Cold email to people in the EU or UK is legal in many situations, but GDPR shapes how you collect the data, what you say in the first message and what you do when someone says no. The rules are less scary than the forum threads suggest and stricter than the "B2B is exempt" crowd claims.
This post walks through the parts of GDPR that matter for B2B outbound, plus the separate e-privacy rules that sit next to it. It isn't legal advice. Rules differ by country, and if you run outbound at scale in Europe, a short session with a privacy lawyer is money well spent.
Does GDPR apply to cold email?
GDPR applies when you process personal data of people in the EU (and, through the UK GDPR, the UK). A work email address like [email protected] identifies a person, so it's personal data. Generic addresses such as [email protected] usually aren't tied to an individual, though the line can blur at very small companies.
So yes: if you email named people at European companies, GDPR applies, regardless of where your company is based.
There are two layers to keep apart:
| Layer | What it covers | Examples |
|---|---|---|
| GDPR / UK GDPR | Collecting, storing and using personal data at all | Lawful basis, transparency, rights, retention |
| E-privacy rules | Sending electronic marketing specifically | ePrivacy Directive as implemented in each EU country, PECR in the UK |
You need to satisfy both.
Legitimate interest: the usual lawful basis
GDPR requires a lawful basis for processing. For cold outreach, consent is impractical, so most B2B senders rely on legitimate interest under Article 6(1)(f). Recital 47 of the regulation explicitly says direct marketing may be regarded as a legitimate interest.
Legitimate interest isn't automatic. You have to pass a three-part test, and you should write it down (this is often called a legitimate interest assessment):
- Purpose. Do you have a real business interest? Offering a relevant product to a business is usually fine.
- Necessity. Is emailing this person necessary for that purpose, or is there a less intrusive way?
- Balance. Would the person reasonably expect this contact, and does your interest outweigh their privacy interests?
The balancing test is where targeting matters. Emailing a head of finance about accounts payable software is defensible. Emailing every address at a company about anything you sell is much harder to justify.
Tell people where you got their data
When you didn't collect data from the person directly, Article 14 says you must tell them certain things: who you are, why you're processing their data, your lawful basis, where you got it, how long you'll keep it and what rights they have. If you use the data to contact them, you must provide this at the latest with the first communication (and in any case within one month of obtaining it).
In practice, many senders handle this with a short line in the first email and a link to a privacy notice:
I found your details on your company's website. We store them to contact you about this; see how we handle data here, and reply "no thanks" to be removed.
Keep it short and readable. The full detail can live on your privacy page.
The right to object is absolute
Under Article 21, a person can object to processing for direct marketing at any time, and once they do, you must stop. No balancing test, no exceptions.
That means:
- Every email needs an easy way to opt out. A reply is fine; an unsubscribe link is better at volume.
- Opt-outs have to be honoured across every tool and every sequence, not just the campaign they replied to.
- You need a suppression list that survives list imports. Otherwise the same person reappears in next quarter's export and gets emailed again.
E-privacy rules: country by country
GDPR tells you whether you can process the data. E-privacy rules decide whether you can send unsolicited marketing email at all, and they differ by country.
United Kingdom (PECR). PECR distinguishes between individual subscribers and corporate subscribers. You can send marketing email to corporate subscribers (companies, LLPs, government bodies) without prior consent, as long as you identify yourself and offer a way to opt out. Sole traders and some partnerships count as individuals, so the stricter consent rules apply to them.
EU countries. Each country implemented the ePrivacy Directive differently. Some allow B2B cold email with an opt-out, while others, Germany being the usual example, are much stricter and generally expect prior consent even for business contacts. Check the rules for each country you target, and be most careful there.
CAN-SPAM and other regions, briefly
If you also email the US, CAN-SPAM is an opt-out law: you don't need consent, but you need accurate header information, a subject line that isn't deceptive, a valid physical postal address, a clear way to opt out, and you must honour opt-outs within 10 business days. Canada's CASL is consent-based and stricter, with limited exceptions. Don't assume one region's rules carry over to another.
Data handling that keeps you on the right side
The practical habits matter as much as the legal basis:
- Collect only what you need. Name, role, company and work email. Not personal phone numbers or home addresses scraped from somewhere.
- Know your sources. Record where each contact came from. If a data provider can't tell you how they gathered data, that's a problem for you, too.
- Set a retention period. Delete prospects who never engaged after a defined time instead of keeping them forever.
- Keep accurate data. Accuracy is a GDPR principle (Article 5). Mailing addresses that no longer belong to the person you meant to reach is both a compliance and a deliverability problem.
- Use processors with a DPA. Every tool that touches the data (CRM, sequencer, enrichment, verifier) should have a data processing agreement.
- Respond to rights requests. Access, deletion and objection requests need an owner and a process.
A pre-send checklist for EU and UK outreach
- Legitimate interest assessment written and filed for this campaign
- Target list limited to roles that would reasonably expect the message
- Country-specific e-privacy rules checked, with stricter countries excluded or handled separately
- Sole traders filtered out for UK sends, or handled under consent rules
- Data source recorded for every contact
- First email includes who you are, why you're writing, where you got the data, and a privacy link
- Simple opt-out in every message
- Global suppression list checked before import
- List verified so you're not mailing stale or misdirected addresses
How SimpleCold fits
SimpleCold verifies addresses; it doesn't decide whether your outreach is lawful. What it does is help with the accuracy side: the bulk email verifier flags addresses that no longer exist or sit on dead domains, so they can be removed before you send. For how we handle the data you upload, see our GDPR and DPA page.
If you're setting up outbound from scratch, the cold email deliverability checklist covers the technical side, and the cold email page shows where verification fits in a sequence workflow.
