GDPR and Cold Email: What B2B Sales Teams Actually Need to Do

The Common Misconception

Many sales teams believe GDPR prohibits cold email to EU-based prospects. It does not. What GDPR regulates is how you collect, store, and use personal data—including the business email addresses you prospect with. With the right practices, cold B2B email to EU prospects is fully compliant.

The Legal Basis for B2B Cold Email Under GDPR

GDPR requires a lawful basis for processing personal data. For B2B cold email, the relevant basis is legitimate interests (Article 6(1)(f)). This means you can email a business professional if:

1. You have a legitimate business interest in contacting them
2. The contact is relevant to their professional role
3. Your interest does not override their rights and interests

In practice, this means: emailing a VP of Sales at a SaaS company about a sales tool = likely legitimate. Emailing that same person about an unrelated consumer product = likely not.

What You Must Do to Be Compliant

1. Have a Privacy Policy

Your company must have a GDPR-compliant privacy policy that explains what data you collect and how you use it. Include a link or reference in your email footer.

2. Identify Your Data Source

Be prepared to tell any prospect where you obtained their contact information. "From LinkedIn" or "from a public database" is generally acceptable.

3. Honor Opt-Outs Immediately

When someone asks to be removed from your list, you must comply within one month (though best practice is 24–72 hours). You must also not re-add them.

4. Do Not Store Data Longer Than Necessary

Contacts that have never engaged and have not replied in 12 months should be suppressed or deleted. Set up automated data retention policies in your CRM.

5. Avoid Excessive Personal Data

Do not add GDPR-covered personal data (personal email addresses, phone numbers from personal social profiles) to your sequences without a clear legitimate interest rationale.

PECR: The Additional UK/EU Regulation to Know

In the UK, the Privacy and Electronic Communications Regulations (PECR) applies alongside GDPR. PECR is more permissive for B2B than B2C: you can email business contacts at their corporate address without prior consent, as long as you follow GDPR data principles.

Practical Compliance Checklist

• [ ] Privacy policy published and accessible
• [ ] Data source documented for all prospect lists
• [ ] Unsubscribe mechanism in every email
• [ ] Suppression list maintained and honored
• [ ] Data retention policy in place (12-month inactivity = suppress)
• [ ] Only emailing prospects whose role makes your email relevant

GDPR compliance is achievable without limiting your outbound volume. The investment is in process, not in stopping outreach.