support the balance. Where national ePrivacy law requires consent, legitimate interests alone is not enough.

Country differences

Member states implemented ePrivacy rules differently. Some allow unsolicited B2B marketing emails with an opt-out, while others require prior consent even when the recipient is a business contact. Germany, for instance, is generally regarded as strict on unsolicited email advertising. Because rules vary, record each contact's country and apply the right rule for that country, or adopt the strictest approach across the region.

The UK: PECR and corporate subscribers

In the UK, PECR distinguishes corporate subscribers, such as limited companies, from individual subscribers, such as sole traders and some partnerships. Marketing emails to corporate subscribers do not need prior consent, but must identify the sender and offer a way to opt out. Individual subscribers generally require consent, or the soft opt-in for existing customers. UK GDPR still applies to the personal data involved.

Transparency obligations

When you collect personal data from sources other than the person, such as public websites or data providers, GDPR requires you to tell them who you are, why you are processing their data, the lawful basis, the source, and their rights, within a reasonable time and at the latest at first contact. Many teams include a short notice and link to a privacy policy in the first email.

Opt-outs and the right to object

Individuals have an absolute right to object to direct marketing. When someone objects or unsubscribes, you must stop marketing to them and should keep their address on a suppression list so they are never contacted again. Make opting out easy, act immediately, and ensure the suppression applies across every mailbox, team member, agent, and external rep.

Data sources and retention

Know where prospect data comes from and whether it was collected lawfully. Avoid buying lists without clear provenance. Keep only the data needed for outreach, delete data for prospects who do not engage after a reasonable period, and keep records of your lawful basis and processing decisions.

A conservative operating model

Given the variation, some platforms apply a conservative default. Koryo, for example, requires recorded opt-in or an existing-customer basis before sending cold mail to recipients in the EU and EEA, the UK, Switzerland, and Canada, checks every message against a permanent suppression list, and records each sending decision. This approach reduces regional risk at the cost of fewer cold sends to those regions.

Practical checklist

Before emailing European or UK contacts: record each contact's country and whether they are a corporate or individual subscriber; document your lawful basis and, where relevant, a legitimate interests assessment; check whether national law requires prior consent; include sender identity, a transparency notice, and an easy opt-out; check against your suppression list; and log what you sent and why. Revisit the checklist when rules or guidance change.

Outreach by agents and external reps

If AI agents, agencies, or independent reps contact prospects for you, you remain responsible for how personal data is used. Make sure every message they send passes the same lawful basis, consent, and suppression checks, and that data processing agreements cover any third parties.

Frequently asked questions

Is B2B cold email legal under GDPR?: GDPR does not prohibit it, but you need a lawful basis such as legitimate interests or consent, transparency about how you obtained and use the data, and an easy way to object. National ePrivacy laws may additionally require prior consent, which varies by country.
Do I need consent to send B2B cold emails in the UK?: Not for corporate subscribers such as limited companies, under PECR, provided you identify yourself and offer an opt-out. Sole traders and some partnerships count as individual subscribers and generally require consent. UK GDPR still applies to the personal data you process.
Can I rely on legitimate interest for cold outreach?: Often, where national law does not require consent. You must show a genuine interest, that outreach is necessary for it, and that it does not override the recipient's rights. Document a legitimate interests assessment, target relevant roles, provide transparency, and honour objections immediately.