This article explains how the rules generally apply. It is not legal advice. For your specific setup, talk to a data protection lawyer or your DPO, especially before running campaigns in a new country.
Two sets of rules, not one
Most confusion comes from mixing up two different layers of law.
- GDPR governs whether you may process a person's data at all: collecting a name, finding a work email, storing it in your CRM, using it to contact them. It is the same regulation in every EU country.
- E-marketing rules come from the ePrivacy Directive as implemented in national law. They govern the channel: whether you may send unsolicited commercial email or make sales calls, and under what conditions. These differ from country to country.
You need to pass both. A perfectly documented legitimate interest does not help if the recipient's country requires consent for marketing emails. And a country that allows B2B email does not excuse a missing privacy notice.
What counts as personal data in signal-based prospecting
Signal-based prospecting has a useful property here: it starts with companies, not people.
| Data | Personal data? | Why |
|---|---|---|
| Company X is opening a distribution centre in Venlo | Generally no | Information about a legal entity |
| Company X published a tender for WMS software | Generally no | Information about a legal entity |
| Company X is hiring a Head of Security | Generally no | A role, not a person |
| Anna Berg is the site director at Company X | Yes | Identifies a natural person |
| anna.berg@companyx.com | Yes | A named work address identifies the person |
| info@companyx.com | Usually no | Generic address, though e-marketing rules can still apply |
| Anna's LinkedIn post about choosing a WMS | Yes | Content linked to an identifiable person |
The practical consequence: you can monitor and analyse company signals freely. GDPR obligations start the moment you attach a person to the signal. That is a good reason to attach as few people as you actually need, which is also how good signal-based outreach works anyway.
Legitimate interest: the usual legal basis
Consent is impractical for a first contact, because you cannot ask permission before you have spoken to someone. So most B2B prospecting relies on legitimate interest under Article 6(1)(f) GDPR. Recital 47 explicitly says that processing personal data for direct marketing may be regarded as carried out for a legitimate interest.
"May be" is doing real work in that sentence. You need a legitimate interest assessment (LIA), a short internal document that answers three questions:
1. Purpose: is your interest legitimate?
Offering a relevant product or service to businesses is a recognised legitimate interest. Write down what you sell and why the people you contact are relevant to it.
2. Necessity: do you need this data for it?
Collect only what you need to reach the right person: name, role, company, a work contact channel. Personal phone numbers, home addresses or details about someone's private life fail this test.
3. Balancing: would the person reasonably expect it?
This is where signals help. A site director being contacted about equipment for a site their company publicly announced is a reasonable expectation in a professional context. A random person from a bought list of 50,000 contacts receiving a generic pitch is much harder to justify.
Keep the LIA on file. If a regulator or a prospect asks why you processed their data, it is your answer.
The Article 14 notice: tell people where you got their data
When you obtain someone's data from a source other than them, Article 14 GDPR requires you to inform them. If you use the data to contact the person, the notice must be given at the latest at the time of the first communication (Article 14(3)(b)). Otherwise, within a reasonable period and at most one month.
The notice should cover:
- who you are and how to contact you (and your DPO, if you have one)
- why you process the data and on what legal basis, including the legitimate interest
- which categories of data you hold
- where the data came from, and whether it was from public sources (Article 14(2)(f))
- how long you keep it
- their rights, including access, erasure and the right to object
In practice, teams add two or three plain sentences at the bottom of the first email with a link to a full prospect privacy notice. For example:
We contacted you because of your role at Company X and its recent announcement of a new site. We found your work email using public sources and process it on the basis of our legitimate interest in offering relevant services. You can object at any time by replying "no thanks", and we will not contact you again. Full details: company.com/prospect-privacy
Objections: one reply ends it
Under Article 21 GDPR, a person can object to processing for direct marketing at any time, and when they do, you must stop processing their data for that purpose. There is no balancing here: an objection to direct marketing always wins.
- Treat any clear "not interested, don't contact me" as an objection, not only formal wording.
- Stop all sequences for that person across every tool, not only the one they replied to.
- Keep a minimal suppression record (for example the email address) so you do not contact them again from a new list or signal. Its purpose is to respect the objection.
National email rules: where countries differ
E-marketing rules decide whether you may send the first email without consent. They are national, and the differences are real. A few examples of how it generally works:
| Country | Unsolicited B2B marketing email | Notes |
|---|---|---|
| France | Generally allowed to professional addresses without prior consent | CNIL position: the message must relate to the recipient's professional role and offer a simple, free way to object |
| Germany | Generally requires prior express consent, including for businesses | UWG §7 treats email advertising without consent as unreasonable harassment; B2B phone calls follow different, looser rules |
| United Kingdom (outside the EU) | Allowed to corporate subscribers without prior consent | PECR: identify yourself and offer an opt-out; sole traders and some partnerships are treated like individuals |
| Other EU countries | Varies | Check the recipient's country, not yours; some are close to France, some close to Germany |
The rule follows the recipient. A Finnish company emailing a German prospect has to respect German rules. If you prospect across many countries, the simplest approach is to set the channel per country: email where it is allowed, phone or LinkedIn where email needs consent, and always the same GDPR basics underneath.
LinkedIn messages and connection requests are generally not treated like email under these rules, but they are still personal data processing under GDPR, and LinkedIn's own terms restrict automation and scraping.
Data minimisation and retention
Two habits keep a prospecting database defensible.
- Collect less. For each signal, contact the one or two people who own the decision. Do not enrich the whole org chart because a tool makes it easy.
- Delete on a schedule. Decide how long you keep data on prospects who never replied and delete it when that period ends. Write the period in your privacy notice and actually run the cleanup.
- Know your vendors. If a data provider or signal platform supplies contacts, ask where the data comes from and on what basis it was collected. You remain responsible for how you use it.
Why signal-based prospecting fits GDPR better than bulk lists
GDPR does not prefer one sales method over another. But several of its tests are easier to pass when outreach is relevant and small:
| GDPR question | Bulk list outreach | Signal-based outreach |
|---|---|---|
| Would the person reasonably expect contact? | Weak: no specific reason | Stronger: a public company event tied to their role |
| Is the data necessary? | Thousands of contacts, most never relevant | One or two contacts per relevant event |
| Can you explain the source? | Often a reseller list with unclear origin | A public event plus a documented contact source |
| Volume of complaints and objections | Higher, because most messages are irrelevant | Lower, because messages are relevant |
The same relevance that improves reply rates also improves your legitimate interest case. Our signal-based selling playbook covers how to write those first messages, and the list of 40 buying signals helps you choose events that connect to the recipient's role.
Checklist before your next EU campaign
- A written legitimate interest assessment for your prospecting
- A prospect privacy notice with source, legal basis, retention and rights
- A short Article 14 notice in every first message, with a link to the full notice
- Channel rules set per recipient country
- One shared suppression list across all tools, updated on every objection
- A retention period for non-responders, and a scheduled deletion
- Contacts limited to the people who own the decision behind each signal
- Documentation from your data and signal vendors on how contacts were sourced
Where Karhuno fits
Karhuno starts from public company events, not from bulk contact lists. Each opportunity explains what happened, links to the source, checks the account against your ICP and disqualifiers, and suggests the few decision makers relevant to that event. That keeps your outreach small and specific, which is what both your reply rate and your legitimate interest assessment need. For the wider European data picture, see intent data for B2B Europe.
Plans start at $299/month for 100 deal opportunities, with a 7-day free trial.
FAQ
- Is B2B cold outreach legal under GDPR?
- GDPR does not ban it. Processing a business contact's data for direct marketing can rely on legitimate interest (Article 6(1)(f), Recital 47), provided you run a balancing test, inform the person no later than your first message (Article 14), and stop when they object (Article 21). Separate national e-marketing rules then decide whether you may send unsolicited emails, and those differ by country.
- Are company buying signals personal data?
- Usually not. A company opening a warehouse, raising funding or publishing a tender is information about a legal entity. It becomes personal data processing when you link it to an identifiable person, for example a named decision maker, their work email or their LinkedIn profile.
- Is a work email address personal data?
- A named work address such as firstname.lastname@company.com relates to an identifiable person, so it is personal data. A generic address such as info@ or sales@ usually is not, although national e-marketing rules may still apply to messages sent to it.
- Do I need consent to email B2B prospects in the EU?
- It depends on the country. France allows B2B emails to professional addresses without prior consent if the message relates to the recipient's role and offers an easy way to object. Germany generally requires prior express consent for email advertising, including to businesses. Check the rules of the recipient's country before you send.
- What must I tell a prospect under Article 14?
- Who you are, why you process their data, the legal basis and your legitimate interest, the categories of data, the source (including whether it was public), how long you keep it, and their rights, including the right to object. If you use the data to contact them, this must be provided at the latest with your first message.
- Does signal-based prospecting help with GDPR?
- It can. Contacting a person about a recent, public event at their company that relates to their role is easier to justify in a legitimate interest balancing test than mass outreach to a bought list. It also tends to involve less data and fewer contacts. It does not remove the need for notice, objection handling or national email rules.