# GDPR for outreach: what it means for your cold emails

> A plain explanation of how the EU and UK data protection rules apply when you find business contacts and email them, plus the habits that keep you on the right side of them.

GDPR for outreach means applying the EU General Data Protection Regulation (and the UK's version of it) to the personal data you collect and use when contacting prospects. In practice it covers how you find a contact, what you store about them, why you are allowed to email them, and how quickly you stop when they ask.

This is a practical overview, not legal advice. Rules differ between countries, and B2B email in particular is also governed by national e-privacy laws, so check the rules that apply to you and your recipients.

## Why it matters when you send cold email

The moment you email a named person at a business, you are handling personal data. A work address like jane.smith@company.com identifies a person, so it counts. GDPR applies when your recipients are in the EU or UK, even if you are based somewhere else.

That matters for three reasons:

- **You need a lawful basis.** For cold B2B outreach, people usually rely on "legitimate interest", which means your interest in contacting them is reasonable and balanced against their rights.
- **You must be transparent.** People are entitled to know where you got their data and how to object.
- **Objections are final.** If someone says stop, you stop, and you keep a record so they are not re-added later.

It also overlaps with deliverability. A list built carefully, with relevant recipients and easy opt-outs, tends to get fewer complaints, which helps keep your sending accounts healthy.

## The core ideas in plain terms

### Legitimate interest

You can generally argue legitimate interest when the person's job is relevant to your offer, the message is about their business, and they could reasonably expect such contact. A web designer emailing a bakery owner about their outdated site fits this pattern. Emailing a random employee's personal Gmail about something unrelated does not.

Many organisations write a short "legitimate interest assessment": a note recording why the outreach is relevant, what data you hold, and how people can opt out. It is a sensible habit even for a one-person business.

### Data minimisation

Only collect what you need for the outreach. Business name, website, city, category and a work email are usually enough. Avoid hoarding data you will never use.

### Generic vs personal addresses

Addresses like info@ or sales@ are less tied to an individual than a named address, though they still carry rules under national e-privacy laws. Our page on [role based email](https://getclient.pro/learn/role-based-email) covers the deliverability side.

### Right to object and erasure

Every email needs a clear way to opt out. If someone asks you to delete their data, do it, while keeping just enough (such as the email address on a suppression list) to make sure you never contact them again.

## A concrete example

Say you run a small marketing agency in Ireland and want to pitch dental clinics in Dublin and Cork.

1. You pull clinics from Google Maps: name, category, address, website and a public practice email.
2. You record your reason: clinics with no online booking may benefit from your service, and the contact is a business address related to that.
3. Your first email is short, relevant and names the source: "I found your clinic on Google Maps and noticed your site has no booking form."
4. The footer has your business name, a way to reach you and a one-click unsubscribe link.
5. A practice manager replies "remove us". You unsubscribe them immediately and keep the address on your suppression list.
6. Three months later you delete data for leads who never engaged and are no longer relevant.

You still need to do the thinking in steps 2, 3 and 6 yourself.

## Common mistakes

- **Assuming B2B is exempt.** GDPR covers named business contacts. Some national laws are stricter still for certain business types, such as sole traders.
- **Buying lists you cannot trace.** If you cannot say where an address came from, you cannot tell the recipient either.
- **Hiding the opt-out.** A tiny "reply STOP" buried under a signature invites complaints. Use a proper unsubscribe link.
- **Re-importing removed contacts.** Uploading a fresh CSV that contains people who already opted out is easy to do by accident. Check imports against your suppression list. See [import leads from CSV](https://getclient.pro/blog/import-leads-from-csv) for tidy import habits.
- **Generic blasts.** Sending the same pitch to everyone weakens your legitimate interest case. Relevance is part of the justification, so segment by category and city.
- **Keeping data forever.** Set a retention period and stick to it.
- **Confusing GDPR with CAN-SPAM.** The US rules are different. Read [CAN-SPAM](https://getclient.pro/learn/can-spam) if you also email US businesses.

## What to do next

A short checklist you can act on this week:

1. Write a one-page note covering your lawful basis, data you collect, where it comes from and how long you keep it.
2. Add your business identity and a working unsubscribe link to every template.
3. Keep one suppression list and check every new list against it.
4. Target only businesses where your offer is genuinely relevant.
5. Set up authentication so your mail is trusted: see [SPF, DKIM and DMARC](https://getclient.pro/learn/spf-dkim-dmarc).
6. Keep sequences short and respectful. The [three step campaign blueprint](https://getclient.pro/resources/three-step-campaign-blueprint) is a reasonable starting structure.

If you want to try building a relevant, sourced list, new GetClient accounts get 100 free credits with no card needed. Plans are on the [pricing page](https://getclient.pro/pricing).

## Frequently asked questions

### Do I need consent to send cold B2B emails under GDPR?

Not always. Many senders rely on legitimate interest instead of consent for relevant B2B outreach. However, national e-privacy laws in some countries require consent for certain recipients, so check the rules where your recipients are based.

### Does GDPR apply if my business is outside the EU?

It can. If you target or contact people in the EU or UK, the regulation can apply to that processing regardless of where you are based.

### Is scraping public business data allowed under GDPR?

Data being public does not remove GDPR obligations. You still need a lawful basis, should collect only what you need, and must tell people where you got their details if they ask.

### How long can I keep data on leads who never replied?

GDPR does not set a fixed period. Pick a retention period you can justify for your outreach, write it down, and delete stale leads when it passes, keeping only suppression entries.

### What should I do if someone asks what data I hold on them?

Respond within the legal deadline, which is generally one month, telling them what you hold, where it came from and why. Then honour any request to delete or stop contact.

Source: https://getclient.pro/learn/gdpr-for-outreach