B2B Email Data Compliance Checklist 2026 — 44 Countries

Sending a B2B cold email campaign without documented compliance is a liability risk that compounds with scale. This checklist covers what you need to document before every campaign, by jurisdiction, to maintain defensible compliance across all major markets.

Universal Requirements (Every Jurisdiction)

Before any campaign, regardless of target country: (1) Accurate sender identification — your real company name and contact information must be clearly visible in the From field and email body. Spoofing, impersonation, or deceptive sender names violate law in every major jurisdiction. (2) Working opt-out mechanism — the unsubscribe link must work within 10 days (CAN-SPAM) or immediately (GDPR). Test it before sending. (3) Physical address — include your company's physical postal address in every email. (4) Honest subject lines — the subject line cannot be deceptive about the content of the email. These four requirements apply everywhere.

United States (CAN-SPAM)

No prior consent required for B2B cold email to corporate addresses. Additional requirements beyond universal: opt-out honoured within 10 business days (not immediately), clear identification of commercial nature if not obvious from context. CAN-SPAM applies to emails sent from the US or to US recipients. The FTC enforces CAN-SPAM with penalties up to $51,744 per violation. Class actions are rare — government enforcement is the primary mechanism.

Document: data source for each contact list, send date, opt-out mechanism URL, and opt-out processing records.

European Union (GDPR)

Legitimate interest (Article 6.1f) is the standard legal basis for B2B cold email to corporate email addresses at registered organisations in the EU. Three-part test required: (1) Legitimate purpose — genuine commercial reason for contact. (2) Necessity — email is reasonably necessary to achieve that purpose. (3) Balancing — your legitimate interest is not overridden by the recipient's rights and freedoms. B2B cold email generally passes all three where the email is relevant to the recipient's professional role.

Document: Legitimate Interest Assessment (LIA) completed before first send, data source and collection methodology, categories of data processed, third-party processor agreements (DPA) with any data vendors.

Canada (CASL) — Strictest Requirements

CASL requires implied or express consent before sending commercial electronic messages. Implied consent exists when: (a) a business email address is conspicuously published in connection with a professional role without a prohibition statement, (b) there is an existing business relationship (purchase, contract, or enquiry within 2 years), or (c) the contact gave their business card directly to the sender. Express consent is explicit opt-in. CASL penalties: up to C$10 million per day for organisations, C$1 million per day for individuals.

Document: Source of each Canadian contact, implied consent basis for each contact category, consent date, and opt-out processing records with timestamps.

United Kingdom (UK GDPR + PECR)

UK GDPR legitimate interest applies for corporate email addresses at registered UK companies. PECR requires consent for sole traders and partnerships. Practical guidance: if the email address is at a registered limited company (Ltd or PLC) domain, UK GDPR legitimate interest applies. If the email address belongs to a sole trader or partnership, PECR consent is required. The ICO enforces both frameworks.

Singapore, Australia, New Zealand

Singapore PDPA: explicitly exempts business contact information from its definition of personal data — one of the world's most B2B-permissive frameworks. Australia Spam Act: inferred consent available when business email is conspicuously published without prohibition. New Zealand Unsolicited Electronic Messages Act: similar inferred consent framework to Australia. All three require working opt-out mechanisms and accurate sender identification.