GDPR and B2B Cold Email: What's Actually Permitted in the EU

GDPR is the most misunderstood regulation in B2B email marketing. Most guides either claim GDPR bans cold email entirely (wrong) or dismiss it as irrelevant (also wrong). This guide covers what GDPR actually says, what legitimate interest means in practice, and what German UWG §7 adds on top.

GDPR Does Not Ban B2B Cold Email

GDPR Article 6.1(f) — the legitimate interest basis — explicitly permits processing personal data where the controller has a legitimate purpose, the processing is necessary for that purpose, and the interest is not overridden by the data subject's rights. B2B cold email to corporate email addresses at registered businesses, where the email is relevant to the recipient's professional role, consistently passes all three tests under guidance from the EDPB (European Data Protection Board) and national DPAs.

What Legitimate Interest Requires

A defensible legitimate interest claim for B2B cold email requires documentation of three things: (1) Purpose — your specific commercial reason for the contact. (2) Necessity — why email is a proportionate way to achieve that purpose. (3) Balancing test — your interest does not override the recipient's rights given the professional context of the email, its relevance to their role, and the presence of a clear opt-out.

Germany: UWG §7 Makes It Stricter

Germany adds its own layer through UWG §7 (Unfair Competition Act). German courts require a documented prior business relationship, explicit consent, or clear professional publication of the email address without a prohibition. The practical implication: German B2B cold email requires more careful data sourcing and documentation than other EU markets.