GDPR Cold Email: A Practical Compliance Checklist for B2B Teams (2026)

Is cold email legal under GDPR

B2B cold email is legal under GDPR when you rely on legitimate interest, target people whose job is relevant to your offer, and provide a clear opt-out in every message. The most common misconception about cold email and GDPR is that GDPR prohibits all unsolicited email communication. It does not.

GDPR regulates how personal data is processed, and specifically what legal basis has to exist for that processing. Cold email to a business contact at their professional business email address can be compliant with GDPR when the correct legal basis is in place and specific conditions are met.

So what is that legal basis? The relevant legal basis is Article 6(1)(f) of the GDPR: legitimate interest. This allows processing of personal data (including sending an email to a business contact) when the data controller (the sender) has a legitimate interest in doing so, and that interest is not overridden by the data subject’s (the recipient’s) rights and freedoms.

That said, the legality is conditional. You still have obligations around how you collect data, what you include in your emails, and how you handle opt-outs. The rest of this article walks through each of those obligations.

How GDPR applies to B2B cold outreach

Even though you’re contacting a business, GDPR still applies because your email goes to a person. GDPR applies to the processing of personal data of individuals (called “data subjects”) who are in the European Union, regardless of where the data processor or controller is located.

A named work email like jane.smith@company.com counts as personal data under GDPR. Collecting it, storing it, and emailing that address all qualify as “processing.” A generic address like info@company.com, on the other hand, is typically not considered personal data because it doesn’t identify an individual.

If you are a US company sending cold emails to prospects in Germany, GDPR applies to your processing of their personal data. If you are a UK company emailing French prospects, GDPR applies. Where your company is headquartered doesn’t matter. Where the recipient sits does.

Legitimate interest vs. consent for B2B prospecting

GDPR doesn’t require consent for every type of processing, and legitimate interest is a separate, equally valid legal basis that fits cold outreach far better than consent does, since consent has to be obtained before first contact, which isn’t possible with cold email by definition.

So when does legitimate interest actually apply? A cold email to a CFO at a company about financial software, sent to their corporate email address, is a professional communication to a professional in their professional capacity. Your offer is relevant to what they do. That’s the kind of scenario where legitimate interest holds up.

However, you’ll want consent when:

• •

  You’re emailing a personal address. If your list contains personal email addresses (Gmail, Yahoo, Hotmail) or you’re contacting individuals who aren’t acting in a business role, you typically need explicit consent under GDPR.

• •

  Your outreach has no connection to the recipient’s role. Pitching forklift parts to a CMO breaks the relevance standard that legitimate interest requires.

• •

  Local rules demand it. Some EU countries, notably Germany, require opt-in even for B2B emails (covered below).

How to run a legitimate interest assessment before each campaign

GDPR expects you to document a Legitimate Interest Assessment (LIA) for each campaign, not as a legal filing, but as an internal written record. You’ll want a documented Legitimate Interest Assessment per campaign, not a one-time checkbox.

Here’s how the assessment works in practice:

1. Define the purpose of your outreach

Write down the specific business goal. “Generate demos for our sales automation product among VP Sales contacts in SaaS” works. “Email everyone we can find” does not.

2. Confirm cold email is necessary for your goal

Cold email has to be necessary to achieve that interest. If you could achieve the same result without processing personal data, legitimate interests don’t apply. In most B2B prospecting scenarios, cold email is a practical necessity because you can’t get prior consent from someone you haven’t spoken to yet.

3. Balance your interest against the recipient’s rights

Your interests can’t override the data subject’s privacy rights. B2B contact processing is generally more permissive here, because business email addresses used in a professional capacity carry lower privacy expectations than personal data. If the email would surprise or alarm the recipient, legitimate interest likely doesn’t hold.

4. Document and store the assessment

Keep a written record for each campaign: the date, the ICP definition, the data source, and your reasoning. This is your evidence if a complaint ever comes in. The single most expensive shortcut B2B teams take is skipping the written Legitimate Interest Assessment.

What every GDPR-compliant cold email includes

Every GDPR-compliant cold email includes an opt-out mechanism, your physical address, sender identity, and a link to your privacy policy. Here’s the full list:

• •

  Your real identity: Full name and company name, not a fake alias or vague sender line

• •

  Why you are emailing: A brief, honest reason tied to the recipient’s role or company

• •

  Where you got their data: Name the source (LinkedIn, a third-party provider, your database)

• •

  A working opt-out link: One-click unsubscribe that works immediately

• •

  Your physical business address: Required by GDPR and most other email regulations

• •

  A link to your privacy policy: Explaining how you process and store their data

EU country-level differences that affect cold email

GDPR is the baseline, but each EU member state implements it alongside local ePrivacy rules. That creates real variation in what B2B cold email looks like country to country.

Germany’s UWG (Gesetz gegen den unlauteren Wettbewerb) requires prior consent for most commercial emails, even B2B ones. No law in Europe names double opt-in as a requirement, including the GDPR. What the law does require is provable consent, and because the burden of proof sits with the sender, German courts have treated single opt-in as insufficient evidence, making double opt-in the de facto standard there.

France generally allows B2B cold email under legitimate interest when the outreach is clearly tied to the recipient’s professional role. This makes it more workable for outbound teams compared to Germany, though the same relevance and transparency rules still apply.

The UK sits outside the EU but runs its own closely related framework. PECR includes a “corporate subscriber” exemption that treats email addresses tied to companies (rather than individuals) more flexibly, giving UK-targeted B2B outreach a bit more room than some EU countries.

The practical takeaway: if your ICP includes German or Austrian prospects, plan for opt-in collection through content downloads, webforms, or events before cold emailing. For most of Western and Northern Europe, legitimate interest with a documented LIA is the standard approach.

GDPR vs. CAN-SPAM vs. CASL for cold email

If your team emails prospects across regions, you’ll want to follow the strictest law that applies. Here’s how the three major frameworks compare:

Beyond legal compliance, inbox providers like Google, Yahoo, and Microsoft now enforce their own rules. SPF, DKIM, and DMARC authentication, complaint-rate thresholds, and one-click unsubscribe headers all affect whether your email lands in the inbox or the spam folder. lemlist’s Deliverability Hub handles these configurations automatically and monitors mailbox health so you catch issues before they hurt your open rates.

Common GDPR cold email mistakes B2B teams make

Most GDPR violations in cold email come from operational gaps, not deliberate bad behavior. Here are the ones that show up most often:

• •

  Suppression list gaps: An opt-out from one domain still results in email from another sender domain you operate. Centralize suppression across your entire outbound stack.

• •

  Using legitimate interest as a blanket pass: Without a documented LIA for each campaign, you have no defense if a complaint lands.

• •

  Emailing personal addresses: Sending to gmail.com, outlook.com, or yahoo.com addresses signals personal accounts, which removes the B2B exemption in most jurisdictions.

• •

  No data retention policy: Storing prospect data indefinitely without a legal basis or documented retention period creates liability. For cold email under legitimate interest, the practical retention is 24 months of zero engagement before suppression.

• •

  Failing to identify yourself: Every email should include your real name, company, and a way to reach you. Vague sender lines invite complaints.

How to handle opt-outs and data deletion requests

GDPR gives recipients two distinct rights: the right to stop receiving emails (opt-out) and the right to have their data erased entirely under Article 17.

For opt-outs, act within 48 hours. While GDPR doesn’t specify an exact timeframe, this is the practical standard to avoid complaints. And the opt-out has to propagate across every tool and every rep. If one sender processes the opt-out but another rep emails the same contact from a different sequence, you’re in violation.

For data deletion (also called an “erasure request”), GDPR gives you one month to respond. Erasure means removing the contact from your CRM, sequences, enrichment tools, and any stored lists, then documenting the deletion.

Pre-send compliance checklist for B2B sales teams

Before launching any cold email campaign to EU prospects, run through this:

• •

  ☐ Legitimate interest assessment documented for this campaign

• •

  ☐ Data source known and recorded for every contact

• •

  ☐ Email includes sender name, company, and physical address

• •

  ☐ Email explains why you are reaching out

• •

  ☐ Working one-click unsubscribe link included

• •

  ☐ Privacy policy link included

• •

  ☐ Suppression list synced and up to date

• •

  ☐ Recipient country-level rules reviewed (opt-in vs. opt-out)

• •

  ☐ Email authentication (SPF, DKIM, DMARC) configured

• •

  ☐ Data retention policy defined and documented

How to run GDPR-compliant cold email at scale

Compliance gets harder as volume increases because manual checks don’t hold up. The operational question is: how do you maintain all of the above when you’re running dozens of campaigns across thousands of contacts?

You start with verified data. Using a database with verified emails reduces bounces and protects your sender reputation, which in turn keeps complaint rates low. lemlist’s 600M+ lead database provides verified email addresses with waterfall enrichment across 14+ data providers, so you’re working with clean data from the start.

Then, automate the compliance controls. Built-in unsubscribe handling, centralized suppression across all senders and campaigns, automatic authentication setup, and deliverability monitoring all remove the manual steps where compliance typically breaks down.