GDPR has a reputation for making cold outbound impossible in Europe. It hasn't. What it does require is a more thoughtful approach — one that, in our experience, also produces better outreach. Compliance and quality move in the same direction here.
This guide is the framework we use internally and recommend to our customers. It is not legal advice; it is operational practice.
The legal basis: legitimate interest
GDPR allows B2B cold email under the legitimate interest basis if three conditions are met: you have a legitimate business reason to contact the person, your message is relevant to their professional role, and the prospect's rights aren't unduly impacted.
Translated: you can email a B2B prospect about something their job actually involves, as long as you respect their right to opt out and to know what data you hold.
What 'relevant to their role' means in practice
Reaching a CTO about a technical infrastructure offer is relevant. Reaching that same CTO about a yoga retreat is not. For domain outreach, this means: contact the people whose role would include making naming and brand decisions. Founders, marketing leads, head of brand, sometimes legal. Don't blast every employee on the company.
Data minimization in your prospect data
Only store what you need. Name, role, company and business email is enough. Don't collect personal phone numbers, home addresses, or sensitive demographic data. Document your sources. Delete prospects who opt out within 30 days.
- Store only business contact information
- Document where each record came from
- Honor opt-outs within 30 days, ideally within 7
- Run a quarterly review and prune stale records
Message-level practices
Identify yourself and your company clearly in every message. Provide a one-click unsubscribe (a reply is fine — you're a human). Tell the prospect how you found them in the first email if it isn't obvious. Don't disguise the commercial nature of the message.
All of this also makes for better outbound. Transparent emails outperform manipulative ones in our data.
Subject access requests
If a prospect asks what data you hold, you have one month to respond with a copy. Set up an internal process for this now, before you need it. It's a 30-minute task that can become a fire drill if ignored.
Common misconceptions
Two things you do not need under GDPR for B2B cold email: prior consent (legitimate interest is a separate basis), and a double opt-in (that's a marketing-list pattern, not an outbound one). What you do need: a clear opt-out, transparency, and good record-keeping.
Sofia advises B2B teams on GDPR, CAN-SPAM and CASL. She believes good compliance and good marketing are the same thing.
Stop waiting for buyers to find you.
DotOutbound surfaces the buyers most likely to want your domain — and helps you start the conversation.
Join the waitlist
