GDPR cold email B2B: is it legal in Europe?

"Isn't cold email illegal in Europe?" is the objection that scares teams off outbound. It's a myth, but the nuance matters, and getting it wrong is a real risk. Here's the accurate version.

Note: this is general information, not legal advice. For your specific situation, confirm with a qualified data-protection adviser.

Cold email in Poland and Germany: the two tests

Two separate tests apply to every cold email, and a campaign has to pass both. The GDPR decides whether you may use the contact's data. The national rule that implements the ePrivacy Directive decides whether you may send. Poland shows the gap clearly: a campaign that passes the first test can still need consent under the second.

For the Polish market itself, read B2B lead generation in Poland. For Germany, whether cold email is legal in Germany covers the UWG in detail. The page you are on carries the full country table for the other markets.

The legal basis: legitimate interest, not consent

GDPR requires a lawful basis to process personal data. For B2B marketing, that basis is legitimate interest under Article 6(1)(f), you don't need prior consent. As the EU guidance on email marketing puts it, where a company has a justified interest, marketing emails may be sent to potential customers without consent.

The hard line is B2B vs. B2C:

What "legitimate interest" actually requires

Legitimate interest isn't a free pass, it's a balancing test. To rely on it for cold email you should be able to show:

• Relevance. The recipient's role makes your offer genuinely useful to their business. Spraying an irrelevant list fails the test.
• Professional context. You contact people at their professional address about their work, not their personal life.
• Reasonable expectation. A decision-maker in your target market would not be surprised to hear from a relevant vendor.
• Minimal impact. One relevant, easy-to-decline message is low-impact; high-frequency spam is not.

Write that reasoning down before you send, as a legitimate interest assessment in three parts: the purpose is legitimate, the processing is necessary for it, and the recipient's rights do not override it. Written before the campaign, it is a document; written after a complaint, it is a defence.

The ePrivacy layer (and the UK difference)

GDPR sets the data-processing rules; the ePrivacy Directive governs electronic marketing on top of it. In practice, EU member states apply extra protection to individual subscribers, which is why quality targeting and the relevance test matter so much for compliant outreach.

The UK is a common trip-up: under PECR, unsolicited B2B email to corporate bodies (limited companies, LLPs) is generally permitted, but sole traders and partnerships are treated like individuals and need the stricter consumer approach. If you email the UK, segment accordingly before you build the campaign, as our guide to lead generation in the UK sets out.

Is cold email GDPR compliant in every EU country?

On the GDPR side, yes: the same Article 6(1)(f) basis applies everywhere. On the sending side, no single answer exists, because each country transposed the ePrivacy Directive separately. European B2B compliance guidance groups those national rules into three regimes for email to corporate subscribers:

Two consequences follow. A pan-European campaign is not one legal position but three, so the country field in your list is a compliance field. And the markets people assume are easy often are not: Denmark applies its consent rule to companies as well as consumers, which is stricter than any of its Nordic neighbours. Poland is a common example of the gap between the two layers, since a campaign that passes the GDPR balancing test can still need consent under Polish sending rules.

What GDPR-compliant cold email looks like in practice

Abstract rules become clearer with a concrete pair of campaigns. Picture a warehouse-automation vendor emailing 300 operations directors at mid-sized logistics firms in the Netherlands. Each message names the sender, explains in one line why a logistics operations lead would care, and closes with a one-click opt-out. That campaign passes the legitimate interest balancing test with room to spare: relevant role, professional address, reasonable expectation, minimal impact. That settles the GDPR side only: the Dutch rule on unsolicited email to a named person is a separate test, shown in the country table on this page.

Now picture the same vendor blasting 40,000 scraped addresses, including info@ inboxes, personal Gmail accounts and roles with no connection to warehousing. No sender identity beyond a bare signature, no opt-out link, follow-ups every two days. Same product, same country, but this version fails every limb of the test. The lesson: GDPR compliance in cold email is mostly a targeting and process question, not a legal-paperwork question.

Where your data comes from matters

Legitimate interest covers the sending; it does not launder a bad list. Under GDPR you should be able to say, for any contact, where the record came from and when. Public business registers, company websites, professional profiles and reputable B2B databases all qualify as legitimate sources, and keeping a source log per contact takes minutes to set up. We cover the main options in where European B2B data comes from.

Two habits keep the data side clean. First, refresh lists regularly: a contact who changed jobs eight months ago is no longer a relevant professional contact, and stale records fail the relevance test.

Common GDPR cold email mistakes (and the fixes)

• Emailing generic inboxes and personal addresses. info@ and gmail.com addresses undercut the professional-context argument. Fix: only email named contacts at their work domain.
• Hiding the opt-out. A grey line in 8px font, or "reply STOP" buried in a signature, invites complaints. Fix: a plain, visible sentence offering an easy way out.
• Slow opt-out processing. Removing someone "within 30 days" is a marketing-list habit, not a cold-email standard. Fix: suppress the contact the same day, across every mailbox and sequence.
• No record of the balancing test. If a regulator or an annoyed prospect asks why you emailed them, "we bought a list" is a weak answer. Fix: a short written legitimate interest assessment (LIA) for each campaign type, one page is enough.
• Treating one EU rulebook as universal. The rules shift the moment you email the US, Canada or Australia. Fix: read up on the rules beyond GDPR before expanding.

How enforcement varies across Europe

GDPR is a regulation, so the core is identical in every member state, but the ePrivacy layer is a directive, and each country transposed it with its own accent. Germany and Austria sit at the strict end: German unfair-competition law gives competitors and associations standing to act against unwanted advertising, so DACH campaigns reward tighter targeting and conservative volume. That standing matters more than the statute: a competitor can send you a formal warning letter, the Abmahnung, with costs attached, so enforcement does not wait for a regulator to have time. The table above shows where the other markets land. Telephone outreach splits even further, because consent rules and do-not-call registers mean the legality of B2B cold calling changes country by country.

For sellers targeting the German-speaking market, the practical answer is not to avoid outbound, it is to run it with precise role targeting, restrained cadence and clean records. Serious German outbound therefore leans on the phone, LinkedIn, existing customers and consent gathered in advance rather than on volume email. As a Vilnius-based agency running campaigns across the EU in German, English, Lithuanian and Russian, we build every campaign to the strictest interpretation in the target country, which also happens to produce better reply rates.

Your GDPR cold-email checklist

• Rely on legitimate interest (Art 6(1)(f)) for B2B; never cold-email consumers without consent.
• Email professional addresses about a genuinely relevant offer.
• Identify yourself, who you are and why you're reaching out, in every message.
• Include a clear opt-out, and honor it immediately and permanently.
• Source data from publicly available business sources and keep a record of where it came from.
• Honour data-subject requests (access, erasure) promptly.
• Maintain a suppression list so opted-out contacts are never re-emailed.
• Store the country on every record and apply that country's regime, not one rule per campaign.
• Have a local lawyer read your notice text once per market before you run volume there.

Done right, compliant outreach isn't a constraint, it's a competitive edge. Buyers trust senders who are transparent, and clean practices protect your deliverability at the same time.

Our companion piece, GDPR vs the Spam Act 2003: cold email compared, covers this from a different angle.

A lead magnet trades something of value for a contact detail, and the lead magnet page covers what works in B2B and why most fail.

The Polish sending rule has its own page: cold email law in Poland and Article 398 PKE, with the statute text and fines.