Is cold email legal under GDPR?

Does GDPR apply to a work email address

Yes, GDPR applies whenever an email address points to a named person, so an address built from someone's first and last name at their employer is personal data. A shared address such as a sales or info inbox usually is not.

Applying does not mean forbidding. GDPR asks you to have a lawful basis for using the data, to tell people what you are doing, to keep only what you need and to stop when someone objects. A cold email programme can meet all four.

Can you rely on legitimate interest for cold email

Yes, legitimate interest is the lawful basis most B2B senders use, provided they can show it passes a three-part test. GDPR itself names direct marketing as something that may be a legitimate interest, but the test is what makes it hold.

Write the test down before the campaign, in a short legitimate interests assessment. The deciding factor is usually relevance: an offer that clearly relates to the person's role is something they could reasonably expect, while a generic blast to anyone with a business address is much harder to defend.

• Purpose: what you want to achieve, such as offering a product that serves the person's job.
• Necessity: why email to this person is a proportionate way to do it.
• Balance: why their interests and expectations do not outweigh yours, and what you do to protect them.

What must every cold email include

Every cold email must say who is writing and give a working way to opt out. Under GDPR the right to object to direct marketing is absolute, so an opt-out has to stop all further marketing to that person, not just the current sequence.

You also have to tell people where their details came from. When you collect data from somewhere other than the person, GDPR expects that notice by the time of your first message at the latest, which is why many senders add one plain line and a link to their privacy notice.

• Your name, your company and a real reply address.
• One line on why you are writing to them in their role.
• Where their details came from, with a link to your privacy notice.
• A simple way to opt out, honoured promptly and recorded on a suppression list.

What does PECR say about B2B email in the UK

In the UK, PECR allows marketing email to corporate subscribers without prior consent, as long as you identify yourself and give a valid way to opt out. Corporate subscribers include companies, limited liability partnerships and government bodies.

Sole traders and some partnerships count as individual subscribers, and they need prior consent or the soft opt-in for an existing customer relationship. So the same email can be fine to a limited company's employee and not fine to a sole trader using their own address. UK GDPR still applies to the named person's data in both cases.

How does cold email compliance differ across the EU

Compliance differs across the EU because each country writes the e-marketing rules into its own law, while GDPR stays the same everywhere. The rule that matters is the one for the recipient's country, not yours.

Some countries allow B2B email without consent when the message relates to the person's job; France is often cited as an example. Others, such as Germany, generally expect prior consent for advertising email even between businesses. Before a campaign into a new country, check the local rule or ask counsel.

Who is responsible when a cold email breaks the rules

The company that decides to send is responsible, whichever tool supplied the address or wrote the draft. It chose the lawful basis, the audience and the message, so it answers for all three.

That is why the checks belong in your own process: a written assessment, a suppression list everyone uses, a privacy notice that names your data sources in general terms and a review of each segment before a send.