GDPR and Cold Email: What B2B Senders Need to Know

Cold email is not illegal under GDPR, but it is not a free-for-all either. If you email people in the EU or UK, you need a lawful basis for using their personal data, you must tell them who you are and why you are writing, and you must stop the moment they object. In many EU countries, a second layer of national e-privacy rules decides whether you may send at all without prior consent. This guide walks through both layers for a US sender, in plain terms.

This is general information, not legal advice. If you run campaigns across several countries, have a privacy lawyer review your process.

Plusvibe

Build More Responsible Cold Email Campaigns

PlusVibe helps teams manage prospect data, personalize outreach, monitor deliverability, and handle replies at scale.

Explore PlusVibe plans

Key takeaways

GDPR applies to a business email address whenever it identifies a person, such as a name in the address. A cold email list is personal data.
Two different laws apply: GDPR governs how you use the data, and national e-privacy rules (PECR in the UK) govern whether you can send the message.
Legitimate interest is the usual basis for B2B outreach, but you must document it with a three-part assessment, not just claim it.
Every email needs a clear sender identity, a plain explanation of where you got the data, and a working way to opt out. Objections go on a suppression list.
Being a US company does not exempt you if you target people in the EU.

Does GDPR apply to you if you are in the US?
Two laws, two questions
Choosing a lawful basis: legitimate interest or consent
Where your data comes from matters
What every cold email must tell the recipient
Opt-outs, objections and suppression lists
What happens if you get it wrong
Our perspective
A compliance routine you can run this week
Running this in PlusVibe
FAQ
Sources

Yes, it can. According to the European Commission, GDPR covers a non-EU company that offers goods or services to, or monitors, individuals in the EU. The same page explains that processing includes collecting, storing and using contact databases. Scraping a prospect’s details, enriching them and loading them into a sequence is all processing.

The UK has its own version, the UK GDPR, which the Information Commissioner’s Office (ICO) enforces. Its guidance says the rules apply to B2B marketing whenever personal data is processed, for example when you hold a business contact’s name, or when an email address identifies an individual.

That last point catches many senders out. The belief that “it’s a company address, so it isn’t personal data” is wrong when the address is firstname.lastname@company.com. Generic mailboxes like info@ are a different case, but most outbound lists are built from named contacts.

If your list contains only US recipients, CAN-SPAM is your framework instead. We cover that in our guide to CAN-SPAM and cold email.

Two laws, two questions

Most confusion comes from treating “GDPR” as the one rule for cold email. There are really two questions:

Question	Governing law (UK example)	What it decides
Can I process this person’s data at all?	UK GDPR (EU: GDPR)	Lawful basis, transparency, rights, data security
Can I send this marketing email without prior consent?	PECR (EU: national laws based on the ePrivacy Directive)	Whether consent is required before the message goes out

You have to satisfy both. Passing one does not clear the other.

The e-privacy layer: corporate vs. individual subscribers

Under UK PECR, the rule on electronic mail marketing does not apply to corporate subscribers, so you can email someone at a limited company without their consent. Sole traders and some partnerships count as individual subscribers. You can email them only with specific consent, or under the “soft opt-in”: you obtained their details during a sale or negotiation, the marketing is for similar products or services, and you offered an opt-out when collecting the details and in every message.

UK PECR rules for corporate and individual subscribers

That is the UK. Other countries differ. The ICO itself notes that EU countries have laws based on the ePrivacy Directive and that some are stricter than the UK rules, especially for marketing to companies. It advises getting your own legal advice for international campaigns.

In practice, this means “B2B cold email is fine in Europe” is true in some countries and risky in others. Before you target a new country, check its national rule on unsolicited marketing to businesses. Do not assume the UK position carries over.

Under GDPR you need a lawful basis for every use of personal data. For B2B marketing the two most relevant are consent and legitimate interests.

Consent is not practical for first contact, because you cannot ask for it before you have emailed. And where e-privacy law requires consent, the ICO says that in practice consent will be the GDPR basis too. So for corporate recipients in markets where consent is not required, legitimate interest is the realistic route.

The three-part legitimate interest assessment

The ICO’s approach to assessing legitimate interests has three steps:

Purpose: identify the interest. For example, offering a relevant business service to people who are likely to need it.
Necessity: show that the processing is necessary for that purpose, and that you could not reasonably achieve it with less data.
Balancing: weigh your interest against the individual’s interests, rights and freedoms.

The European Data Protection Board adds that when you rely on Article 6(1)(f), you must identify the legitimate interests you pursue and inform the person of them. The same guidelines link transparency to fairness: processing should not be unexpected, misleading or unjustifiably harmful to the person.

The “unexpected” test is where cold email lives or dies. A VP of Sales getting a short note about sales software at her work address is within reasonable expectations. A plumber getting a pitch built from his personal social media profile is not.

A worked example

Say you sell invoicing software to accounting firms in Germany and the Netherlands. Your assessment might read:

Purpose: to offer invoicing software to firm owners who handle client billing.
Necessity: we need a name, work email and job title to reach the right person. We do not collect home addresses, family details or anything unrelated to their role.
Balancing: the data is business contact information tied to the person’s professional role. The email is short and relevant, states where we found the data, and offers a one-click opt-out. Recipients can reasonably expect professional offers at their work address.

Write this down, date it, and keep it with your campaign records. If a regulator or a recipient asks, you can show your reasoning. A document you wrote after the complaint arrives is much weaker than one that predates the campaign.

Where your data comes from matters

Buying or scraping a list does not transfer someone else’s compliance to you. The European Commission states that before acquiring a contact list from another organization, you must be able to demonstrate that the data was obtained in compliance with GDPR and may be used for advertising.

In practice, ask any list vendor:

Where and when was each record collected?
What were people told at the time?
Can the vendor show you that the data may be used for marketing?
How does the vendor process opt-outs and deletions?

If you cannot get clear answers, do not load the list. The same discipline applies to the tools inside your stack. Prospecting software, enrichment tools, your CRM and your spreadsheets all hold personal data, and a marketing automation checklist helps you map where each field travels and who can access it.

Keep collection narrow. Role, company, work email and a relevant business trigger are usually enough. Every extra field is something you must justify in your balancing test.

What every cold email must tell the recipient

GDPR requires personal data to be processed transparently, and people must be told the controller’s identity and the purposes of processing. The ICO is specific about timing for B2B marketing: give privacy information when you collect details directly, or, if you got them from another source, within a reasonable period and no later than one month.

For a first cold email, the simplest compliant move is to put it in the message itself:

Who you are: your name, company and a real postal or business address.
Why you are writing: one sentence on the offer and why it is relevant to their role.
Where you found them: for example, a public company website or a professional directory.
A link to your privacy notice: explaining what you hold, your legal basis, how long you keep it and how to exercise rights.
How to opt out: a plain line, such as “Reply STOP and I won’t contact you again,” plus an unsubscribe link.

A short footer does the job without bloating the email. Compare these two:

Not compliant: “Hi Sam, quick question about your Q3 goals…” (no sender identity, no source, no opt-out)

Better: “Hi Sam, I’m Jordan at Acme Billing. I found your details on your firm’s website because you handle client invoicing. If you’d rather not hear from me, reply ‘no’ and I’ll remove you. Privacy notice: [link].”

For more on structure and tone that stays compliant without hurting replies, see our cold email best practices.

Opt-outs, objections and suppression lists

The right to stop direct marketing is absolute. The ICO says that when processing personal data for B2B marketing you must respect data protection rights, including the absolute right to stop data being used for direct marketing. If a business contact objects, stop processing their data for marketing and add them to a suppression list so you do not contact them again.

This sounds contradictory: you keep their email to make sure you never email them. That is the accepted approach. Store only the minimum needed to match future records, ideally the email address or a hash of it.

Build the process so it cannot fail:

Add the opt-out to every message, in the body and not only a footer link.
Treat a reply of “remove me,” “not interested, stop” or “unsubscribe” as an opt-out, even if the wording is informal.
Sync one global suppression list across every campaign, inbox and team member, including agency clients.
Check new imports against it before launch.
Honor requests promptly. Do not leave them in a queue for weeks.

For corporate subscribers, the ICO also says to keep a do-not-email list and comply with opt-out requests. Where you rely on consent, people must be able to withdraw it at any time without disadvantage, and the ICO recommends keeping records of what was consented to, when and how.

If you want a ready-made routine, our cold email compliance checklist turns these steps into a team process.

What happens if you get it wrong

GDPR penalties are tiered. Article 83 of the regulation sets maximum administrative fines of up to €20 million or 4% of worldwide annual turnover for infringements of the basic principles, lawful basis and data subject rights, and lower maximums for other obligations. Regulators rarely start there for a small sender. More typical outcomes are a complaint, an investigation, an order to stop processing, or a demand to delete data.

The practical risks arrive earlier and cost more day to day:

Spam complaints. Recipients who feel misled report you, which damages sender reputation. Poor reputation pushes later campaigns into spam folders.
Domain blocks. Mailbox providers act on complaint rates regardless of what any regulator thinks.
Lost deals. A prospect who feels their data was mishandled does not become a customer.
Contract friction. Agencies often find clients ask for proof of compliance before approving a campaign.

The ICO’s guidance for the UK is the clearest public reference on how the rules sit together. If you are targeting a specific EU country, check that country’s data protection authority for its own enforcement stance.

Our perspective

We built PlusVibe around the idea that compliance and deliverability are the same discipline viewed from two sides. The habits that keep you on the right side of GDPR are the same ones that keep you in the inbox: targeted lists, accurate data, honest identification, easy opt-outs and low complaint rates.

Our perspective — overview diagram

The most common mistake we see is volume first, rules later. A team buys a large list, scrapes more, and sends to everyone, then wonders why bounces climb and replies are angry. Narrow, relevant lists with documented reasoning perform better and carry less legal exposure. Clean data matters too: verifying addresses before you send protects your reputation, and it supports the GDPR principle of keeping data accurate. Our guide to email list cleaning shows how.

Our view is also that tools should not hide the mechanics. Private, non-shared sending infrastructure means your reputation depends on your own behavior, not on a stranger’s. That transparency makes it easier to run a clean program, and easier to explain it to a client or regulator.

— Yaro

A compliance routine you can run this week

Map where your contacts live. Split your list by country and by recipient type: corporate, sole trader or unknown.
Check each country’s e-privacy rule on unsolicited B2B email. Remove or pause markets where consent is required and you do not have it.
Write your legitimate interest assessment using the purpose, necessity and balancing steps. Date it.
Publish a privacy notice that covers cold outreach, and link it in every email.
Add the sender identity, data source and opt-out to your template.
Set up one suppression list and run every new import against it.
Verify addresses before sending to reduce bounces and keep data accurate.
Review quarterly. Rules and your own lists both change.

Running this in PlusVibe

If you manage outreach at volume, your tooling should make the routine above easy to follow. PlusVibe gives you campaign automation and email verification in one platform, with private warm-up and isolated sending infrastructure. Plans start with Personal at $37-$58 per month and Business at $77-$220 per month, and agencies managing many client accounts can look at the Agency plan from $497 per month. You can compare everything and start a free trial on our plans page.

FAQ

It can be, if you have a lawful basis (usually legitimate interest), you are transparent about who you are and why you are writing, and you honor opt-outs. It also has to pass the national e-privacy rules of the recipient’s country, which are stricter in some EU states than in the UK. Document your reasoning before you send.

Is a work email address personal data?

Yes, when it identifies an individual, such as an address built from a person’s name. The ICO says GDPR applies to B2B marketing whenever personal data is processed. A generic address like info@ is less likely to identify a person, but you should not rely on that for a named-contact list.

Not always. Under UK PECR you do not need consent to market to corporate subscribers, but you do for sole traders and some partnerships unless the soft opt-in applies. Some EU countries require consent even for business recipients, so check the country before you send.

What should I do when someone asks me to stop?

Stop contacting them straight away and add their details to a suppression list so they are not emailed again from any campaign. The right to object to direct marketing is absolute. Keep only the minimum data needed to enforce the suppression.