GDPR and B2B Cold Email: Legitimate Interest Explained (UK/EU)

Yes, GDPR allows B2B cold email on the legitimate interests basis: Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest". But GDPR is only half the test. The ePrivacy rules (PECR in the UK) decide whether you may send the email at all, and they turn on who the recipient is and which country they are in.

This is not legal advice. It is a reading of what the regulators themselves have published, with links so you can check every quote.

The two-layer test most guides skip

Cold email to Europe is governed by two separate laws that answer two different questions. GDPR asks whether you may process a person's data. ePrivacy law asks whether you may send them an unsolicited electronic message. You need a yes from both.

Layer	UK law	EU law	Question it answers
Processing	UK GDPR + Data Protection Act 2018	GDPR	Do you have a lawful basis to hold and use this person's data?
Sending	PECR (regulation 22)	National laws implementing ePrivacy Directive Article 13	May you send this unsolicited marketing email to this recipient?

Most articles on "GDPR and cold email" only discuss the first layer, conclude that legitimate interest works, and stop. The European Data Protection Board is explicit that this is the wrong order. In its Guidelines 1/2024 on legitimate interest (version 1.0, adopted 8 October 2024 for public consultation), it says:

"Before engaging in the processing of personal data for direct marketing purposes, controllers should consider specific European, as well as national, legislation which may require consent for certain operations in the context of direct marketing, or prohibit some kinds of direct marketing."

And in a footnote that matters a great deal for cold outreach:

"if sending direct advertising messages is not permitted under the national law implementing Art. 13 ePrivacy Directive, there would be no legitimate interest that the controller could invoke in order to justify the collection of personal data for sending such messages."

In plain terms: if the sending layer says no, the processing layer cannot rescue you.

What GDPR actually says about direct marketing

GDPR names direct marketing as a possible legitimate interest, but does not make it automatic. Three provisions do the work.

Article 6(1)(f), the legal basis itself, allows processing that is:

"necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data"

Recital 47 ends with the sentence every cold email vendor quotes:

"The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

The word is "may". Earlier in the same recital is the sentence they tend to leave out:

"The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing."

The EDPB guidelines close the gap directly: Recital 47 "does not mean that direct marketing always constitutes a legitimate interest, and that it is automatically possible to rely on Article 6(1)(f) GDPR to engage in all kinds of direct marketing activities."

Article 21(2) and (3) give the recipient an absolute right to say no:

"Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes."

The EDPB calls this right "unconditional and irrespective of the legal basis relied on by the controller". There is no balancing test on an objection. A reply saying "not interested, please remove me" is an objection.

The UK sending rules: corporate vs individual subscribers

In the UK, PECR lets you email limited companies without consent, but not sole traders or ordinary partnerships. The deciding factor is the legal form of the business, not whether the email is "B2B".

The ICO defines the two types in its key concepts guidance:

"There are two types, which are: individual subscribers (people, sole traders, ordinary partnerships); and corporate subscribers (organisations with their own legal personality, for example limited companies, LLPs and Scottish partnerships)."

And in its compliance guidance:

"You can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in."

Two obligations apply to every recipient regardless of type:

"You must not disguise or hide your identity in messages to either type of subscriber. You must provide a valid contact address for recipients to opt out or unsubscribe."

The corporate exemption covers PECR only. The ICO's older PECR guide adds: "You may also need to consider data protection implications if you are emailing employees at a corporate body who have personal corporate email addresses." An address like jane.smith@company.co.uk identifies Jane, so UK GDPR still applies to it even when PECR does not require consent.

A UK decision table

Recipient	PECR (may you send?)	UK GDPR (may you process?)
jane.smith@ at a limited company	Yes, no consent needed	Yes, if your legitimate interests assessment holds up
info@ at a limited company	Yes	Usually little or no personal data; GDPR light-touch
Sole trader, any address	Only with consent or soft opt-in	Not reached unless PECR allows
Ordinary partnership (not Scottish, not LLP)	Only with consent or soft opt-in	Not reached unless PECR allows
LLP or Scottish partnership	Yes	Legitimate interests assessment

The practical problem is the third and fourth rows. A list of "local plumbers" or "independent consultants" is often mostly sole traders, and their trading name does not tell you their legal form. Companies House lists limited companies and LLPs, so a business you cannot find there may be a sole trader or ordinary partnership. Check before you send, not after.

What the Data (Use and Access) Act 2025 changed

The Data (Use and Access) Act 2025 amended UK law, and the ICO says that as of 19 June 2026 "all data protection provisions in the Data (Use and Access) Act 2025 are now in force". Per the ICO's summary, it "clarifies that direct marketing can be a legitimate interest", and it adds a soft opt-in for charities. Neither change removes the corporate and individual subscriber distinction above. The ICO also notes on its PECR email page that "due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change", so check the current version before relying on it.

Note that "recognised legitimate interests", a separate new lawful basis, is not the same thing. The ICO says it applies "only if your use of the personal information is for one of its pre-approved purposes". Direct marketing is described as a legitimate interest that still needs the three-part test.

The EU sending rules vary by country

In the EU, the ePrivacy Directive sets a consent default for marketing email to individuals, and each member state implements it differently for business recipients. There is no single EU answer for B2B.

The EDPB guidance states the default:

"under the ePrivacy Directive, the sending of unsolicited communications for purposes of direct marketing by email, SMS, MMS and other kinds of similar applications can only take place with the prior consent of the individual recipient."

It then notes that marketing to legal persons (companies, not people) without personal data is governed only by ePrivacy, and adds the warning that matters for B2B:

"controllers should also assess the scope of application of the national rules implementing the ePrivacy Directive at Member State level, which may occasionally impose consent requirements that go beyond those laid down in that Directive (e.g., with respect to direct marketing towards professionals)."

So some member states permit unsolicited B2B email to work addresses on an opt-out basis, and some require consent even for professionals. We have not listed country-by-country rules here because they change and we could not verify each one against a primary source. If a meaningful share of your list is in one EU country, read that country's data protection authority guidance directly.

Running the legitimate interests test on one cold email

The ICO and EDPB describe the same three cumulative conditions; write them down before you send. The ICO's version is:

1. Purpose test: "Do you have a legitimate interest for using the personal information?"
2. Necessity test: "Is your use of personal information necessary for that purpose?"
3. Balancing test: "Do the person's interests, rights or freedoms override the legitimate interest you've identified?"

Here is a worked example. The scenario is invented for illustration: a UK firm selling payroll software emails the finance director of a 40-person UK limited company, using an address found on the company's own website.

Test	Weak answer	Stronger answer
Purpose	"We want to grow sales."	"Offering payroll software to finance leads at UK companies of 20-200 staff, a product relevant to their role."
Necessity	Full name, phone, LinkedIn URL, personal email, home town	Name, work email, job title, company. Nothing else stored.
Balancing	Same email sent to every contact at the company, no opt-out, no notice	One person per company, role-relevant message, opt-out in every email, source disclosed, objections suppressed permanently

The EDPB's guidance supports the stronger column. It says controllers should check whether "the marketing interest pursued cannot reasonably be achieved just as effectively by other means less restrictive", respect data minimisation, and that reasonable expectations depend on "the nature of the products and services the controller wishes to market, and whether it is likely that the data subject would expect to receive direct marketing about such products and services." A finance director getting a payroll pitch at work is a different expectation from a junior engineer getting the same pitch.

Keep the written assessment. The EDPB says controllers "should carefully assess and document whether these three cumulative conditions are met", and that this "should be done before carrying out the relevant processing operations."

The step people forget: telling them where you got their data

When you did not collect the address from the person, Article 14 GDPR requires you to give them specific information, and for outreach the deadline is the first email. Article 14(3)(b) says the information must be provided:

"if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject"

Article 14(2)(f) includes "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources". In practice this is one or two lines at the foot of the first email, with a link to a privacy notice that names your lawful basis, your interest, and how to object.

A workable footer:

You're receiving this because you're listed as finance director on
example.co.uk. We process your work email under legitimate interests
to offer relevant B2B services. Reply "stop" and we'll never contact
you again. Privacy notice: yourdomain.com/privacy

Where verification fits

Email verification does not make outreach lawful, but it is consistent with the accuracy and minimisation principles: it removes addresses that no longer belong to anyone before you process them further. A bounced address is also a sign the data was stale, which weakens any argument that the recipient could reasonably expect to hear from you.

Two operational points matter more than the verification itself:

• Suppression must survive re-imports. Under Article 21(3) an objection is permanent for marketing. If you buy or build a fresh list next quarter, check it against your suppression file before verifying or sending.
• Store less. If you verify a CSV, keep the result and the fields you need, not every column the data vendor gave you.

Our verification tool checks a single address without sending mail, and our post on whether it is legal to collect business emails covers the sourcing side. If you also send to North America, see CAN-SPAM and cold email and CASL for Canada.

Takeaway

Answer the sending question first, then the processing question. In the UK, that means confirming the recipient is a corporate subscriber, writing a three-part legitimate interests assessment, disclosing your source in the first email, and honouring every objection permanently. In the EU, it means checking the recipient country's own ePrivacy rules before assuming B2B is opt-out. If you cannot write the assessment in a paragraph that you would be comfortable showing a regulator, the campaign is not ready.