GDPR Legal Basis for B2B Prospecting in 2026: GDPR-Compliant Outreach for B2B Marketers

Yes, you can contact B2B prospects in the EU without their consent. The GDPR lets you rely on legitimate interest when you have a real business reason, the person holds a relevant role, and you offer an easy way to unsubscribe from the first message.

The catch sits in the details.

1. The GDPR governs how you collect and store B2B data.
2. A separate law, the ePrivacy Directive, governs the cold email itself, and each EU country applies it differently. The DACH region is the strictest.

This guide shows B2B marketers, SDRs, and every sales team what a defensible outbound workflow looks like today.

GDPR Compliant Sales Teams: Key Takeaways

• GDPR applies fully to B2B. A work email like jane.doe@company.com is personal data. The regulation protects people, not companies.
• Legitimate interest is the usual legal basis for outreach. Document a Legitimate Interest Assessment (LIA) before the first send.
• Country rules change the answer. France and the UK allow B2B email to company addresses. Germany and Austria require prior consent.
• Your first message must name your data source. Article 14 of the GDPR sets this deadline at the time of first contact.
• “Stop” is permanent. The right to object to direct marketing is absolute. Add the contact to a suppression list the same day.

Does GDPR Apply to B2B Prospecting?

Yes, fully. GDPR compliance is not a consumer-only issue. The moment your prospect list names an individual, you are processing personal data under GDPR. That holds whether the person is a shopper or a VP of Procurement.

Personal data is any information that identifies a living person, directly or indirectly (Article 4(1)). In B2B prospecting, that covers more than most teams expect. A name plus a job title at a 20-person company identifies someone as clearly as a home address.

Data point	Covered by GDPR?	Why
jane.doe@company.com (business email address)	Yes	Names a specific person
info@company.com, sales@company.com	Usually no	Generic role inbox
Direct dial or mobile number	Yes	Reaches one identifiable person
Company switchboard number	No	Reaches the organization
Name + job title + employer	Yes	Identifies the individual
Company size, industry, revenue	No	Describes the organization
LinkedIn profile URL	Yes	Links to one person

The practical rule is simple. If a data point allows you to reach or identify one human, treat it as protected. That includes enriched contact data, verified work email addresses, and the notes your SDR adds to the CRM after a call.

Are Small Businesses Exempt from GDPR?

No. GDPR has no size exemption for B2B companies. A five-person SaaS company emailing German CFOs carries the same core obligations for the personal data involved as a large enterprise. The only relief is narrow: organizations with fewer than 250 employees may skip the formal record-keeping requirements under Article 30(5), unless processing is regular or risky. Prospecting is regular by nature, so most B2B teams should keep the record anyway.

What Are the 7 GDPR Requirements?

The “7 requirements” are the seven principles in Article 5. Here is what each one means for prospecting:

1. Lawfulness, fairness, and transparency. Have a valid ground and tell prospects where their data came from.
2. Purpose limitation. Use the data for the reason you collected it. Recruiting data is not automatically sales data.
3. Data minimization. Collect only what you need. Name, role, company, and work email usually suffice. Skip birthdays and home addresses.
4. Accuracy. Verify emails and phone numbers before you send. Stale records hurt data quality and deliverability.
5. Storage limitation. Delete prospects who have not engaged after a set period.
6. Integrity and confidentiality. Protect your records with access controls.
7. Accountability. Be able to prove all of the above. Your LIA is the core evidence.

Legal Bases for B2B Prospecting: Consent vs Legitimate Interest

GDPR lists six legal grounds for processing personal data. Two matters for outreach: 1) consent and 2) legitimate interest.

1. Consent must be freely given, specific, informed, and recorded before you process anything. You cannot get consent from someone you have never contacted.
2. That is why the legitimate interest basis is the default for most outbound teams in Europe.

	Consent	Legitimate interest (LI)
When it fits	Newsletters, inbound leads, DACH email	Cold email and calls to relevant roles in most of the EU and UK
What you need	A recorded opt-in before contact	A documented LIA and an unsubscribe link in every message
Can the prospect withdraw?	Yes, at any time	Yes, via the absolute right to object
Main risk	Hard to get before first contact	Weak or missing balancing test

“The question we hear most is whether SDRs need permission before the first email,” says Mary Tan, Head of Sales at SignalHire. “In most of Europe, the answer is no, but only if the team can show why that person, why that message, and why now. Relevance is the legal basis.”

The courts back this up. On 4 October 2024, the Court of Justice of the EU ruled in case C-621/22 (KNLTB) that a purely commercial business interest can be legitimate. Recital 47 of the GDPR already states that direct marketing “may be regarded as carried out for a legitimate interest.”

What “Legitimate Interest” Means

Legitimate interest means your business has a genuine reason to process someone’s data, and that reason is not outweighed by their privacy rights. The UK regulator, the ICO, uses a three-part test. The EDPB Guidelines 1/2024 on legitimate interest use the same structure:

1. Purpose test. Is your aim legitimate? Selling a relevant product to a business counts.
2. Necessity test. Is contacting this specific person necessary? Emailing the IT director about security software passes. Emailing the whole company does not.
3. Balancing test. Would the person reasonably expect a message like yours, given their role and where you found their data?

An LIA is a short document, often one or two pages, that records your answers. The ICO publishes a free LIA template and detailed legitimate interests guidance. Complete it before the campaign starts, not after a complaint arrives. The same logic covers showing relevant ads to business contacts on professional networks.

When You Need Prior Consent

Legitimate interest does not cover everything. Get prior consent, or do not contact the person, in these cases:

• The national email law requires it. Germany and Austria require consent for advertising email, including B2B.
• The prospect is a sole trader or freelancer. The UK and several EU states treat them as individuals.
• You use automated calls or SMS. These need an opt-in almost everywhere in the EU.
• The data is sensitive. Health, religion or union membership fall under Article 9. Never use them for prospecting.
• The person already objected. A past unsubscribe overrides any new campaign.

What Your First Outreach Message Must Include (Article 14)

When data is collected from anyone other than the prospect, Article 14 applies. You must inform the person at the latest at your first contact. For B2B cold outreach, that means your first email or call must cover:

• Who you are. Your name and company.
• Why are you contacting them? The purpose and your business interest.
• Where did you get their data? Name the data source, for example, “a B2B contact database.”
• How to opt out. An unsubscribe link or a “reply stop” line.
• Where to learn more. A link to your privacy policy covering retention and rights.

Example: an SDR emails a Head of Procurement about supply chain software. The email says where the data came from, links to the privacy notice, and ends with an unsubscribe link. The whole notice takes two lines at the bottom.

When a Prospect Asks “How Did You Get My Details?”

Treat it as a right-of-access request under Article 15. Reply with where you found them, the data you hold, and why you hold it. You have one month to respond. A fast, honest answer turns a compliance risk into a credibility moment. Log the request.

GDPR-Compliant Outreach by Channel: Email, Phone, and LinkedIn

The GDPR sets one standard for your data. Channel rules come from the ePrivacy Directive. Article 13 leaves B2B email largely to the discretion of each member state. That is why the same sequence can be legal in Paris and unlawful in Munich.

Channel	Usual basis	Consent needed?	Key rule
Cold email to a work address	LI	Depends on country (no in FR and UK corporate; yes in DE and AT)	Relevant role, unsubscribe link in every email
Live call to a direct dial	LI	Usually no; presumed consent in DE	Check national do-not-call registers
Automated call or SMS	Consent	Yes	Prior opt-in required
LinkedIn message	LI	No, but platform terms apply	No scraping, no bulk automation

Cold Email to Work Addresses

France’s regulator, the CNIL, allows B2B email without consent when the message relates to the recipient’s job. Every email must offer a simple way to refuse. Its guidance on email prospecting gives the example of presenting software to an IT director.

The UK follows a similar model. Under PECR, you can email “corporate subscribers” such as limited companies without consent. Sole traders and some partnerships count as individuals. The ICO explains the split in its business-to-business marketing guidance.

Cold Calls to Direct Dials

Live B2B calls usually need no consent. Check national do-not-call registers first, such as the UK Corporate Telephone Preference Service. The ICO covers this in its guidance on live direct marketing calls.

LinkedIn Outreach and Sales Navigator

LinkedIn messages to decision-makers generally do not require consent. The message stays on a platform built for professional contact. Using Sales Navigator for DACH prospecting also works, as long as you message inside the platform. Two limits apply. The LinkedIn User Agreement prohibits scraping and unauthorized automation. And once you copy profile data into your own system, you own it under GDPR, including the Article 14 notice.

What about enrichment? Using a tool to find a prospect’s email or phone number from their profile is common. The enrichment itself can rest on the same basis. But the new email then falls under that country’s email rules. In Germany, a found email still needs consent before a sales pitch.

Cross-Border B2B Prospecting: UK, DACH and the US

Cross-border prospecting is where most GDPR risk hides. One sequence can touch five legal regimes. Use this table to split your list before you send.

Market	B2B email	Key law
France	Allowed if relevant to the role	CNIL guidance, LCEN
UK	Allowed to corporate subscribers	UK GDPR, PECR, DUAA 2025
Germany	Prior consent required	Section 7 UWG
Austria	Prior consent required	Section 174 TKG 2021
Switzerland	Consent for mass email, with existing customer exception	Swiss UWG, revised FADP
US	Allowed with opt-out	CAN-SPAM

How DACH Prospecting Differs

The DACH region is the hardest market for B2B cold outreach in Europe. Germany’s Unfair Competition Act requires prior consent for advertising emails, even to businesses. The main enforcement risk is not always a regulator. Competitors and consumer associations can send a formal warning letter (Abmahnung) with legal costs attached. Austria’s Telecommunications Act sets a similar consent rule for email.

Switzerland is not in the EU, but its revised Federal Act on Data Protection has been applied since September 2023. It’s unfair competition law requires consent for mass advertising emails. The biggest mistake SDRs make in Switzerland is treating it like the UK.

So, how do you keep DACH outreach compliant this year? Lead with channels that need no prior consent. Use LinkedIn messages and live calls to earn a first reply. Then ask for permission to send an email. Keep follow-ups few and relevant. No law sets a number, but in Germany, any unsolicited sales email is already one too many. A German-language domain is not a legal requirement, but a local email address can improve trust.

Is It Different for UK Prospects?

Slightly. The UK has its own UK GDPR and PECR, which mirror EU rules. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It names direct marketing as an example of a legitimate interest. Many of its provisions took effect on 5 February 2026. You still need an LIA.

Does GDPR Apply to US Companies?

Yes, if you contact people in the EU. Article 3(2) extends GDPR to companies outside the EU that offer goods or services to people in the EU. A US SaaS company emailing French CFOs must comply with the GDPR for those contacts. The same applies to companies in India, China, or anywhere else. Non-EU companies that process European data regularly may also need an EU representative under Article 27.

Has the GDPR Legal Basis for B2B Prospecting Changed?

The core rules have not changed since 2018, but the details have moved. The KNLTB ruling confirmed commercial interests in 2024. The UK DUAA took effect in 2026. In the EU, the Commission proposed a “Digital Omnibus” in November 2025 that would amend parts of GDPR. It is still under negotiation, and the EDPB has raised concerns about narrowing the definition of personal data. Until it passes, plan your GDPR compliance for 2026 based on the current text.

When a Prospect Says “Stop”

When a prospect says stop, you stop everywhere and permanently. The right to object under GDPR Article 21 is absolute in the case of direct marketing. Article 21(3) allows no balancing test and no exception for “just one more follow-up.”

A suppression list keeps opted-out contacts from appearing in every sequence. Store only what’s needed to recognize the person, usually the email or its hash. Do not delete them entirely, or they may return with the next import.

Request	Deadline	What to do
Unsubscribe or “stop” reply (EU/UK)	Without undue delay	Add to suppression list, end the sequence
Unsubscribe under CAN-SPAM (US)	10 business days	Honor it, per the FTC CAN-SPAM guide
Right to access or erasure (GDPR)	One month	Provide or delete the data, keep the suppression entry
Complaint to a regulator	Varies	Share your LIA and records

How Long Can You Keep Data on Prospects Who Never Reply?

GDPR sets no fixed number. The storage limitation principle says you keep data only as long as the purpose needs it. Pick a period, write it in your LIA, and enforce it automatically. Many teams set a 6- to 12-month window for non-responders, then delete or re-verify. Whatever you choose, apply it to every contact, not just the ones someone remembers.

Penalties and Common GDPR Violations in B2B Prospecting

Most headline GDPR fines hit large platforms, not SDR teams. But the maximum fine under Article 83 is €20 million or 4% of global annual turnover, whichever is higher. Any data protection authority can open a case after one complaint.

For most sales and marketing teams, the real cost is not the penalty. It is the cleanup: frozen campaigns, legal team hours, and a damaged sender domain. These are the most common violations:

• No LIA on file. You cannot prove the balancing test after the fact.
• No source disclosure. The first email hides the source of the contact data.
• Ignoring objections. A contact who opted out gets re-imported and emailed again.
• Emailing DACH without consent. A French playbook applied to German prospects.
• High-volume blasts to whole domains. Emailing every employee fails the necessity test.
• Scraped or unverified lists. Bought lists with no clear origin are hard to defend.

How to Choose a GDPR-Compliant B2B Data Source

What does compliance mean for a data provider? It means the vendor has a lawful basis for its data processing, informs people that their data is held, and honors opt-outs. It does not transfer your obligations. Your own basis for each email stays with you.

Whether you use SignalHire, Cognism, or another data vendor, ask these questions before you buy:

• Where is the sourced data from? Public professional data sources are easier to defend than opaque lists.
• How do people opt out? Look for a public removal form and a right-of-access process.
• Is there a data processing agreement? You will need one.
• What security standards apply? Ask whether the vendor holds SOC 2 certification or ISO 27001.
• How often is data verified? Fresh data protects both compliance and pipeline.

Price varies widely, from pay-per-contact credits to annual enterprise contracts. Compare cost per verified contact, not list size.

Does Your Company Need a Data Protection Officer?

Not always. Article 37 requires a data protection officer when core activities involve large-scale, regular monitoring of people. Using a B2B enrichment tool alone rarely triggers this. Germany is stricter: its Federal Data Protection Act requires a DPO when 20 or more people regularly handle such data by automated means.

Can a DPO Block a Sales Tool?

Formally, a DPO advises and does not hold a veto. In practice, leadership rarely overrules a documented DPO objection, because it creates evidence against the company. Bring your DPO in early. Share the vendor’s GDPR documentation and your draft LIA before signing.

Find Contacts with SignalHire the GDPR-Friendly Way

GDPR for B2B prospecting starts with the data source. SignalHire compiles business contact details from public professional sources and stores them in its database of 900M+ profiles. It honors access, rectification, erasure, and removal requests, as set out on its GDPR page. Anyone can remove their profile through the opt-out form.

That covers where the data comes from. The reason to contact each prospect still belongs to your team. A few habits keep your B2B outreach compliant:

• Search by job title and company, so every contact has a clear business reason. The email finder and browser extension support role-based search.
• Store the data source field in your CRM for the Article 14 notice.
• Sync your suppression list before every import.
• Send from a tool that adds an unsubscribe link by default, such as SignalHire Email Sequences.

If you collect emails from websites yourself, the same rules apply. Read our guide to email scraping, how it works and whether it’s legal. Then verify addresses before sending, since bounces hurt deliverability.

GDPR Compliance Checklist for B2B Marketers in 2026

Run three questions for every prospect list. If you cannot answer yes to all three, do not contact that person.

Do you have a real business reason? Name the product, the problem, and why this company needs it. “We sell workflow software to finance teams” is a reason. “They were on a list we bought” is not.

Would they expect a message like yours? A CFO expects vendor emails about finance tools. A hospital nurse does not expect sales pitches about marketing software.

Is this person relevant to what you sell? Target decision-makers, not everyone at the company. A 50-person list of the right roles is safer, and converts better, than 5,000 names pulled by domain.

Before every campaign, confirm:

• LIA documented and dated
• Data source recorded for each contact
• Privacy notice linked in the first email
• Unsubscribe link or “reply stop” line in every email
• Suppression list synced before import
• DACH, sole-trader and sensitive-data contacts excluded or handled by consent
• Retention period set and automated
• Annual audit of your data provider on the calendar

This article is general information, not legal advice. For decisions about your own campaigns, check with your data protection officer or legal counsel.