Is B2B Cold Email Legal Under GDPR? UK, EU and Germany

Your list has 300 founders on it. Two have a .de address, one is in Dublin, a handful are in London, and the tool that built the list has a "GDPR compliant" badge on its homepage. You have no idea what that badge means, and neither does the

Your list has 300 founders on it. Two have a .de address, one is in Dublin, a handful are in London, and the tool that built the list has a "GDPR compliant" badge on its homepage. You have no idea what that badge means, and neither does the person who designed it. So you search "B2B cold email GDPR" and get a wall of posts from lead-data vendors who need the answer to be yes.

The honest answer is three answers. The UK is permissive for B2B. The wider EU runs on legitimate interests, which is a test you have to pass and document. Germany starts from consent. Here is what each one says, checked against the regulators' and the statute's own text. This is not legal advice, and you should hire a lawyer before you scale into a country that scares you.

GDPR does not ban cold email, it regulates your list

Two different laws touch a cold email, and founders blur them. GDPR governs what you do with a person's data: finding it, storing it, emailing it. A separate set of email marketing rules governs the message itself. In the UK that is PECR. In the EU it is each country's version of the ePrivacy rules.

GDPR lets you process data for direct marketing under legitimate interests instead of consent. The ICO's guidance says direct marketing may be a legitimate interest under UK GDPR, and then attaches the test that most cold email tools skip. You identify your purpose, show the processing is necessary for it, and balance your interests against those of the person you are emailing. The same page warns that simply suggesting direct marketing is in people's interests is unlikely to move the balancing test much.

The UK lets you email companies, and only companies

For the UK, the ICO's B2B marketing guidance is short and useful. PECR's electronic mail rule does not apply to corporate subscribers, so a limited company, LLP, Scottish partnership or government body needs no prior consent. You still cannot hide who you are, and you still have to give a valid address for opting out.

Two catches. Sole traders and some partnerships count as individuals, and a solo founder running a one-person consultancy is often exactly that. And the address itself is personal data. The ICO says an address that identifies an individual means UK GDPR applies, even in a business context. So sarah@theircompany.co.uk is a company recipient for PECR and a person for GDPR at the same time. Both apply.

Objection is the rule that actually bites in practice

Most of the operational risk sits in one article. GDPR Article 21 gives a person the right to object at any time to their data being processed for direct marketing. Once they object, the data can no longer be processed for that purpose. It also says the right has to be brought to their attention clearly and separately from other information, at the latest at the first communication.

Translate that into a founder workflow. Your first cold email needs a plain line telling them how to stop the emails, and your tool needs a real suppression list. If someone replies "remove me", that is an objection, and the ICO calls the right absolute. It is also how a re-imported CSV becomes a complaint: the tool you switched to next quarter has never heard of the person who told you to stop in March.

A GDPR-compliant badge tells you what the vendor thinks about its own database. It says nothing about what you do with the export.

Germany starts from consent, even for business addresses

Here is where founders who read one UK-flavoured article get burned. Germany's unfair competition act, section 7, treats advertising by email without the addressee's prior express consent as an unreasonable nuisance. The single exception covers your own existing customers, under conditions: you got their address in connection with a sale, you use it for similar products of your own, they have not objected, and they were told they could object every time you collected or used the address.

That English translation is a courtesy copy, so have someone read the German original before you rely on it. What matters is the shape of the text: it does not separate B2B from B2C for email. Whether a specific German business address can be emailed on a legitimate-interest basis is a question for a German lawyer. It is not one to settle on a growth blog. Other member states implement the ePrivacy rules their own way, so a compliant UK sequence tells you nothing about Spain or France.

Writing the legitimate interests assessment takes one page

Founders treat the assessment like a legal ceremony. The ICO's three parts map onto three short paragraphs you can write in twenty minutes, and the ICO's guidance recommends a documented assessment as the way to show your work.

Purpose: say what you sell and to whom, in one sentence. "We sell inbox monitoring to SaaS founders" is a purpose. "Growth" is not. Necessity: say why email is a reasonable way to reach this person and whether a less intrusive route exists. If the honest answer is that you could have replied to their public post instead, write that down, and then use that route where it fits. Balancing: ask whether a recipient in that role would reasonably expect an email like this. A founder who listed a work address on a company site to receive business enquiries is one case. A private address scraped from a leaked database is another, and no template rescues that one.

The test also punishes a mismatch. If you target CFOs with an email about developer tooling, the necessity and balancing paragraphs get hard to write, and that difficulty is the signal. Relevance is the compliance control and the reply-rate control at once.

Your first email carries most of the compliance

Put the legal requirements where the recipient can see them, and they double as good copy. Say who you are and give a real company name and address. The ICO says you must not disguise or conceal your identity in electronic mail marketing and must provide a valid contact address for opting out. Add one plain sentence telling the recipient why you picked them, something specific like the role they hold or the thing they published. That supports your balancing paragraph and makes the email read like it came from a person, which it should.

Then add the opt-out in words, not in a grey footer link: reply "no" and you will not hear from us again. Article 21 requires the right to object to be presented clearly, and a sentence in the body does that better than eight-point type. Then honor it. A founder who logs the reply and keeps sending has turned a polite refusal into a documented breach.

The lower-risk version of this problem is a public reply

Every risk above comes from the same step: turning a person into an email address and writing to them unasked. Public communities skip that step. A founder posts in r/SaaS asking which tool handles X, and a useful, honest reply in the thread does not involve a scraped email, an enrichment vendor or a suppression list. That is my opinion, not a legal ruling, and the platform's rules and the GDPR treatment of scraped data still apply. The legal breakdown of scraping Reddit for leads covers where they bite.

It is also how Reddit lead generation works when timing matters: the buyer raised their hand publicly, and you answered where they asked. If you do move to email, the US-side rules are in our CAN-SPAM breakdown, and enrichment workflows is worth reading before you bolt a data vendor to your list. Volume makes every one of these risks bigger, which is one more reason volume outbound stopped working anyway.

● FAQ

Is B2B cold email legal under GDPR?

Often yes, but it is conditional. GDPR lets you rely on legitimate interests for direct marketing, and the ICO says direct marketing may qualify, but only after you pass a purpose, necessity and balancing test. The email rules that sit next to GDPR are a separate layer, and some countries require consent even for business addresses.

Do I need consent to cold email a company in the UK?

Not for a corporate subscriber. The ICO says you can email any corporate body, meaning a company, Scottish partnership, LLP or government body, and that PECR's electronic mail rule does not apply to them. Sole traders and some partnerships count as individuals, so they need consent or a prior purchase.

Is a work email address personal data?

If it identifies a person, yes. The ICO's B2B guidance says an address like a first name at a company identifies an individual, so UK GDPR applies even in a business context. A generic address like info@ is a different case, but most outbound targets a named person.

Can I cold email businesses in Germany?

Read section 7 of the German unfair competition act before you try. Its text bans email advertising without the addressee's prior express consent and lists one exception, for your own existing customers. The section carries no B2B carve-out for email, so German lists need a lawyer's opinion, not a legitimate-interest hunch.

What happens when someone tells me to stop emailing them?

You stop, permanently. GDPR Article 21 gives the recipient the right to object to direct marketing at any time, and once they do, you can no longer process their data for that purpose. Keep a suppression list so a re-imported CSV does not email them again.