What Is GDPR and B2B Outreach?

GDPR (General Data Protection Regulation) is the European Union's data protection law, in force since May 25, 2018, governing how organizations collect and process personal data of people in the EU - including business contact details like a named individual's work email, which count as personal data. GDPR does not ban B2B cold email. It requires a lawful basis for processing, and for B2B outreach the commonly used basis is legitimate interest under Article 6(1)(f): the sender documents a balancing test showing the outreach is relevant to the recipient's professional role, uses lawfully sourced data, and would be reasonably expected. Obligations attach regardless of basis: identify yourself, tell people where their data came from, honor objections and deletion requests promptly, and keep records. GDPR interacts with the ePrivacy layer - national implementations of the ePrivacy Directive, like the UK's PECR - which adds channel-specific email marketing rules on top. Fines can reach 20 million euros or 4% of global annual turnover, whichever is higher.

GDPR and B2B Outreach in Practice

In practice, a defensible GDPR posture for B2B cold email into the EU looks like this: target only business contacts whose role makes the message professionally relevant (a marketing director receiving a marketing-services email passes the relevance test; a random employee does not); source data from providers that state a GDPR-compliant basis; document a legitimate interest assessment (LIA) - a short written balancing test - before campaigns run; include in the email who you are, why you are contacting them, and a clear way to object; suppress objectors permanently across all campaigns; and fulfill any access or deletion request within one month. Country nuance matters because ePrivacy rules are national: Germany is notably stricter than the GDPR baseline, effectively expecting consent or an existing relationship for email marketing, while other member states are more permissive toward B2B legitimate interest. The common misconception runs in both directions. One camp believes GDPR outlawed cold email to Europe - it did not, and legitimate-interest-based B2B outreach continues lawfully at scale. The other camp believes work emails are exempt from GDPR - they are not; a named person's work address is personal data, full stop.