GDPR Legitimate Interest: The Complete Legal Framework for B2B

Legitimate interest is the most misunderstood lawful basis in GDPR. Misapplication leads either to unnecessary consent collection that makes B2B outreach impractical, or to overclaiming that creates genuine legal exposure. This guide covers the complete legal framework as written in the Regulation, not simplified summaries that omit critical conditions.

Article 6(1)(f): The Exact Legal Text and What It Means

GDPR Article 6(1)(f) states that processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Every word matters for compliance analysis.

Necessary is not equivalent to convenient or useful. Processing must be the minimum required for the legitimate purpose. Legitimate interests must be real, present interests of the controller. The balancing test weighing controller interests against data subject interests is mandatory and must be documented. Three conditions must all be satisfied simultaneously: (1) the controller pursues a legitimate interest, (2) the processing is necessary for that interest, and (3) the interest is not overridden by the data subject's interests, rights, or freedoms. Failure on any one condition means legitimate interest does not apply.

Recital 47: The B2B Cold Email Justification

Recital 47 of GDPR explicitly addresses direct marketing as a context where legitimate interest may apply: the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. This recital is the textual foundation for GDPR-compliant B2B cold email. It establishes that direct marketing is not inherently incompatible with legitimate interest as a lawful basis.

Recital 47 continues: such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller. The phrase such as indicates that a pre-existing client relationship is an example, not a requirement. A non-client business contact who could plausibly benefit from your service and whose professional email address is publicly associated with their business role can satisfy the relationship requirement.

The Three-Part Legitimate Interest Assessment (LIA)

The ICO (UK) and EDPB (EU) both require controllers relying on legitimate interest to conduct and document a Legitimate Interest Assessment. The LIA has three sequential parts that must all be satisfied.

Part 1 — Purpose Test: Is there a legitimate interest? The purpose must be lawful, not prohibited by any law. Direct marketing, business development, and informing potential customers of relevant services all pass the purpose test when the organisation genuinely provides relevant services to the audience it is contacting.

Part 2 — Necessity Test: Is the processing necessary for the purpose? Processing the professional email address and job title is necessary to send relevant outreach to the right person. Processing personal health information or home addresses is not necessary and fails this test.

Part 3 — Balancing Test: Do the legitimate interests override the data subject's interests, rights, and freedoms? Factors that tip the balance toward the controller: the data subject is a professional acting in their professional capacity, the data processed is professional contact information, opt-out mechanisms are provided and respected.

What Makes B2B Cold Email Pass the Balancing Test

B2B cold email to professional email addresses at company-relevant job titles generally passes the balancing test when: the contacted role has a plausible professional interest in the offer; the contact was made through a professionally published email address associated with their business role; opt-out is clear, immediate, and honoured; and the processing is limited to sending commercially relevant outreach rather than extensive profiling.

EDPB guidelines emphasise that the reasonable expectations of the data subject are a key balancing factor. A professional who has published their business email address on a company website or professional directory has a higher reasonable expectation of receiving relevant professional outreach than a private individual whose email was extracted from a personal context.

The Role of ePrivacy Directive (PECR in UK)

GDPR and the ePrivacy Directive are separate legal frameworks that both apply to email marketing. GDPR governs data processing generally. ePrivacy Directive governs the specific act of sending electronic communications to individuals.

Under PECR (UK): direct marketing email to corporate subscribers (a company email address, or an employee at their work address where the company is the subscriber) is permitted under opt-out basis. This aligns with legitimate interest under GDPR as the lawful basis for the data processing. B2B cold email to work email addresses at companies is regulated differently from email to personal addresses — PECR allows B2B outreach to corporate addresses on an opt-out basis.

LIA Documentation: What Must Be Recorded

Controllers relying on legitimate interest must maintain a written LIA. A compliant LIA for B2B cold email includes: (1) the specific processing activity described in plain language, (2) the legitimate interest identified (direct marketing of relevant professional services), (3) necessity analysis demonstrating that only minimum required data is processed, (4) balancing test documentation identifying the data subjects, the nature of data, the reasonable expectations of data subjects, opt-out provision, and the conclusion, (5) date of assessment and name of person conducting it, (6) decision to proceed on legitimate interest basis with rationale.

The LIA does not need to be shared with data subjects, but must be available to demonstrate compliance if a supervisory authority requests evidence. Regulators have consistently accepted well-documented LIAs as sufficient evidence of compliance for B2B direct marketing.

Common Non-Compliant Practices and Practical Checklist

Four practices frequently result in regulatory complaints: (1) sending to personal email addresses and claiming legitimate interest — this fails the balancing test; (2) processing special category data as part of targeting even if the email itself is innocuous; (3) sending to individuals who have previously opted out and relying on the passage of time as implicit re-engagement permission; (4) using data collected for one purpose for cold outreach without informing the data subject at collection time.

Implement these safeguards: restrict cold email to corporate addresses on company domains; screen against a suppression list before every send; include a clear privacy notice link in every email; honour opt-outs within 30 days; document the LIA before the campaign launches. The global compliance matrix at B2B Data Index provides jurisdiction-by-jurisdiction requirements for 44 countries including all EU member states and the UK.