For most GDPR-aware B2B cold email, the practical route is legitimate interest, not consent, but only when the outreach is tightly targeted, relevant, transparent, and easy to refuse. GDPR Article 6(1)(f) allows processing where a real business interest is not overridden by the person’s rights, and regulators often discuss this route for direct marketing [source: ICO]. That does not mean “email anyone you can scrape.” It means you need a defensible reason, a clean process, and proof that you thought about the recipient before pressing send.

TLDR: Legitimate interest can support B2B cold email when the recipient has a clear professional link to your offer, such as emailing a Head of IT about endpoint security. Consent is safer but often unrealistic for first-touch sales, because you usually do not have it yet. A compliant campaign might target 500 finance directors, exclude personal Gmail addresses, keep only work-related data, and see a 3% reply rate while logging opt-outs within 24 hours. If your list is vague, your message is generic, or your unsubscribe process is clumsy, expect legal and reputational trouble.

Legitimate interest vs consent: the real difference

Consent means the person has clearly agreed to receive your marketing. Under GDPR, consent must be specific, informed, freely given, and easy to withdraw. Pre-ticked boxes do not count. Silence does not count. “They downloaded a report two years ago” may not count either, unless the wording was clear.

Legitimate interest is different. You do not need prior permission, but you must show that your interest is real and balanced against the person’s privacy rights. In B2B prospecting, that interest is usually selling a relevant product or service to another business.

The catch is that legitimate interest is not a magic phrase you paste into a privacy policy. You need to run a Legitimate Interests Assessment, often called an LIA. It asks three basic questions:

• Purpose test: Why are you contacting this person?
• Necessity test: Is email outreach a reasonable way to do it?
• Balancing test: Would the recipient expect this contact, and could it cause harm or annoyance?

If those answers are weak, your basis is weak.

When legitimate interest usually makes sense

Legitimate interest is most defensible when your campaign is narrow. Think quality over volume. A software company emailing compliance managers about audit automation has a stronger case than a random agency blasting every “info@” and named contact it can find.

Good signs include:

• The recipient works in a role linked to your offer.
• You are contacting them at a business email address.
• The message is about their employer’s needs, not their private life.
• You explain why you contacted them.
• You include a simple opt-out in every email.
• You suppress unsubscribed contacts across all future campaigns.

For example, emailing Operations Directors at logistics firms about route planning software is easier to justify. Emailing the same people about a personal investment scheme is a problem. The role, context, and offer must line up.

When consent is the better choice

Consent is better when the contact is more intrusive, frequent, or unrelated to the person’s role. It is also safer for newsletters, webinars, partner promotions, and nurture sequences that continue long after the first exchange.

You may also need consent because of local electronic marketing rules. GDPR is only one piece of the puzzle. In the EU and UK, email marketing rules also come from ePrivacy laws, such as the UK’s PECR. Some countries are stricter than others, especially for emailing sole traders or partnerships. Corporate email rules can differ from rules for individual subscribers.

Honestly, it feels like this is where many teams lose the plot. They check GDPR, ignore local marketing law, then wonder why their legal review takes three extra weeks. GDPR answers the personal data question. ePrivacy-style rules answer the marketing channel question.

Personal data still matters in B2B

A work email address like maria.smith@company.com is personal data if it identifies a person. A job title, LinkedIn profile, direct dial, and email history can also be personal data. So yes, GDPR applies even when you are selling to companies.

You should collect the minimum needed. Usually that means:

• Name
• Work email
• Job title
• Company name
• Business need or segment
• Source of the data
• Opt-out status

Do not store extra details because your sales tool makes it easy. Extra data creates extra risk. It also slows teams down. I have seen reps waste 20 seconds per record scrolling through useless enrichment fields when all they needed was role, company, and reason for contact.

What a compliant cold email should include

A strong first email is short, clear, and honest. It should not hide who you are or why you are writing.

Include these elements:

• Your identity: Company name and sender name.
• Reason for contact: A short line explaining why the recipient is relevant.
• Value statement: A clear business reason, not hype.
• Privacy link: A link to your privacy notice.
• Opt-out: A simple way to say no.

Here is a plain example:

Hi Priya, I’m contacting you because you lead procurement at a mid-sized manufacturing group. We help procurement teams reduce supplier onboarding time by centralizing risk checks. If this is not relevant, reply “no thanks” and I will not contact you again. Our privacy notice is here.

That email is not perfect for every country. Still, it shows the right attitude. It is specific, work-related, and easy to refuse.

Do not buy lists blindly

Purchased lists are risky. They can be legal in some cases, but only if the data was collected fairly, the source is clear, and people were told their data might be used for this kind of outreach. Many list vendors make bold claims. Ask for proof.

Before using a list, check:

• Where the data came from
• When it was collected
• Whether the people were informed
• Whether opt-outs are included
• Which countries are covered
• Whether the vendor can remove stale records

If the vendor cannot explain the source, walk away. “Publicly available” does not always mean “free to use for cold email.”

Retention, suppression, and follow-ups

Compliance does not end after the first email. You need rules for follow-ups and deletion. A common approach is to run a short sequence, then stop. For example, send one initial email and two follow-ups over 21 days. If there is no reply, suppress or delete the contact unless you have a clear reason to keep it.

Keep opt-out records longer than prospecting records. That may sound odd, but it helps you avoid contacting someone again. A suppression list should store only what is needed, such as the email address and opt-out date.

A practical compliance checklist

Before launching a B2B cold email campaign, confirm that you can answer “yes” to these points:

• You have completed a Legitimate Interests Assessment.
• The audience is tightly linked to the offer.
• You use work contact details, not private contact details.
• Your source of data is recorded.
• Your email explains why you are contacting the person.
• Your privacy notice is easy to find.
• Every email has a clear opt-out.
• Opt-outs are processed quickly.
• You have checked local electronic marketing rules.
• You delete or suppress stale contacts.

The smart middle ground

GDPR does not ban B2B cold email. It bans careless use of personal data. There is a big difference.

If you use legitimate interest, make your outreach narrow, relevant, and respectful. If you use consent, make it real and recorded. The best teams treat compliance as a sales filter. It removes bad-fit contacts, sharpens messaging, and reduces angry replies. That is not just safer. It is better prospecting.