# How to Send B2B Cold Email Under GDPR Without Guesswork

> A practical, step-by-step setup for emailing European businesses: what data to collect, how to document legitimate interest, and what every email needs. Not legal advice.

You want to email businesses in Europe, and someone told you GDPR makes cold email illegal. Someone else told you B2B is exempt. Neither is quite right, and the uncertainty is probably stopping you from sending at all.

This guide picks one goal: setting up a B2B cold email process that holds up under GDPR's well-established principles, step by step. It is not legal advice. Rules differ by country, especially for electronic marketing, so check what applies to you and your recipients, and talk to a lawyer if the stakes are high.

## What GDPR actually cares about in cold email

GDPR covers personal data. A generic address like info@ a company still often sits outside the strictest worries, but a named address like anna@ a company is personal data about Anna. Most B2B cold email touches personal data, so assume GDPR applies when you email people in the EU or UK.

GDPR does not demand consent for everything. It requires a lawful basis. For B2B outreach, the basis people usually rely on is **legitimate interest**: you have a genuine business reason, the processing is necessary for it, and it does not override the person's rights and reasonable expectations.

Separately, many EU countries have national e-marketing rules (based on the ePrivacy Directive) that can be stricter, and some require prior consent even for business addresses. Germany is commonly cited as strict. Check the country before you build a list for it.

## Step 1: Write a short legitimate interest assessment

Do this today. It takes 20 minutes and it is the document you will want if anyone ever asks. Answer three questions in a plain text file:

1. **Purpose:** What is your business reason? Example: "Offering website redesign services to restaurants whose sites are outdated."
2. **Necessity:** Why is email to this person the reasonable way to do it? Example: "The owner decides on the website; their public business email is the direct channel."
3. **Balance:** Would this person reasonably expect a relevant business offer at this address? What do you do to limit the impact? Example: "Only role-relevant contacts, one short sequence, easy opt-out, data deleted if no interest."

If you cannot write a convincing answer to question 3 for a segment, drop that segment.

## Step 2: Collect only what you need, from public business sources

Data minimisation is a core GDPR principle. For a cold email you typically need the company name, a business email, maybe a first name, the city and category, and a reason they fit.

Good habits:

- Prefer data the business published itself for business purposes, such as its website or [Google Business Profile](https://getclient.pro/learn/google-business-profile).
- Do not collect personal social profiles, home addresses or anything unrelated to the offer.
- Record where each lead came from and when. A "source" and "date collected" column is enough.

If you use GetClient's Google Maps scraper, it pulls public business details such as name, category, address, website and emails found, and you can save leads into folders with custom fields. Add a source field there so your records stay in one place rather than across several exported spreadsheets.

## Step 3: Target relevance, not volume

Legitimate interest is much easier to defend when the message plainly fits the recipient's job. A tailored offer to auto repair shops about booking tools is relevant. A blast to every company in a country is hard to justify.

Pick a niche, define who decides, and write to that role. If you need ideas for tight segments, [these Google Maps niche ideas](https://getclient.pro/resources/google-maps-niche-ideas) help. Personalising with real details (their city, category, website) also shows the email is not random; see [subject line personalization](https://getclient.pro/blog/subject-line-personalization).

## Step 4: Build every email to be transparent and easy to refuse

Each cold email should include:

- **Who you are:** your real name, company and a physical or business address.
- **Why them:** one line explaining why you contacted this business.
- **Where you got the address:** for example, "I found your email on your website." GDPR's transparency rules expect people to be told the source of their data within a reasonable time, and the first email is a natural place.
- **A clear opt-out:** a working unsubscribe link or "reply 'no' and I won't email again."
- **A link to a privacy notice** that explains what you store, why, how long, and how to ask for deletion.

A simple footer example:

> I found your address on your company website. If this isn't relevant, click unsubscribe or reply "stop" and I'll remove you. How we handle your data: yoursite.com/privacy

## Step 5: Keep sequences short and respect objections fast

A right to object to direct marketing is absolute under GDPR: once someone says stop, you stop, everywhere. Practical rules:

- Keep follow-ups to a small number. Two or three is a sensible rule of thumb.
- Treat any "not interested" reply as an opt-out and add it to a suppression list.
- Keep the suppression list (just the email address) so you never re-add them from a new scrape. That small retention is generally seen as justified because its purpose is to honour the objection.
- Send at modest volumes from your own accounts. This is good practice for deliverability too; see [email sending limits](https://getclient.pro/learn/email-sending-limits).

## Step 6: Set retention and deletion rules

Decide now how long you keep non-responding leads. A rule like "delete or anonymise leads with no engagement after 6 months" is a reasonable starting point; pick what fits your sales cycle and write it in your privacy notice.

Also be ready for access and deletion requests. If someone asks what you hold, you should be able to find them, export their record and delete it within a month. Searching one lead database makes this far easier than hunting across tools.

## A quick checklist before your first EU send

| Item | Done? |
|---|---|
| Legitimate interest assessment written | |
| Country e-marketing rules checked | |
| Only business-relevant fields collected, with source and date | |
| Email states who you are, why them, and data source | |
| Unsubscribe link and privacy notice link in every email | |
| Suppression list in place | |
| Retention period set | |

If you are new to outreach generally, start with [cold email for beginners](https://getclient.pro/blog/cold-email-for-beginners), then apply this checklist on top. When you are ready to try it, GetClient gives new accounts free credits with no card; plans are on the [pricing page](https://getclient.pro/pricing).

## Frequently asked questions

### Is B2B cold email exempt from GDPR?

No. If you email a named person at an EU or UK company, you are processing personal data and GDPR applies. B2B context mainly helps you argue legitimate interest, it does not remove the rules.

### Do I need consent to cold email EU businesses?

Under GDPR itself, legitimate interest can be a lawful basis instead of consent. But national e-marketing laws in some countries require prior consent even for business recipients, so check the rules for each country you target.

### Can I email a generic address like info@ without worrying?

Generic addresses usually carry less personal data risk, but national e-marketing rules can still apply to them. Keep the same standards: relevance, identification and an easy opt-out.

### I am outside the EU. Does GDPR still apply to me?

It can. GDPR can apply to organisations outside the EU when they target or monitor people in the EU. If you email European prospects, it is safest to follow its principles.

### What should I do if someone asks me to delete their data?

Delete their record, confirm it to them, and keep only their email on a suppression list so you do not contact them again. Respond within one month.

Source: https://getclient.pro/blog/gdpr-cold-email-b2b