How to find GDPR-safe email addresses for B2B outreach without risking €20M fines. The legal basis, the 3-part test, and where to source compliant data.
You can legally email European business prospects without their prior consent. The legal basis is "legitimate interest" under GDPR Article 6(1)(f), and it covers B2B direct marketing when you can prove a genuine business reason. That is the part most reps and founders never get straight, so they either avoid the EU entirely or blast scraped lists and gamble on a €20 million fine.
Neither is necessary. GDPR-safe email sourcing comes down to three things: a documented legal basis, data from a compliant provider, and the right to be forgotten built into your process. Get those right and you can prospect across Europe with confidence. Get them wrong and one complaint can trigger an investigation. This playbook shows you exactly how to find and use GDPR-safe email addresses.
A quick definition. A GDPR-safe email address is a business contact you can lawfully process for outreach under a valid legal basis, almost always legitimate interest for B2B. It has to be sourced transparently, relevant to the recipient's professional role, and paired with an easy opt-out. Consent is not required for B2B legitimate-interest outreach, but documentation of your reasoning is.
GDPR-safe does not mean "I got consent." For B2B outreach it means you have a lawful basis to process the contact's data and you can defend that basis if challenged.
The European Data Protection Board explicitly recognizes direct marketing as a potential legitimate interest in Recital 47. So a relevant, role-based B2B email to a decision-maker is generally lawful, as long as you pass the balancing test and respect opt-outs.
The risk is not the email itself. It is processing personal data with no documented justification, from an unknown source, with no way to honor a deletion request. That is what regulators fine.
For B2B cold email in the EU, your legal basis is legitimate interest under Article 6(1)(f), not consent. Consent, the double opt-in standard, is required for B2C and in stricter jurisdictions, but for business-to-business professional outreach, legitimate interest applies.
To rely on it, you have to pass a three-part test defined by the EDPB. The purpose test asks whether you are pursuing a genuine legitimate interest, and selling a relevant solution to a relevant buyer qualifies. The necessity test asks whether the email is necessary to achieve that purpose, where direct outreach to the right role passes but spraying an entire company does not. The balancing test asks whether the person's right to privacy overrides your interest, so emailing a VP of Sales about a sales tool is balanced while emailing their personal Gmail is not.
Document this reasoning in a Legitimate Interest Assessment (LIA) for each campaign. It is not a one-time checkbox. Regulators expect a per-campaign record of why your outreach is justified.
GDPR is one regulation, but enforcement varies sharply by country, and the ePrivacy Directive can override legitimate interest entirely.
A few variations to know. Germany is consent-heavy and frequently enforced as double opt-in, even in some B2B contexts, so treat it as the strictest market. France is comparatively permissive for profession-related B2B outreach. And the ePrivacy Directive is transposed differently in every member state, sometimes demanding consent for electronic marketing regardless of GDPR's legitimate-interest allowance.
The practical takeaway is to research the specific country before a campaign and apply the strictest reasonable standard when in doubt. Sending a generic blast across all 27 member states under one assumption is how you get caught.
GDPR-safe outreach goes to people in their professional capacity. Target the decision-maker's work email tied to their role and company. Avoid personal email domains and contacts whose role has no connection to what you sell. Relevance is half the balancing test.
Where your data comes from matters as much as who is on it. A GDPR-compliant B2B contact database documents its sources, processes contacts transparently, and supports deletion requests. Scraping LinkedIn or buying a mystery list fails on provenance, because you can't prove where the data came from, which sinks your defense.
Use a provider that gives you verified business emails, firmographic context, and a clear data-sourcing trail. A 280-million-contact database with 98% deliverability and documented sourcing lets you filter to relevant roles and prove provenance if asked.
Before each campaign, write down who you are targeting, why your product is relevant to their role, why email is necessary, and why their privacy interest doesn't outweigh yours. Store it. This single document is your defense if a regulator asks.
Every cold email needs a clear, one-click way to opt out, and you have to process deletion requests promptly. The right to be forgotten is non-negotiable. Keep a suppression list and scrub it against every send.
Maintain records of your data sources, processing activities, and LIAs. GDPR's accountability principle puts the burden of proof on you. Organized records turn a scary audit into a five-minute exercise.
A few myths worth clearing up. It is not consent-only, since B2B legitimate interest does not require prior opt-in in most member states. It is not avoiding Europe entirely, because compliant outreach across the EU is fully legal. It is not "the tool handles it," because your sending platform doesn't write your LIA or pick relevant targets, you do. And it is not a one-time setup, since each campaign needs its own assessment and clean suppression handling.
The simplest way to hold the standard is to check three things on every contact. Provenance, meaning you can prove where the data came from. Relevance, meaning the contact's role matches your offer. And reversibility, meaning you can honor deletion and opt-out instantly. A contact is only GDPR-safe when all three hold. Miss provenance and you can't defend the source. Miss relevance and you fail the balancing test. Miss reversibility and you violate the right to be forgotten. Put plainly, a GDPR-safe contact is not one you got consent for. It is one whose source you can prove, whose role you can justify, and whose data you can delete on request.
A compliant database covers the first two for you. InboundLabs provides documented data sourcing, verified business emails with 98% deliverability, and firmographic plus role filtering, so you reach the right decision-maker in their professional capacity. See how InboundLabs finds verified, compliant contacts instantly
GDPR penalties are not theoretical. Violations can reach €20 million or 4% of global annual revenue, whichever is higher. Beyond fines, a complaint can freeze a campaign, trigger an audit, and damage your brand with the exact buyers you are trying to win.
The asymmetry is stark. A documented LIA and a compliant data source cost you an afternoon. A violation can cost a percentage of your entire company's revenue. Compliance is cheaper than the gamble every time.
GDPR doesn't lock you out of Europe. It rewards the senders who do it properly. While competitors either avoid the EU or risk fines on scraped lists, you can prospect confidently with documented legitimate interest, compliant data, and clean opt-out handling.
Start today: write one Legitimate Interest Assessment for your next EU campaign, and source the contacts from a provider that documents its data trail. Try InboundLabs free and build a GDPR-safe list this week
Is it legal to send cold emails to EU contacts under GDPR?
Yes. B2B cold email is legal in the EU under the legitimate interest basis in Article 6(1)(f), provided the outreach is relevant to the recipient's role, you document your reasoning, and you offer an easy opt-out. Consent is not required for B2B legitimate-interest outreach in most member states.
Do I need consent to email business contacts in Europe?
Not usually. Legitimate interest covers most B2B outreach, so prior consent is not required. Exceptions exist, since Germany is often enforced as double opt-in and the ePrivacy Directive can demand consent in some member states, so check the country first.
What is a Legitimate Interest Assessment?
A Legitimate Interest Assessment (LIA) is a documented record proving your outreach passes GDPR's three-part test of purpose, necessity, and balancing. You write one per campaign, explaining why your email is justified. It is your defense if a regulator investigates.
What happens if I violate GDPR with cold email?
GDPR violations can result in fines up to €20 million or 4% of global annual revenue, whichever is higher. A single complaint can trigger an investigation, freeze your campaign, and damage your reputation with target buyers.
Can I scrape emails from LinkedIn for GDPR-safe outreach?
No. Scraping fails the provenance requirement, because you can't prove a lawful, transparent data source, which undermines your legitimate-interest defense. Use a compliant data provider that documents where contacts came from and supports deletion requests.
How do I make a cold email GDPR-compliant?
Target a relevant business role, rely on documented legitimate interest, include a clear one-click opt-out, honor deletion requests instantly, and keep records of your data source and assessment. Relevance and reversibility are non-negotiable.
Which EU country has the strictest cold email rules?
Germany is generally the strictest, often enforced as double opt-in even in some B2B contexts. France is more permissive for profession-related outreach. Always apply the strictest reasonable standard when targeting multiple member states.
Sources: GDPR Local, GDPR Cold Email Strategy 2025; Sales Force Europe, Legitimate Interest for GDPR Cold Email; Instantly, GDPR, CAN-SPAM and B2B Email Compliance.
Where Lusha’s speed and Chrome extension shine, what it really costs, and the data accuracy catch to know before you build a pipeline on it.
An honest look at Lusha's data accuracy: the 98% claim versus a real-world 60 to 70%, where it slips, and how to use Lusha without bouncing.
A no-spin breakdown of whether Cognism is worth its premium price, who should buy it, and who should choose a more flexible database.
No commitment. No credit card. Just 50 free verified contact lookups.