Do you need consent to send B2B cold email in the EU?

It depends on the country. The GDPR itself allows legitimate interests as the basis for processing, but national implementations of the ePrivacy rules differ on electronic marketing, and some treat B2B email as requiring consent. Check the rule for the recipient country rather than applying one policy across Europe.

Does a lawful basis need to be written down?

Yes. Accountability under the GDPR means being able to show which basis you chose and why, and where the basis is legitimate interests the assessment behind it is the record. A basis decided informally is indistinguishable from no basis when someone asks.

Does a lawful basis remove the right to object?

No. Where processing relies on legitimate interests, the data subject can object, and for direct marketing an objection must be honoured without a balancing test. In practice that means an opt-out has to work immediately and the address has to reach a suppression list.

JaxSuite AI

What Is a GDPR Lawful Basis?

TL;DR

A GDPR lawful basis is the legal ground a controller relies on to process personal data. Article 6 of the GDPR lists six: consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. One must be identified before the processing starts.

What are the six lawful bases?

Article 6(1) sets them out from (a) to (f): consent given by the data subject, processing necessary for a contract with them, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, and the legitimate interests of the controller or a third party.

They are alternatives rather than a ranking, and exactly one applies to a given purpose. Naming two as a fallback does not strengthen the position, because the safeguards and the rights of the data subject differ between them, so the basis has to be chosen and recorded before processing rather than defended afterwards.

Which lawful basis fits B2B cold email?

Legitimate interests, Article 6(1)(f), is the basis most B2B senders rely on for prospecting, because a business contacted at a work address about something relevant to their role has an interest that can be weighed against the processing. It is the basis for holding and using the data.

It is not the whole picture. Rules on electronic marketing sit on top of the GDPR through the ePrivacy regime, implemented nationally, and several member states apply consent requirements to B2B email that others do not. The country of the recipient therefore changes the answer, which is the part a single policy applied across Europe tends to miss.

What does a legitimate interests assessment involve?

Three questions, written down before sending. What is the interest being pursued, is the processing necessary to achieve it or could a less intrusive route work, and does the interest outweigh the rights and reasonable expectations of the person. That record is the assessment.

The balancing question is where cold outreach is won or lost, and relevance is what decides it. A message to a named role about something that role plausibly deals with is within reasonable expectations; the same list mailed indiscriminately is not, which makes targeting a compliance matter and not only a performance one.

FAQ

Frequently asked questions

It depends on the country. The GDPR itself allows legitimate interests as the basis for processing, but national implementations of the ePrivacy rules differ on electronic marketing, and some treat B2B email as requiring consent. Check the rule for the recipient country rather than applying one policy across Europe.