GDPR for outreach: what it means for your cold emails

GDPR for outreach means applying the EU General Data Protection Regulation (and the UK's version of it) to the personal data you collect and use when contacting prospects. In practice it covers how you find a contact, what you store about them, why you are allowed to email them, and how quickly you stop when they ask.

This is a practical overview, not legal advice. Rules differ between countries, and B2B email in particular is also governed by national e-privacy laws, so check the rules that apply to you and your recipients.

Why it matters when you send cold email

The moment you email a named person at a business, you are handling personal data. A work address like jane.smith@company.com identifies a person, so it counts. GDPR applies when your recipients are in the EU or UK, even if you are based somewhere else.

That matters for three reasons:

• You need a lawful basis. For cold B2B outreach, people usually rely on "legitimate interest", which means your interest in contacting them is reasonable and balanced against their rights.
• You must be transparent. People are entitled to know where you got their data and how to object.
• Objections are final. If someone says stop, you stop, and you keep a record so they are not re-added later.

It also overlaps with deliverability. A list built carefully, with relevant recipients and easy opt-outs, tends to get fewer complaints, which helps keep your sending accounts healthy.

The core ideas in plain terms

Legitimate interest

You can generally argue legitimate interest when the person's job is relevant to your offer, the message is about their business, and they could reasonably expect such contact. A web designer emailing a bakery owner about their outdated site fits this pattern. Emailing a random employee's personal Gmail about something unrelated does not.

Many organisations write a short "legitimate interest assessment": a note recording why the outreach is relevant, what data you hold, and how people can opt out. It is a sensible habit even for a one-person business.

Data minimisation

Only collect what you need for the outreach. Business name, website, city, category and a work email are usually enough. Avoid hoarding data you will never use.

Generic vs personal addresses

Addresses like info@ or sales@ are less tied to an individual than a named address, though they still carry rules under national e-privacy laws. Our page on role based email covers the deliverability side.

Right to object and erasure

Every email needs a clear way to opt out. If someone asks you to delete their data, do it, while keeping just enough (such as the email address on a suppression list) to make sure you never contact them again.

A concrete example

Say you run a small marketing agency in Ireland and want to pitch dental clinics in Dublin and Cork.

1. You pull clinics from Google Maps: name, category, address, website and a public practice email.
2. You record your reason: clinics with no online booking may benefit from your service, and the contact is a business address related to that.
3. Your first email is short, relevant and names the source: "I found your clinic on Google Maps and noticed your site has no booking form."
4. The footer has your business name, a way to reach you and a one-click unsubscribe link.
5. A practice manager replies "remove us". You unsubscribe them immediately and keep the address on your suppression list.
6. Three months later you delete data for leads who never engaged and are no longer relevant.

In GetClient, steps 1, 4 and 5 happen in one place: the Google Maps scraper builds the list, every campaign email carries a per-recipient unsubscribe link, and unsubscribed addresses are skipped automatically in future sends. You still need to do the thinking in steps 2, 3 and 6 yourself.

Common mistakes

• Assuming B2B is exempt. GDPR covers named business contacts. Some national laws are stricter still for certain business types, such as sole traders.
• Buying lists you cannot trace. If you cannot say where an address came from, you cannot tell the recipient either.
• Hiding the opt-out. A tiny "reply STOP" buried under a signature invites complaints. Use a proper unsubscribe link.
• Re-importing removed contacts. Uploading a fresh CSV that contains people who already opted out is easy to do by accident. Check imports against your suppression list. See import leads from CSV for tidy import habits.
• Generic blasts. Sending the same pitch to everyone weakens your legitimate interest case. Relevance is part of the justification, so segment by category and city.
• Keeping data forever. Set a retention period and stick to it.
• Confusing GDPR with CAN-SPAM. The US rules are different. Read CAN-SPAM if you also email US businesses.

What to do next

A short checklist you can act on this week:

1. Write a one-page note covering your lawful basis, data you collect, where it comes from and how long you keep it.
2. Add your business identity and a working unsubscribe link to every template.
3. Keep one suppression list and check every new list against it.
4. Target only businesses where your offer is genuinely relevant.
5. Set up authentication so your mail is trusted: see SPF, DKIM and DMARC.
6. Keep sequences short and respectful. The three step campaign blueprint is a reasonable starting structure.

If you want to try building a relevant, sourced list, new GetClient accounts get 100 free credits with no card needed. Plans are on the pricing page.