What is gdpr for b2b?
GDPR for B2B refers to how the EU/UK data-protection regulation applies to business contact data — generally allowing outreach on a legitimate-interest basis with clear notice and an easy opt-out, while still treating a named person's work details as personal data.
GDPR doesn't ban B2B email, but it does shape it. The key point people miss is that a named individual's work email — jane.doe@acme.com — is still personal data under GDPR, even though it's a business address. So the regulation applies; the question is which lawful basis you rely on.
For most B2B outreach, that basis is legitimate interest rather than consent. You can process and contact business prospects where you have a genuine business reason, the contact would reasonably expect it, and you've weighed your interest against their privacy. In practice that means relevant, role-appropriate outreach to people for whom your product is plausibly useful — not blasting everyone.
Legitimate interest comes with obligations. You must provide clear notice of who you are and how you got their data, make opting out trivial, honour erasure and objection requests, and keep the data accurate and no longer than necessary. Suppression isn't a nicety here; it's a legal requirement, which is why a compliant dataset removes opted-out individuals everywhere.
National rules layer on top. The ePrivacy regime and country-specific e-marketing laws can impose stricter requirements for certain channels or recipients. The safe operating principle for cross-border sending is to meet the strictest rule that applies to each contact, document your legitimate-interest assessment, and make opt-out and erasure genuinely easy.
Frequently asked questions
Is a work email personal data under GDPR?
Yes, if it identifies a person (jane.doe@acme.com). Generic role addresses (info@acme.com) are less clearly personal. Because named work emails are personal data, GDPR applies — typically satisfied for B2B via a legitimate-interest basis.
Can I send cold B2B email in the EU under GDPR?
Generally yes, on a legitimate-interest basis: relevant, role-appropriate outreach with clear notice and an easy opt-out, plus respect for erasure and objection requests. National e-marketing rules can add stricter requirements, so meet the strictest rule that applies.