GDPR and Cold Email in 2026: What B2B Senders Actually Have to Do

Two Laws, Not One

GDPR governs personal data, and a named person's work email address is personal data. The ePrivacy Directive, implemented as national law in each member state, governs unsolicited electronic marketing specifically. Most of the confusion about cold email comes from reading only the first. GDPR gives you legitimate interest as a lawful basis; the national ePrivacy rules decide whether that is enough for email, and the answer ranges from "yes, for business recipients" (the Netherlands, Ireland, France for professional addresses) to "no, consent" (Germany's UWG, Austria's TKG, which treat B2B email marketing as requiring prior consent with narrow exceptions). The UK guide covers PECR, which sits on the permissive side for corporate subscribers and the strict side for sole traders and partnerships.

What Legitimate Interest Requires in Practice

• •A written assessment. Purpose: you sell something relevant to this role at this kind of company. Necessity: email is the proportionate way to reach them and you are not writing to anyone it does not concern. Balance: the message is relevant, limited to a short sequence, easy to stop, and would not surprise a reasonable person in that role. Twenty minutes, one document per campaign type, dated.
• •Relevance you can defend. Legitimate interest covers a message about outbound infrastructure to a head of sales. It does not cover the same message to the finance team because they were in the export.
• •Work addresses, named roles. [email protected] for a person in a relevant role, at a company, not a personal Gmail, not a sole trader's address in a country that treats them as consumers.
• •A short sequence. Three or four messages, then stop. Twelve-step sequences fail the balancing test on their own.

Transparency: What the First Email Has to Say

Article 14 obliges you to tell people whose data you obtained elsewhere what you hold, where it came from, why, and what they can do about it, at first contact. The whole of that fits in a footer, and it has the side effect of making the message read as honest, which helps replies.

You're receiving this because I found your details on {{source}} and thought it was relevant to your role at {{company}}. I'll send at most two more messages. Reply "no" or use this link to stop: {{unsubscribe_link}}. How we handle your data: {{privacy_url}}.

Huz · WarmInboxes · {{postal_address}}

The source is a real one: the company website, a named data provider, LinkedIn. The privacy URL is a real page that says what you hold, the lawful basis, retention, and how to exercise rights. The postal address is not required by GDPR but is by CAN-SPAM, and most campaigns cross the Atlantic somewhere in the list; the CAN-SPAM address article covers that side.

The Right to Object, Honoured Everywhere

An objection to direct marketing is absolute under Article 21: you stop, you do not argue, and you do not email them again from a different domain, a different tool or a different client's campaign. That last part is the one that fails in practice, because opt-outs live in one sequencer and the next campaign runs in another. One global suppression list across every domain, inbox and tool, checked before every send, is how the right is honoured; the suppression list guide builds it and the suppression checker tests a list against it. The unsubscribe generator produces the one-click headers that Google and Yahoo now expect on marketing mail, which satisfies the "as easy as it was to send" standard without a reply.

Data Minimisation and Retention

• •Hold name, role, company, work email, and the signal that made them relevant. Not their personal phone, not their home city, not a 40-column enrichment export "in case".
• •Delete contacts who did not respond after the sequence ends plus a defined period, 6 to 12 months is a common choice, and write the period down.
• •Keep opt-outs indefinitely, as a hashed suppression record, because the obligation to not contact them does not expire.
• •Know which processors hold the data: the sequencer, the enrichment tool, the CRM, the verifier. Each needs a data processing agreement, and each is where a subject access request has to be answered from.

Where B2B Cold Email Is Not Enough

• •Germany and Austria: prior consent for email marketing, business recipients included, with a narrow existing-customer exception. Cold email there is a legal risk, not a compliance detail; many operators exclude both from EU campaigns.
• •Sole traders and partnerships: treated as individuals in several states and in the UK. Filter by company type before sending.
• •Personal addresses: gmail.com and the like are consumers. Consent, or do not send.
• •Health, finance, public sector: sector rules stack on top. A campaign into hospitals is a different document.

The Working Checklist

• •Legitimate interest assessment written and dated for this campaign type.
• •List limited to named business roles at companies, work addresses only, Germany and Austria and sole traders filtered as policy decides.
• •First email names the source, the purpose, the sequence length, the opt-out and the privacy notice.
• •One-click unsubscribe headers on, and a reply "no" treated the same way.
• •Global suppression list shared across every tool, checked before every send.
• •Retention period defined; non-responders purged on schedule; processors under agreement.

None of this touches the infrastructure. A compliant campaign still needs trusted domains, authentication and a pace that lasts, which is the half we build; the infrastructure guide is that half, and the marketing guide puts both halves in one place.