GDPR does not automatically ban B2B cold email, but it does regulate it. If you email named people at European companies, you’re processing personal data, so you need a lawful basis (usually legitimate interest), you must tell the person where you got their data and how to object no later than your first email, and you must stop immediately when they object. On top of GDPR, each country has its own e-marketing rules: some allow B2B email on an opt-out basis, while Germany requires prior express consent for email advertising.

This is general information, not legal advice. Rules vary by country and change over time, so get advice from a lawyer who knows the markets you target.

This post is a practical prospecting guide for US companies selling into Europe and the UK. For a broader look at consent records and how GDPR compares with CAN-SPAM, see Consent, records and the rules that outlive your list.

Often, yes. GDPR applies to organizations outside the EU when they process personal data of people in the EU in connection with offering them goods or services (GDPR Art. 3(2)). Prospecting EU-based buyers to sell them your product fits that description.

And a business email address is still personal data when it identifies a person. jane.schmidt@company.de is personal data; the UK regulator makes the same point, noting that data protection law applies to information identifying someone in their business role (ICO).

Cold email in Europe is governed by two different sets of rules that work together:

GDPR governs how you collect, store, and use personal data: lawful basis, transparency, rights, and security.
National e-marketing laws (implementing the EU’s ePrivacy Directive, or the UK’s PECR) govern whether you may send electronic marketing at all, and to whom.

You need to satisfy both. Legitimate interest under GDPR doesn’t help if the country’s e-marketing law requires consent for the email itself.

Legitimate interest: the usual lawful basis for B2B prospecting

Recital 47 of GDPR says processing personal data for direct marketing may be regarded as carried out for a legitimate interest (GDPR Recital 47). “May” is the key word. You have to show it, using the three-part test the European Data Protection Board set out in its guidelines on legitimate interest (version 1.0 adopted 8 October 2024) (EDPB):

Legitimate interest. Is your interest lawful, clearly stated, and real? Selling a relevant B2B product can be.
Necessity. Is processing this person’s data necessary for that purpose, or could you achieve it in a less intrusive way?
Balancing. Do the person’s interests, rights, and reasonable expectations outweigh yours? Safeguards such as relevance, low frequency, and easy objection help.

The EDPB says this assessment should be done and documented before the processing starts (EDPB).

What a defensible prospecting assessment looks like

Write a short legitimate interests assessment (LIA) for each outreach program. Practical factors that support the balancing test:

Role relevance. You only contact people whose job relates to what you sell (for example, IT directors for IT security software).
Data minimization. You store name, work email, company, role, and source. Not personal social profiles, not home addresses.
Reasonable expectations. The person’s business contact details were published in a professional context.
Low intensity. A short sequence, not weeks of follow-ups.
Easy objection. Every email offers a simple opt-out, and objections are honored immediately and permanently.
Retention limit. Non-responders are deleted after a defined period, with only a suppression record kept for people who objected.

What your first cold email must tell the recipient

When you get personal data from somewhere other than the person (a website, a data vendor, an enrichment tool), Article 14 requires you to give them privacy information. If you use the data to contact them, you must do so at the latest at the time of your first communication, and in any case within one month of obtaining it (GDPR Art. 14). That information includes where the data came from (GDPR Art. 14(2)(f)).

Separately, the right to object to direct marketing must be explicitly brought to the person’s attention at the latest at the first communication, presented clearly and separately from other information (GDPR Art. 21(4)).

A practical way to do both without a wall of legal text:

I found your details on your company’s team page. We use them only to contact you about [topic], under our legitimate interest in reaching relevant B2B buyers. You can object at any time: reply “no” and we’ll delete your details and not contact you again. Privacy notice: [link]

Put the full Article 14 information (who you are, purposes, lawful basis, legitimate interest, categories of data, retention, recipients, rights, and right to complain to a regulator) in the linked privacy notice.

The right to object is absolute

For direct marketing, a person can object at any time, and once they do, their data must no longer be processed for that purpose (GDPR Art. 21(2)-(3)). The UK regulator describes this right as absolute (ICO).

In practice:

Stop all sequences to that person in every tool and mailbox.
Keep a minimal suppression record so they’re never re-imported from another data source.
Don’t argue or send a “sorry to see you go” pitch.

Our post on suppression list design covers what to keep and for how long.

Country differences that change the answer

National e-marketing rules decide whether you can email at all. Three important examples:

Country	B2B cold email position	Source
United Kingdom	PECR’s consent rule for electronic mail marketing doesn’t apply to corporate subscribers (companies, LLPs, Scottish partnerships, some government bodies). Sole traders and some partnerships are treated like individuals and need consent unless the soft opt-in applies. You must identify yourself and give a valid opt-out address. UK GDPR still applies. The ICO notes this guidance is under review following the Data (Use and Access) Act.	ICO
France	The CNIL allows B2B email prospecting without prior consent when the subject relates to the recipient’s profession, the person was informed and can object, and every message identifies the sender and offers a simple, free opt-out. Generic company addresses such as contact@ fall outside these rules because they relate to legal entities.	CNIL
Germany	The Act Against Unfair Competition treats advertising by email without the addressee’s prior express consent as an unacceptable nuisance, and it doesn’t distinguish consumers from business recipients for email. There’s a narrow exception for existing customers.	UWG § 7

The takeaway: there’s no single “EU B2B rule.” Before you add a country to your targeting, check its e-marketing law.

Penalties

GDPR fines for infringing data subjects’ rights, including Articles 12 to 22, can reach up to €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher (GDPR Art. 83(5)). National e-marketing laws carry their own enforcement. In practice, the more common consequences of poor prospecting are complaints to regulators, deletion demands, and damaged reputation with the buyers you’re trying to win.

Define the audience by role. Only roles that clearly relate to your offer.
Check country rules. Exclude or switch to consent-based approaches where email marketing requires consent.
Write and file your LIA for the program.
Source data responsibly. Use public professional sources and reputable vendors who can tell you where data came from. Record the source for each contact. See How to Find Business Email Addresses Ethically.
Minimize and verify. Keep only what you need, and check that addresses are valid before sending. Accuracy is a GDPR principle, and mailing dead addresses also hurts deliverability.
Disclose in the first email. Source, purpose, right to object, and a link to your privacy notice.
Honor objections immediately and suppress across all systems.
Delete non-responders after your defined retention period.
Comply with US rules as well if you’re a US sender. See CAN-SPAM and Cold Email.

For step 5, our free email verifier checks syntax, domain and MX records, disposable and role-based addresses, free-provider domains, and common typos. It doesn’t connect to the recipient’s mail server over SMTP, so it doesn’t confirm an individual mailbox exists. It’s useful for catching structural errors before they turn into bounces. The B2B lead list cleaning guide covers the full process.

FAQ

GDPR itself doesn’t require consent if you can rely on legitimate interest, but you must pass the three-part test and document it. Whether you need consent for the email itself depends on national e-marketing law. The UK and France allow B2B email on an opt-out basis in many cases, while Germany requires prior express consent for email advertising.

Is a work email address personal data?

Yes, if it identifies a person, such as firstname.lastname@company.com. A purely generic address like info@company.com usually relates to the company rather than an individual, and France’s CNIL treats such addresses as outside its prospecting rules.

What must I include in my first cold email to an EU prospect?

At minimum, tell them who you are, where you got their data, and that they can object at any time, with the right to object shown clearly and separately. Link to a privacy notice with the rest of the Article 14 information.

How long can I keep a prospect’s data if they never reply?

GDPR doesn’t set a fixed period. You must keep data no longer than necessary for your purpose, so set a defined retention period for non-responders in your LIA and delete them when it expires. Keep a minimal suppression record only for people who objected.

GDPR and B2B Cold Email: What You Need to Know

Does GDPR apply to a US company sending cold email?

Two layers: GDPR plus national e-marketing law