GDPR and B2B Prospecting in the UK and EU

Yes. GDPR protects information that identifies a person, and a name plus a company email address or direct phone number does. It doesn't matter that the person is acting in a professional role. The UK has its own version, UK GDPR, alongside the Privacy and Electronic Communications Regulations (PECR), which govern electronic marketing.

Two separate sets of rules apply to most outreach. Data protection law covers how you collect, store and use the contact's details. Marketing rules, sometimes called ePrivacy rules, cover whether you can send that particular email, text or call. You have to satisfy both.

Often, yes, but you have to earn it. Legitimate interests is a lawful basis that requires a three-part assessment, commonly documented as a legitimate interests assessment:

1. Purpose: what business interest are you pursuing, and is it real and specific?
2. Necessity: is contacting this person needed for that purpose, and is there a less intrusive way?
3. Balance: does the individual's reasonable expectation and right to privacy outweigh your interest?

A relevant message to someone whose role matches what you sell usually passes more easily than a broad blast. Write the assessment down and keep it with your records. Consent is the other route, and some countries expect it for email marketing even to business addresses, so check the rule for each country you target.

Channel rules vary, so treat each country separately:

• UK email: PECR generally lets you send B2B marketing to corporate subscribers, such as a limited company's employee address, without prior consent, but sole traders and some partnerships are treated as individuals and usually need consent. Include your identity and a working opt-out.
• EU email: national laws implement the ePrivacy rules differently. Some countries, Germany is often mentioned, take a strict approach that expects prior consent even for B2B. Confirm each country with local counsel.
• Phone: in the UK, screen numbers against the Telephone Preference Service and its corporate counterpart before cold calling. Other countries have their own do-not-call systems.

If you can't get country-specific advice, restrict outreach to markets you've cleared and skip the rest until you can.

When you obtain someone's details from a third party, GDPR expects you to tell them who you are, why you have their data, where it came from and how to object, generally within a month of getting it and no later than your first message to them. In practice, teams put this in a short privacy notice linked from every outreach email.

The right to object to direct marketing is absolute. When someone objects, stop and add them to a suppression list that every tool checks. Don't delete the record entirely, because you need to remember not to contact them again. Keep one suppression list that your CRM, sequencer and data tools all check.

Whatever tool supplies your contacts, you remain responsible for how you use them. Before buying, ask the provider in writing:

• Where does the data come from, and how is it collected and refreshed?
• How do individuals get notified, and how are opt-outs and deletion requests fed back to you?
• Where is the data stored, and what safeguards apply to transfers outside the UK or EEA?
• Do you offer a data processing agreement, and what do you say about subprocessors?

Cognism markets itself to European sellers and is worth including in a shortlist, but confirm its compliance practices for your use case rather than assuming. See the comparison with ZoomInfo and Apollo, the overview of CASL and GDPR outbound compliance and the prospect list guide. For calls, see finding direct dials with the same care about consent and screening.