General information, not legal advice. Rules differ between countries; check with a lawyer for your situation.
Does GDPR apply to B2B emails?
GDPR applies to personal data, including business contact details that identify a person (like maria@clinic.com). Generic company addresses (info@) are less clearly personal data, but how they are treated can vary. Assume the rules apply when you email named people.
Lawful basis: legitimate interests
Many B2B senders rely on "legitimate interests" — a genuine business reason to contact someone, balanced against their rights and expectations. That generally means:
- the offer is relevant to the person's role or business
- you contact them in a reasonable way and volume
- you tell them who you are and how you got their details
- they can easily object
Document your reasoning (often called a legitimate interests assessment).
Electronic marketing rules
Alongside GDPR, countries have rules on electronic marketing (in the UK, PECR). Rules for emailing corporate subscribers (companies) are often different from those for individuals and sole traders. Sole traders and some partnerships may be treated like individuals, which can require consent. This is one reason to check local rules for each country you email.
Transparency
Tell recipients:
- who you are
- why you are contacting them
- where you got their details (for example, "your business website")
- how to opt out and how to request deletion
Data hygiene
- collect only what you need
- keep lists up to date and delete old data
- keep a suppression list of people who opted out
- respond to access and deletion requests promptly
Practical tips
- target precisely — relevance is your best defence
- keep the first email short and honest
- include an easy opt-out line
- don't mix cold outreach lists with marketing newsletters without consent