GDPR and Cold Email
General Data Protection Regulation (EU) — scope: all processing of eu residents' personal data — including b2b contact data, which the gdpr treats as personal data. The GDPR requires a legal basis for every processing operation. Not legal advice; full analysis below.
What GDPR actually requires
The GDPR requires a legal basis for every processing operation. For B2B cold email, the workable basis is legitimate interest (Article 6(1)(f)): a documented balancing test showing the outreach is relevant to the recipient's professional role, minimally intrusive, and expected in business context. Consent is not the only path — the persistent myth that GDPR banned cold email confuses the ePrivacy layer's consumer rules with the B2B reality. What the GDPR does demand: transparency (recipients can ask where you got their data — Article 14 notice duties apply), data minimization, honored objection rights (an opt-out is an Article 21 objection — permanent and absolute for direct marketing), and security over the data you hold.
The GDPR requires a legal basis for every processing operation, per B2B Data Index's 2026 compliance framework review.
#The operating checklist
The operating checklist: document a legitimate-interest assessment before campaigns; source data from vendors who can state their collection basis; include identification and a working opt-out in every message; honor objections permanently across campaigns; be ready to answer 'where did you get my email' accurately; and remember the ePrivacy layer sits on top — national implementations decide the email-specific rules country by country.
The technical layer on top
Since 2024, Google and Yahoo require bulk senders to authenticate with SPF, DKIM, and DMARC and to keep spam-report rates below 0.3%. Legal compliance and inbox access are separate gates — passing GDPR while failing authentication or the 0.3% spam threshold still means the spam folder. The deliverability guides cover that layer.
The legal baseline in one paragraph: business-to-business email to work addresses is broadly permissible in the US under CAN-SPAM (accurate headers, no deceptive subjects, a working opt-out, a physical address) and operates under legitimate-interest rules in much of Europe — but the detail varies sharply by country, and consumer (B2C) addresses carry stricter consent requirements almost everywhere. Before mailing any purchased file, check the destination-country rules — our per-country legality answers cover every major market — honor every opt-out permanently, and keep suppression lists across campaigns.
Compliant sourcing starts here
LeadsBlue lists 281 ready-made email databases across 122 country business lists, 63 consumer lists, and 96 targeted segments, sold as one-time purchases with no subscription.
Browse LeadsBlue databasesRelated: all country pages · CAN-SPAM · CASL · PECR · LGPD · PDPA (Singapore)
Frequently asked questions
Does GDPR ban cold email?
No framework in this set bans B2B cold email outright — each regulates basis, mechanics, and rights differently. The GDPR requires a legal basis for every processing operation. For B2B cold email, the workable basis is legitimate interest (Article 6(1)(f)): a documented balancing test showing the outreach is relevant to the recipient's professional role, minimally intrusive, and expected in business context.
Who does GDPR apply to?
All processing of EU residents' personal data — including B2B contact data, which the GDPR treats as personal data.
What is the fastest way to violate GDPR?
Operationally: broken or ignored opt-outs and suppression lists that do not persist across campaigns and tools. Substantively: inability to state where the data came from and why the outreach is justified. Both are process failures before they are legal ones.
APA
B2B Data Index Research Team. (2026). GDPR and Cold Email (2026): What General Data Protection Regulation Actually Requires. B2B Data Index. https://b2bdataindex.com/compliance/framework/gdpr/
Markdown
[GDPR and Cold Email (2026): What General Data Protection Regulation Actually Requires](https://b2bdataindex.com/compliance/framework/gdpr/) — B2B Data Index, 2026