GDPR requires a lawful basis, transparency, and respect for individual rights whenever you process personal data about people in the EU, including business contacts.
Key points
- GDPR applies to any Personal Data, and a work email such as firstname.lastname@company.com counts, so B2B Cold Email is in scope [1][2].
- It reaches non-EU companies too: Article 3 covers organizations that offer goods or services to, or monitor, people in the EU [3].
- Every processing activity needs one of six lawful bases in Article 6; for Outbound Sales this is usually Legitimate Interest rather than Consent [2].
- Article 5 principles include purpose limitation, accuracy, storage limitation and Data Minimization [1].
- Individuals can object to direct marketing at any time, and the objection is absolute; they can also request access and the Right to Erasure [4].
- The maximum fines are 20 million euros or 4% of global annual turnover, whichever is higher, for breaches of the core principles and rights [5].
Scope and key roles
GDPR is built around a few defined roles. The controller decides why and how personal data is processed; the processor handles data on the controller's behalf, under a Data Processing Agreement (DPA); and the data subject is the person the data is about [1]. The regulation applies to controllers and processors established in the EU, and under Article 3(2) also to those elsewhere who offer goods or services to people in the EU or monitor their behavior there [3]. A US startup emailing German prospects is therefore within reach. Since Brexit, the UK runs a near-identical copy called the UK GDPR, alongside PECR for electronic marketing, so the same core ideas apply to UK prospects with some local differences. In the US, California's CCPA / CPRA gives residents comparable rights over their personal information.
What GDPR means for cold outreach
GDPR does not ban cold outreach to business contacts, but it does require you to justify it, even when the details were publicly available. Recital 47 notes that direct marketing may be regarded as a legitimate interest, which is why many B2B senders rely on that basis after a documented balancing test [2]. You also have to be transparent: when data was not obtained from the person, Article 14 requires you to tell them who you are, why you have their data, and where it came from, at the latest when you first contact them [5]. Keep the Lead List lean, keep contact data accurate to limit Data Decay, and honor any Opt-Out immediately. Separately, the EU ePrivacy rules and national laws can require consent for marketing email to individuals, so check the recipient's country.
Rights, enforcement and practical steps
Data subjects have rights to be informed, to access, to rectification, to erasure, to restrict processing, to data portability and to object [4]. Controllers must respond without undue delay and generally within one month. For marketing, the right to object in Article 21(3) is decisive: once someone objects, you must stop using their data for direct marketing, which in practice means adding them to a Suppression List rather than deleting every trace [4]. Enforcement is handled by national supervisory authorities, and Article 83 sets two fine tiers, up to 10 million euros or 2% of turnover and up to 20 million euros or 4% [5]. A good baseline is a record of processing, a legitimate interest assessment, a clear privacy notice, and a quick path to honor objections. This is general information, not legal advice.
Related terms
Outreach without the busywork.
PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.
Start free with 100 credits →