Is B2B data GDPR compliant? Legitimate interest, notices and opt-outs

B2B data can be GDPR compliant, but the data never is on its own: compliance depends on how you collect and use it. A work email like dana.whitfield@northwindfab.com identifies a person, so it is personal data under the General Data Protection Regulation (GDPR), and prospecting that person needs a lawful basis, a privacy notice and an opt-out you honor.

Is B2B data GDPR compliant?

B2B contact data is GDPR compliant when you process it lawfully: with a lawful basis (usually legitimate interest), a privacy notice the person actually receives, and an objection process you honor. The GDPR has no exemption for business contacts, so a named person’s work email, direct dial or mobile number is protected like any other personal data.

No vendor can make your outreach compliant for you. The GDPR makes the company that decides why and how the data is used, the controller, responsible for proving compliance (Article 5(2), “accountability”). A good vendor makes that easier with documented sources, a Data Processing Agreement and an opt-out process; your team still owns the notice, the objection log and the records.

When is B2B contact data personal data?

Business contact data is personal data whenever it identifies a person, directly or indirectly. Article 4(1) of the GDPR covers “any information relating to an identified or identifiable natural person”, and a job title does not change that.

The UK regulator, the Information Commissioner’s Office (ICO), gives the practical line in its business-to-business marketing guidance:

• Personal data: a business contact’s name and number on file, or an email that identifies someone, such as initials.lastname@company.com.
• Not personal data: post addressed to “the IT department” or an email to info@company.com, when you do not know who reads it.
• Still personal data: a name and title published on a company website. The ICO says you “cannot assume” public data means the person agrees to direct marketing.

The GDPR also reaches sellers outside Europe. Article 3(2) applies it to companies with no EU establishment when their processing relates to offering goods or services to people in the EU. A US team prospecting buyers in the EU should plan on it applying.

Legitimate interest and the three-part test for B2B

Legitimate interest (Article 6(1)(f)) is the lawful basis most B2B prospecting relies on, because a cold first contact has no prior consent behind it. Recital 47 says direct marketing “may be regarded as carried out for a legitimate interest”, but the European Data Protection Board (EDPB) says that “does not mean that direct marketing always constitutes a legitimate interest”.

The EDPB’s Guidelines 1/2024 on legitimate interest set “three cumulative conditions”, and the ICO applies them as a three-part test in this order:

1. Purpose test. Name a specific, lawful interest. The ICO rejects “we have a legitimate interest in using customer information” as too vague. “Offer shift-planning software to people who run production shifts” is specific.
2. Necessity test. Show the processing is targeted and proportionate. Use the fields outreach needs (name, title, company, work email, work phone), not personal emails or home addresses.
3. Balancing test. Check the person’s interests do not override yours. Expectations weigh heavily: the ICO says someone whose details are on their employer’s website “may well expect to receive contact from other businesses”, while data from other sources is “less likely” to be expected.

The EDPB says this assessment “should be done before carrying out the relevant processing operations”. One page per campaign is enough:

Article 14: tell people where you got their data

When you did not collect the data from the person, Article 14 of the GDPR requires a privacy notice. It must cover who you are, why you use the data and on what legal basis, your legitimate interest, the person’s rights, and “from which source the personal data originate”.

Timing. Article 14(3) gives you “a reasonable period” and “at the latest within one month”. If you use the data to contact the person, the deadline is “at the latest at the time of the first communication”. For cold outreach, that means the first email or call.

The exception is narrow. Article 14(5)(b) lifts the duty where notice is impossible or “would involve a disproportionate effort”. The ICO’s right to be informed guidance says that if you rely on it, you must carry out a data protection impact assessment (DPIA). When you are about to email the person anyway, a short notice in that email is the practical route:

The right to object and opt-out handling

The right to object to direct marketing is absolute. Under Article 21(2) and (3), a person can object “at any time”, and their data “shall no longer be processed for such purposes”. There is no balancing test and no reason required.

Three details catch sales teams:

• Say it up front. Article 21(4) requires you to bring the right to object to the person’s attention at the first communication, “clearly and separately from any other information”.
• Any wording, any channel. The ICO’s right to object guidance says an objection can be made “verbally or in writing”, to any part of your organization. “Take me off your list” on a call counts.
• Suppress, don’t just delete. The ICO says to put objectors on a “do not contact” or suppression list rather than deleting every record of them, so you can screen new lists against it. Article 17(1)(c) also gives people who object to direct marketing a right to erasure.

The process, in five steps:

1. Log it the same day: contact, date, channel, who took it.
2. Stop everything: every sequence and call task, in every tool.
3. Suppress: add the email and phone to the list your CRM and sequencer check before each send.
4. Point them upstream: send the vendor’s opt-out if they want out of its database too.
5. Confirm: if they asked for a reply, answer within one month (Article 12(3)).

ePrivacy and PECR: the email and call rules by country

The GDPR decides whether you may use the data; ePrivacy law decides whether you may send the message. Those rules come from the ePrivacy Directive (2002/58/EC) and each country’s law, and they differ most for B2B.

• EU baseline. Article 13(1) allows marketing email and automated calls only with prior consent, and Article 13(5) applies that to “subscribers who are natural persons”, leaving companies to national law. Whether a named employee’s work email counts as a personal or a company address is therefore decided nationally. Live calls are opt-in or opt-out “determined by national legislation” (Article 13(3)).
• UK. Under the Privacy and Electronic Communications Regulations (PECR), marketing email to “corporate subscribers” (companies, LLPs) needs no consent, but you must identify yourself and give a valid opt-out address. Sole traders and some partnerships need consent or the soft opt-in. Live calls must be screened against the TPS and CTPS registers (ICO).
• Germany. The Act against Unfair Competition (UWG section 7) treats marketing email without the addressee’s “vorherige ausdrückliche Einwilligung” (prior express consent) as an unacceptable nuisance, with no B2B carve-out. An existing-customer exception has four conditions. Calls to businesses need at least presumed consent. More in our guide to German business mobile numbers.

For calling hours, registers and autodialer rules in the US, UK, EU, Canada and Australia, see our B2B cold calling laws by country.

UK GDPR after the Data (Use and Access) Act 2025

The UK GDPR keeps the same three duties for B2B prospecting: a lawful basis, a notice and an absolute right to object. The Data (Use and Access) Act 2025 (DUAA) changed the details, and the ICO says most of its remaining data protection provisions came into force on 5 February 2026.

• Direct marketing is named as a legitimate interest. The ICO’s DUAA summary lists it among examples added to the standard basis. The ICO still says you must “identify your precise purpose” and assess the rest of the three-part test.
• A separate “recognised legitimate interests” basis skips the balancing test, for purposes listed in an annex. The ICO summary lists direct marketing under the standard basis instead.
• Article 14 is unchanged in substance. The Act clarifies that disproportionate effort depends on factors such as the number of people and the age of the data.
• Higher PECR fines. The ICO says the Act lets it fine up to 17.5 million GBP or 4% of global turnover under PECR.

The ICO’s B2B marketing and right to be informed pages both say they are under review after the Act, so check them before a UK campaign. Country detail for calling: UK business mobile numbers.

What to ask a B2B data vendor before you buy

A vendor cannot make your outreach compliant, but a vendor without clear answers can make it impossible. Ask these seven questions before you sign, and file the answers with your records.

1. Where does the data come from, and were people told? You need the source for your Article 14 notice. The ICO says to be clear “whether those sources tell people that they might share people’s information”.
2. Which lawful basis do you rely on? Ask to see the vendor’s own assessment.
3. Will you sign a Data Processing Agreement (DPA)? Article 28(3) requires a contract when a vendor processes data on your behalf, such as a file you upload for enrichment.
4. Where is data processed, and who else touches it? Look for Standard Contractual Clauses for transfers out of the EEA and a published sub-processor list.
5. How does a person opt out of your database? You will pass this on to people who object.
6. What happens to the data we upload? Is it added to your database, shown to other customers, and when is it deleted?
7. How do you keep data accurate? Article 5(1)(d) requires accurate, up-to-date data, and contact data goes stale as people change jobs (how fast B2B data decays).

Then test the data on your own accounts before you commit: our bake-off method for testing a data provider takes a week. For what the options cost, see B2B data cost per email and mobile, and for the vendors we tested, our best B2B data providers list.

A GDPR record-keeping checklist for B2B outreach

Article 5(2) makes you responsible for demonstrating compliance, so a GDPR-ready outbound program is mostly records you can produce in a day. Article 30 also requires a record of processing activities. Its exemption for organizations under 250 people does not apply when processing “is not occasional”, which a standing outbound program is unlikely to be.

Each record in the checklist maps to one GDPR article. Three are easy to forget:

• A source and date on every contact, so the Article 14 notice can name the source.
• A suppression list with the date and channel of each objection, so Article 21(3) holds across tools.
• A retention rule for prospects who never reply, because Article 5(1)(e) limits how long you keep data.

Common GDPR problems in B2B prospecting

These three gaps between the privacy policy and the actual list are the easiest to miss.

Personal addresses inside a business list

A Gmail address or a personal mobile in a “B2B” file changes the rules. The ICO says that if you are unsure whether details belong to a company or an individual subscriber, treat them as an individual’s, which in the UK means consent for email. Keep personal addresses out of cold sequences.

Contacts nobody can source

If you cannot say where a contact came from, you cannot give the Article 14 notice. Old spreadsheets and exports with no source column are the usual culprits. Tag every import with its source and date, and retire records that have neither.

Objections that live in call notes

A prospect who says “don’t call me again” has objected, but the note often stays in a rep’s call log. Add a do-not-contact disposition to your dialer and CRM, and make it sync to the suppression list.

How Scalelist handles GDPR

Here is where Scalelist, an AI lead finder, stands on the vendor questions above. The outreach duties stay with you.

• Accuracy: Scalelist finds and verifies contact details on demand rather than serving a pre-compiled list. Every email is verified before it is returned and labelled Valid or Risky; see what Valid and Risky mean.
• Charged on success: 1 credit per email found, 20 per mobile found, nothing when nothing is found. Plans start at 29 USD a month; see Scalelist pricing.
• Your part: the legitimate interest assessment, the Article 14 notice, the suppression list and the records on this page.

FAQ

Is B2B data GDPR compliant?

It can be, but compliance depends on how you use the data, not on the data itself. B2B contact data that names a person is personal data under the GDPR. It is compliant to use when you have a lawful basis (usually legitimate interest, with a documented three-part test), give an Article 14 notice by your first message, and stop at once when someone objects. This is not legal advice.

Do I need consent to send B2B cold emails in the EU?

It depends on the country. The ePrivacy Directive requires consent for marketing email to individuals and leaves company addresses to national law. In the UK, email to companies and LLPs needs no consent under PECR, but sole traders need consent or the soft opt-in. Germany’s UWG requires prior express consent for marketing email, businesses included. Check each country before you send.

Does the GDPR apply to US companies prospecting in Europe?

It can. Article 3(2) applies the GDPR to companies with no EU establishment when their processing relates to offering goods or services to people in the EU. A US team emailing or calling buyers located in the EU should plan on it applying, including the Article 14 notice and the right to object.

How quickly do I have to act on an opt-out?

Stop the marketing immediately. Under Article 21(3), once a person objects to direct marketing, their data “shall no longer be processed for such purposes”, with no exceptions. If they asked for a response, Article 12(3) gives you one month. Keep them on a suppression list rather than deleting every trace, so a future import cannot add them back.

Can I buy a B2B contact list under the GDPR?

Yes, but buying the list makes you the controller for what you do with it. You need your own lawful basis, you must tell each person where you got their data (Article 14), and you must honor objections. The ICO says you must tell people you have obtained their data. Ask the seller about sources, opt-outs and a Data Processing Agreement first.

Does the CCPA cover B2B contact data?

Yes, for businesses that meet its thresholds. The California Consumer Privacy Act (CCPA) once exempted personal information from business-to-business transactions, but the California Attorney General says those exemptions “expired on December 31, 2022”. A California resident’s work contact data can therefore fall under CCPA rights, such as the right to opt out of sale. This is not legal advice.

Sources

• EUR-Lex: Regulation (EU) 2016/679, the GDPR (Articles 3, 4, 5, 6, 12, 14, 17, 21, 28, 30, Recital 47)
• EUR-Lex: Directive 2002/58/EC on privacy and electronic communications, consolidated (Article 13)
• EDPB Guidelines 1/2024 on processing based on Article 6(1)(f) GDPR, version 1.0 for public consultation
• ICO: What is the legitimate interests basis?
• ICO: Business-to-business marketing
• ICO: Right to be informed
• ICO: Right to object
• ICO: The DUAA, summary of the changes to data protection law
• ICO: Statement on the commencement of the DUAA, 5 February 2026
• Gesetz gegen den unlauteren Wettbewerb (UWG), section 7
• State of California, Office of the Attorney General: California Consumer Privacy Act (CCPA)