The short version
Cold B2B email is not banned under the GDPR. Many businesses send it on the basis of legitimate interest. That basis only holds if you can show you thought it through: a real business reason, a message that fits the recipient's role, a clear way to say no, and a record of where each address came from.
The GDPR is not the only rule that applies. Email marketing is also covered by national rules based on the ePrivacy Directive, and those differ per country. Some countries allow cold email to business addresses on an opt-out basis. Others treat a named person's work address almost like a private one and expect prior consent. Know the rules of the country where your recipients are.
This guide is general information, not legal advice. It describes how the rules are commonly applied to B2B outreach. For your own situation, check with a privacy professional or your data protection authority.
Legitimate interest as the basis
Article 6 of the GDPR lists six lawful bases for processing personal data. For cold outreach, consent is usually not available, because you have not spoken to the person yet. That leaves legitimate interest (Article 6(1)(f)). Recital 47 says that processing for direct marketing may be regarded as a legitimate interest. It is a possibility, not a free pass.
Legitimate interest means you weigh your interest against the interests and rights of the person you write to. You do that weighing before you send, and you write it down. That written record is often called a legitimate interest assessment. It does not have to be long. One page per type of campaign is enough for most small teams.
The three part test
The assessment has three questions. Answer all three for each kind of outreach you do.
- Purpose test. Is there a real, specific interest? "Offering our bookkeeping software to independent accountants" is specific. "Growing our business" is too vague to weigh.
- Necessity test. Is processing this data needed for that purpose, and is there a less intrusive way? You need a work address and a company name. You do not need a private phone number, a date of birth or a home address.
- Balancing test. Do the person's interests override yours? Ask whether they would reasonably expect this message. A purchasing manager at a wholesaler expects supplier offers. A nurse at a hospital does not expect a pitch at a work address she never published.
Things that tip the balance your way: the address was published for business contact, the offer relates to the person's job, you send few messages, and you make it easy to stop. Things that tip it the other way: large volumes, irrelevant offers, data from dubious sources and ignoring objections.
Companies, people and sole traders
The GDPR protects people, not companies. Data about a limited company as such is not personal data. But the moment an address points to a person, it is. anna.smith@company.com is personal data. info@company.com usually says less about a specific person, although it is still read by someone.
Sole traders and one person businesses are the tricky group. Their company name is often their own name, and their business address is often their home. For them, almost everything you store is personal data, and several national ePrivacy rules treat them like private individuals. Be more careful here: keep the message clearly about their business, send less, and check your national rules before you mail them at all.
Inform people at first contact
When you did not get the data from the person directly, Article 14 applies. You must tell them who you are, why you process their data, which basis you rely on, where the data came from, how long you keep it, and what their rights are. When you use the data to contact someone, this has to happen at the latest at that first contact.
In practice, a short paragraph in the footer of your first email works, with a link to your privacy notice for the full text. For example:
- "We found your company in the member list of [association] and write to you as a business contact, based on our legitimate interest in offering [service]. Not interested? Reply with stop or use the link below and we will not mail you again. Details and your rights: [privacy link]."
Keep that footer in every mail of the sequence, not only the first. It costs one line and answers most questions before they are asked.
Record the source and date of every record
If someone asks "where did you get my address?", you need an answer that is more than "a list". Article 15 gives people the right to know the source, and your own assessment depends on it too. The simple habit: store for every record where it came from and when.
A good source line names the actual place, like "exhibitor list Trade Fair 2026, page 3" or "association member directory, collected 12 March". A file name like export_final_v2.csv is not a source.
Handling opt-outs and objections
Under Article 21, a person can object to direct marketing at any time, and that right is absolute. You do not weigh it. You stop. That includes replies like "not interested", "remove me" or "please do not contact me again", even when they do not click the unsubscribe link.
- Put a working unsubscribe line in every mail.
- Process replies that ask you to stop by hand, the same day if you can.
- Keep an opt-out register. Do not delete the address completely, or it may come back in with the next import and get mailed again. Keep the minimum needed to block it.
- Check every new import against that register before you send.
How long to keep the data
The GDPR does not give a number. It says you keep data no longer than needed for the purpose. For cold outreach, a common approach is to set a fixed period for records that never responded, for example twelve months after the last contact, and then delete or archive them. Records that became customers fall under your normal customer administration.
Pick a period, write it in your privacy notice and your assessment, and actually apply it. A periodic clean-up is easier than explaining why you still hold five year old records of people you never spoke to.
How Riftjaw supports this
Riftjaw does not make you compliant on its own. You decide who to write to and what to say. What it does is keep the administration in one place, so the right steps are the easy ones. Two things happen without you having to remember them:
