In short: Legitimate interest is often the most practical GDPR lawful basis for relevant B2B prospecting in the EU, but it isn’t automatic.
You need a documented balancing test, a clear business purpose, minimal personal data, transparent outreach, and a simple right to object.
B2B intent data and buying signals support relevance; they don’t prove consent or create permission to contact anyone.
The ePrivacy Directive and local marketing rules may add separate requirements for email, calls, and LinkedIn automation.
- Define the business purpose before collecting prospect data.
- Separate company-level buying signals from personal data.
- Document the legitimate interest assessment before outreach.
- Use only the enrichment fields your SDR workflow needs.
- Sync opt-outs, suppression lists, retention rules, and audit records across the CRM and sequencer.
Cold lists create a legal and commercial problem at the same time: they contain too much data, too little context, and weak evidence that outreach is relevant. A better approach uses public B2B buying signals, applies a specific lawful basis to the personal data involved, and gives each prospect a clear way to object.
Legitimate interest is usually the starting point, not a blanket permission
The GDPR doesn’t ban B2B prospecting. It requires you to justify the processing of personal data and respect the individual’s rights.
For many B2B sales teams, legitimate interest under Article 6(1)(f) is the most workable lawful basis for prospecting. The interest might be developing relevant business relationships, offering a service to a professional audience, or identifying companies that could benefit from a specific solution.
That basis only works after a three-part assessment:
- You identify a genuine and specific legitimate interest.
- You show that processing is necessary for that purpose.
- You balance the business interest against the prospect’s rights, expectations, and privacy impact.
The European Data Protection Board’s guidance on legitimate interest explains this assessment in practical terms. The assessment should exist before the campaign starts, not after a complaint.
A generic statement such as “sales prospecting is a legitimate interest” isn’t enough. The assessment should describe the target audience, the data sources, the outreach channel, the expected relevance, and the safeguards.
For example, a company hiring five sales engineers may indicate a change in its go-to-market capacity. That is a useful company-level buying signal for a sales intelligence workflow. It doesn’t automatically justify emailing an individual employee whose name appears on a public profile.
The signal helps explain why the account may be relevant. The lawful basis applies to the processing of identifiable personal data and the outreach activity.
The European Commission’s overview of GDPR principles and legal bases is a useful reference when documenting this distinction.
When legitimate interest becomes harder to defend
Legitimate interest gets weaker when the prospect has no reasonable expectation of contact, the message is unrelated to their role, or the data was collected through intrusive methods.
Risk increases when teams:
- Buy broad databases with unclear data provenance.
- Enrich every account with unnecessary personal details.
- Use personal emails or private contact information.
- Send high-volume messages with no business relevance.
- Continue contacting people after an objection.
- Rely on scraping that violates a platform’s terms of service.
A public profile is not a free pass. Public availability affects transparency and expectation, but it doesn’t remove GDPR obligations.
Consent is not always required, but email rules still matter
Many operators confuse two separate questions:
- Does GDPR allow you to process the prospect’s personal data?
- Does the applicable electronic marketing law allow you to send the message through a particular channel?
GDPR answers the first question. The ePrivacy Directive and national implementations often affect the second.
This distinction matters because an organisation may have a GDPR lawful basis for processing professional contact data but still face restrictions on unsolicited email, SMS, or automated calls. Rules differ across EU member states and depend on the recipient, channel, message type, and whether the address is corporate or personal.
The “soft opt-in” or existing-customer exception also has specific conditions. It isn’t a general exception for any B2B contact found online.
Consent remains the clearest option when the campaign requires it. Valid consent must be:
- Freely given.
- Specific and informed.
- Unambiguous.
- Easy to withdraw.
Don’t collect consent for one purpose and reuse it for unrelated outbound sales. Don’t treat a newsletter subscription, event registration, or LinkedIn engagement as consent to receive cold outreach unless the consent language clearly covers that use.
A LinkedIn reaction, comment, or profile view can be a useful buying intent signal. It is not consent. The same applies to a job posting, a new hire, funding announcement, or product launch.
The CNIL guidance on commercial prospecting provides a useful EU compliance reference, although local rules still need review for each market.
| Lawful basis | Typical B2B prospecting use | Main limitation |
|---|---|---|
| Legitimate interest | Relevant outbound based on business context and role | Requires a balancing test and right to object |
| Consent | Subscriptions, gated communications, explicit marketing opt-ins | Must be specific, recorded, and easy to withdraw |
| Contract | Contact needed to perform or prepare a contract | Rarely covers unsolicited prospecting |
| Legal obligation | Processing required by law | Doesn’t generally justify sales outreach |
| Vital interests or public task | Specific public-interest or emergency situations | Usually irrelevant to commercial prospecting |
Contract is often misused in sales operations. A prospect’s potential fit for your product does not mean a contract is “necessary” for processing their data.
B2B intent data improves relevance without proving permission
Strong outbound sales signals reduce unnecessary outreach. They don’t replace legal analysis.
Useful signals can include:
- Hiring signals from relevant job postings.
- A leadership change at a target account.
- Expansion into a new market.
- A public product launch.
- LinkedIn engagement with a topic related to your offer.
- A new technology implementation.
- A request for recommendations in a public business community.
These signals are most defensible when you record what happened, where it happened, and when it happened. Keep observable facts separate from your sales interpretation.
For example:
- Fact: The company published a job posting for a head of revenue operations on 12 March.
- Interpretation: The company may be investing in its sales process.
- Action: Review the account and identify a relevant professional contact.
- Limitation: The signal doesn’t prove a purchase decision or individual consent.
That discipline improves both compliance and reply quality. Sales intelligence should help an SDR decide whether outreach is timely and relevant, not encourage the team to contact every person connected to an account.
A practical workflow looks like this:
- Define the ICP and the business event that matters.
- Capture the source, timestamp, and original wording of the signal.
- Score the account for fit, recency, relevance, and confidence.
- Enrich only the contact fields needed for routing and personalisation.
- Run a human review before adding the contact to a sales sequencer.
- Check suppression lists and send a transparent, role-relevant message.
- Record objections and propagate them across every outbound channel.
A signal layer can sit above an existing CRM, sales sequencer, and API integrations. It can tell the team who to review and when, without becoming another system that sends messages or replaces the outbound stack.
This is where privacy by design becomes operational. A compliant B2B sales intelligence platform should minimise collection at the point of capture, preserve data provenance, restrict access, and avoid third-party cookies or questionable scraping.
The ICO’s guidance on data minimisation is outside the EU regulatory system but offers a clear explanation of the principle. EU teams should apply the same concept alongside their own supervisory authority’s guidance.
For a deeper operating checklist, see GDPR-compliant prospecting strategies. It covers source records, human review, enrichment limits, retention, and synchronized opt-outs.
Safeguards that make legitimate-interest prospecting defensible
A lawful basis is only one part of compliant outbound. Your process needs controls that limit both privacy risk and operational waste.
1. Write a specific purpose
“Generate leads” is too broad. State the purpose in business terms, such as assessing whether a company showing a relevant hiring signal may need a defined service.
Purpose limitation prevents teams from collecting data for one reason and repurposing it later without review.
2. Keep company data and personal data separate
A company’s job posting is not the same as an employee’s contact record. A public company signal can justify account research. It does not automatically justify personal enrichment.
Use account-level signals first. Add an individual contact only when their professional role is relevant to the stated purpose.
3. Apply data minimization
Most outbound workflows don’t need a full social profile, personal phone number, private email address, or detailed employment history.
A minimal record might contain:
- Name and professional role.
- Business email address, where appropriate.
- Company and country.
- Source and timestamp.
- Signal type and business context.
- Lawful-basis record.
- Opt-out status.
Do not collect information merely because an enrichment vendor makes it available.
4. Provide transparency
Your privacy notice should explain the categories of data, sources, purposes, lawful basis, retention period, recipients, and the prospect’s rights. Article 14 may apply when personal data comes from a source other than the individual.
If you cannot explain the source and purpose clearly, you probably shouldn’t use the record.
5. Make objections immediate
People have an absolute right to object to direct marketing. When someone objects, stop the relevant marketing and add the necessary suppression record so they aren’t re-added through another vendor or workflow.
Opt-out management must cover the CRM, sales sequencer, LinkedIn automation, agency workflows, and any API integrations. A suppression list is personal data too, so protect it and retain only what you need to honour the objection.
A compliant outbound system must remember objections better than it remembers leads.
6. Set retention limits
Intent data decays quickly. A job posting from six months ago may no longer support a relevant outreach message.
Set retention periods for raw signals, enriched contacts, campaign records, and suppression data. Review stale records instead of allowing them to remain active indefinitely.
What RevOps should document before launching a campaign
RevOps teams, founders, SDR managers, and lead generation agencies should treat compliance as a workflow design requirement.
Before launch, confirm the following:
- The target audience has a defined professional and business context.
- The legitimate interest assessment is written and approved.
- The source and timestamp of each signal are recorded.
- Data provenance is available for every enriched field.
- The privacy notice covers the processing activity.
- The data controller and any data processor are identified.
- Vendor contracts include a suitable data processing agreement where required.
- Retention and deletion rules are configured.
- Suppression lists are shared across channels.
- Human review happens before outreach.
- The message includes a clear, simple right to object.
- Country-specific email and calling rules have been checked.
A Data Protection Impact Assessment may be appropriate when processing is large-scale, systematic, intrusive, or likely to create a high risk to individuals. It isn’t a badge that makes a campaign lawful. It is a structured way to identify and reduce risk.
The data controller decides why and how the prospect data is processed. A data processor acts on the controller’s instructions. A prospecting vendor may be a processor for some activities, an independent controller for others, or part of a more complex arrangement. The contract must reflect the actual roles.
LinkedIn engagement requires another layer of care. Teams should respect LinkedIn’s terms and avoid prohibited scraping or automation. Public data can still be personal data, and platform compliance is separate from GDPR compliance.
For more detail on this channel, read how to prospect on LinkedIn without violating GDPR. Use the correct URL in production: how to prospect on LinkedIn without violating GDPR.
FAQ: GDPR lawful basis for B2B prospecting
Can we use legitimate interest for cold email in the EU?
Often, but not automatically. You need a documented legitimate interest assessment, relevant and proportionate processing, transparency, and a clear right to object. The ePrivacy Directive and national laws may impose additional restrictions on unsolicited electronic marketing.
Does a public job posting mean the company has buying intent?
No. A job posting is a business signal that may indicate a priority, capability gap, or expansion. It doesn’t prove a purchase decision, and it doesn’t provide consent to contact an employee.
Is a professional email address personal data under GDPR?
Usually, yes, if it identifies or can identify an individual. A generic address such as info@company.eu may be treated differently, but the exact context matters. Apply data minimization and document your reasoning.
Does LinkedIn engagement count as consent?
No. A comment, reaction, profile view, or connection does not automatically authorise marketing contact. It may contribute to a relevance assessment, but teams still need a lawful basis and must follow platform rules.
What should happen after a prospect objects?
Stop direct marketing to that person and record the objection in a protected suppression list. Synchronise the suppression status across the CRM, sales sequencer, enrichment tools, LinkedIn workflows, and agency systems.
Do we need a Data Protection Impact Assessment for every outbound campaign?
No. A DPIA is required when processing is likely to result in a high risk to individuals. Even where one isn’t mandatory, a documented risk assessment, legitimate interest assessment, source register, and retention policy are still useful controls.
Build outbound around relevance, evidence, and control
Legitimate interest can support GDPR-compliant B2B prospecting when the outreach is expected, relevant, proportionate, and easy to refuse. B2B intent data, hiring signals, LinkedIn engagement, and other public trigger events improve timing, but they never replace consent analysis, transparency, or the right to object.
The practical standard is simple: collect less, record where it came from, contact fewer people with a stronger reason, and make every opt-out permanent across the stack.
📘 Pour une vue complète du sujet : Stratégies de prospection conformes au RGPD
