GDPR and B2B cold email

The GDPR governs personal data. It asks whether you may hold someone’s details and use them for marketing.

The ePrivacy rules govern the message. They ask whether you may send an unsolicited email to that address at all.

You need an answer to both. Passing one does not excuse the other.

• GDPR: may I hold this row and use it for marketing?
• ePrivacy, as written into your country’s own law: may I send this email?
• The second question is where B2B and B2C part company.

The GDPR is a regulation. It reads the same in every EU and EEA country, Norway included.

ePrivacy is a directive. Each country wrote its own version of it, so the answer changes when you cross a border.

You do not need consent to hold a business contact row. You need a lawful basis, and consent is only one of the six in Article 6(1).

For cold outreach the basis is legitimate interests, at Article 6(1)(f). Recital 47 of the GDPR says direct marketing may count as a legitimate interest.

Note the word may. This is a test you have to pass, not a box you tick.

The three-part test

Regulators break it into three questions. Answer them in writing before the first send.

1. Purpose. What is the interest, and is it real? Selling a service a trade plainly uses is a real interest.
2. Necessity. Do you need this data to do it? If a smaller, tighter list would work, use the smaller list.
3. Balance. Do your interests override their rights? Ask what they would expect. A plumber expects trade mail at a published business address.

That document has a name. Regulators call it a legitimate interests assessment, and its whole value is that you did the thinking first.

It does not have to be long. One page, dated, kept where you can find it in a hurry.

What moves the balance

• For you: a published business address, and an offer that fits their trade.
• For you: modest volume, and a plain way to say no.
• Against you: a home address, or a named person’s private details.
• Against you: an offer with nothing to do with what they do.
• Against you: bulk sending, and data they would never expect you to hold.

Read that list as a design brief. A tight, relevant, low-volume campaign is not just better sales. It is the version that passes the test.

You got this data from somewhere other than the person. Article 14 of the GDPR covers exactly that case.

It says you must tell them who you are, why you hold their details, and where those details came from. The deadline is a month, or the first time you contact them, whichever comes first.

For a cold email, that means the first email. There is no later.

• Who you are, with a real name and a real address behind it.
• Why you are writing, in one plain line.
• Where you got their details. Say it. A public listing is a fine answer.
• How to stop it. One sentence, in the body, in the same voice as the rest.

Article 14(5) does list exemptions, including one for disproportionate effort. Do not lean on it for a marketing list. You are writing to the person anyway, so telling them costs you a line.

The right to object is absolute

Article 21(2) gives every person the right to object to direct marketing. There is no balancing test on that one.

Article 21(3) then says you stop. No appeal, no last email, no one more try in six months.

So the opt-out is not a courtesy. It is the thing that holds the whole basis up.

Article 13 of the ePrivacy Directive covers unsolicited email. The default is prior consent, with a soft opt-in for your own customers on similar products.

That default is written around natural persons. Article 13(5) then hands the rest to each country.

It tells member states to protect the interests of subscribers who are not natural persons, and leaves the method open. So the B2B answer is a national answer, every time.

The corporate and individual split

The clearest written example sits in the UK rules, PECR, because the regulator spelled it out.

There, the consent rule for marketing email bites on individual subscribers. Limited companies count as corporate subscribers, and so do limited liability partnerships. The rule does not reach them the same way.

The regulator treats sole traders and some partnerships as individual subscribers instead. So a plumber trading as a person gets consumer-grade cover. The same plumber trading through a company does not.

You still have to identify yourself and give a working address for opt-outs, whoever the subscriber is. And data protection law still applies wherever the row is personal data.

That split matters more in local than anywhere else. A file of trades is full of sole traders, and you cannot tell which is which from a map listing.

Is a business address personal data?

Sometimes yes, sometimes no, and you rarely know which from the row alone.

A named address at a company, like anders@firm.no, points at a person. It is personal data.

A role address like post@firm.no is weaker, and for a large company it may not identify anyone. For a one-van firm it is the owner’s inbox, and the distinction stops helping.

The safe working habit in local is to treat every row as personal data. You lose nothing by doing that, and the campaign you build is better anyway.

All four apply the GDPR. Norway is outside the EU but inside the EEA, so the regulation applies there too.

The electronic marketing rules are the part that differs, and they sit in national marketing law rather than in the GDPR.

• Norway: the Marketing Control Act, enforced by the Norwegian Consumer Authority.
• Sweden: the Marketing Act, which carries the electronic marketing rule.
• Denmark: the Marketing Practices Act, where that rule sits in section 10.
• Finland: the Act on Electronic Communications Services.

We are not going to state a national position here that we cannot pin to a primary source. Guides that do are the reason this topic is a mess.

What we will tell you is what to check, and it is the same list in each country.

1. Does the electronic marketing rule cover legal persons? Some national laws reach companies as well as people. That single answer changes your whole plan.
2. How does the law treat a sole trader? In several countries a one-person firm gets consumer-grade cover. Local files are full of them.
3. Is the B2B rule opt-in or opt-out? Opt-out means you may write once and must stop on request. Opt-in means you may not write first at all.
4. What must the message itself say? Sender identity and a working opt-out are close to universal. The wording rules are not.
5. Who enforces it, and what have they said lately? Consumer regulators and data protection regulators both have a say, and they publish guidance.

1. A legitimate interests assessment. One page, written before the first send, with a date on it. This is the document a regulator asks for first.
2. A source note on every row. Where it came from and when. You promised to tell people the source, so you have to know it.
3. A suppression list you never clear. Every opt-out, forever, across every campaign and every tool you use.

The suppression list trips people up, because deleting somebody sounds like the respectful move. It is the opposite.

Delete the row and your next import writes it straight back in. Then you email a person who told you to stop, which is the one mistake regulators care about.

So keep the least you need to keep them out. The address, the date they asked, and nothing else.

We hold a suppression list per account. Add a domain there and the app keeps it out of every export you pull after that, so the row cannot come back through us.

A ten-minute pre-flight

• Written assessment on file, dated before the send.
• Sender identity in the message, with a real address behind it.
• A line saying where you got their details.
• A plain opt-out sentence in the body of the email.
• A suppression list wired into the sending tool, not kept in a notebook.
• A cap on volume that matches a real sales team, not a machine.
• Advice taken for any market you plan to work at scale.