UK GDPR and Legitimate Interest for B2B Cold Email
gdpr cold email legitimate interest guidanceis cold email legal under gdpr in 2026gdpr cold email b2b
UK GDPR and Legitimate Interest for B2B Cold Email
Can you use legitimate interest for B2B cold email under UK GDPR? Learn the PECR consent test, LIA steps, 2026 fines and EU rules for compliance leads.
Carlos AgüeroNov 10, 2026
Last updated: Nov 10, 2026
UK GDPR and Legitimate Interest for B2B Cold Email
By Carlos Agüero | Last reviewed: October 22, 2026
Legitimate interest for B2B cold email is a UK GDPR lawful basis that lets you email business contacts without prior consent, but only where PECR does not require consent and a documented balancing test shows the outreach is fair. PECR, the Privacy and Electronic Communications Regulations, is where many plans fail. This gdpr cold email legitimate interest guidance gives UK compliance leads the two-layer test, a working assessment, the 2026 penalty picture and the EU position. If your team also tests video in first-touch cold email, the same rules apply to it.
Key Takeaways
Legitimate interests under UK GDPR can cover B2B cold email only where PECR does not require consent for that recipient.
PECR fines now reach £17.5 million or 4% of global annual turnover, up from £500,000, since 5 February 2026 (Clifford Chance, 2026).
A legitimate interests assessment (LIA) should record purpose, necessity and balancing before the first send.
EU cold email is decided by each country's national ePrivacy law, not by GDPR alone.
Can we rely on legitimate interest under UK GDPR for B2B cold emails?
UK GDPR legitimate interests can support B2B cold email to UK prospects, but only where the Privacy and Electronic Communications Regulations (PECR) do not require consent. The Information Commissioner's Office (ICO) states that "Legitimate interests can apply for direct marketing but only where the Privacy and Electronic Communication Regulations (PECR) don’t require consent." (ICO, 2026)
Balanced scales on a desk with an envelope on one side and a legal book on the other
Legitimate interests is one of the six lawful bases in UK GDPR. It lets an organisation process personal data for a genuine business purpose, if that purpose passes a balancing test against the individual's rights. The ICO has described it as "the most flexible lawful basis" (DMA, 2026), as quoted by the Data & Marketing Association.
The ICO updated its guidance on 23 March 2026 after the Data (Use and Access) Act 2025 (DUAA), the UK law that amended parts of UK data protection law. Direct marketing is now named as a possible legitimate interest. The new "recognised legitimate interests" basis does not cover commercial marketing, so do not use it for outreach.
Flexible does not mean automatic. You still have to pass two separate tests, covered next.
How do PECR and UK GDPR work together as a two-layer test?
Cold B2B email in the UK passes through two layers. First, PECR decides whether the recipient must have consented. Second, UK GDPR requires a lawful basis for processing the contact's personal data, and legitimate interests is usually the one. Failing the PECR layer ends the analysis, however strong your legitimate interests assessment looks.
Two stacks of paper index cards sorted into separate trays on a desk
PECR is the UK rulebook for electronic marketing by email, call and text. The difference that matters is the type of subscriber. A corporate subscriber is a limited company, a limited liability partnership (LLP) or a Scottish partnership. Individual subscribers include sole traders and ordinary partnerships.
Screen your list by recipient type
Recipient type
Examples
PECR consent for cold email?
Practical rule
Corporate subscriber
Limited company, LLP, Scottish partnership
No prior consent required
Identify yourself, give a contact address, honour opt-outs, and document legitimate interests
Still personal data, so complete an LIA and honour objections
Existing customer
Previous buyer of a similar product
Soft opt-in may apply
Offer a clear opt-out at collection and in every message
Why the soft opt-in does not rescue cold outreach
The soft opt-in is a narrow PECR exemption for existing customers and people who negotiated a sale with you. It does not apply to a first message to a stranger. The ICO fined Allay Claims Ltd £120,000 for 4,046,947 marketing texts sent without valid consent or a valid soft opt-in (ICO, 2026).
How do you run a legitimate interests assessment for B2B cold email?
A legitimate interests assessment (LIA) is a written, three-part test of purpose, necessity and balancing that shows your outreach is fair to the people you email. For B2B cold email, you record why you contact a role, whether email is needed, and how the recipient's expectations and rights weigh against your commercial aim.
Three printed assessment sheets laid side by side with a pen and a checkmark
The ICO's legitimate interests guidance (2026) frames the assessment around these three tests. Complete all three before the first send.
Purpose test. State the exact business aim, such as introducing a product to finance directors at UK software companies.
Necessity test. Explain why email is a proportionate channel and why you cannot reach the same goal with less data.
Balancing test. Weigh the recipient's reasonable expectations, the likely impact and your safeguards.
Two follow-up actions sit alongside the test. Record the decision with a date, an owner and a review schedule. Then check your transparency duties, including any privacy notice owed when you obtain data from a third party.
Example LIA wording
LIA part
Question to answer
Example wording
Purpose
What are we trying to achieve?
"Introduce our reporting software to heads of finance at UK limited companies."
Necessity
Is email needed and proportionate?
"Email is the least intrusive channel, and we use only name, role and work address."
Balancing
Would the person reasonably expect this?
"Recipients hold roles relevant to the offer, and each message has a one-click opt-out."
Safeguards
What limits the impact?
"Suppression list, source records and objection handling across all systems."
The necessity test is where bought data fails. The ICO fined ZMLUK Limited £105,000 for over 67 million marketing emails sent without valid consent, using data sourced from third parties (ICO, 2026). If a contact comes from a broker, check the consent chain and keep the source and date for every record.
Is cold B2B email GDPR-compliant in the EU?
Cold B2B email can be GDPR-compliant in the EU, but GDPR does not settle the question alone. National ePrivacy laws, which implement the EU ePrivacy Directive, set the consent rules for email in each member state, and they vary. Treat each country separately, check its law or data protection authority guidance, and keep your documented lawful basis ready.
A map of Europe on a table with small flag pins placed in several countries
Blog posts often label whole countries "permissive" or "strict" and disagree with each other. Do not copy those labels. Read the national transposition of the ePrivacy Directive and any guidance from that country's data protection authority, then record your conclusion in the LIA.
What the UK adequacy renewal means
For senders holding EU contacts, the European Commission renewed the UK's two adequacy decisions for six years, to December 27, 2031, with a mid-point review after four years (Hunton Andrews Kurth, 2025). EU and UK personal data flows can continue. That covers transfers, not email consent.
Watch the EU Digital Omnibus
The EDPB and EDPS adopted Joint Opinion 2/2026 on the Digital Omnibus proposal, which would amend GDPR and the ePrivacy Directive (EDPB, 2026). It is still before Parliament and Council. As of this writing, no confirmed change to B2B email rules has come out of it.
What are the penalties for breaking the rules, and how likely is enforcement?
PECR breaches, including unlawful email marketing, can now cost up to £17.5 million or 4% of global annual turnover, up from £500,000, since the Data (Use and Access) Act provisions took effect on 5 February 2026 (Clifford Chance, 2026). Enforcement against email is still infrequent and complaint-driven.
A gavel resting beside a stack of official letters on a desk
The recent picture is uneven. In the first half of 2025, the ICO issued six fines in total, none for email marketing (URM Consulting, 2025). Then in January 2026 the ICO fined ZMLUK Limited £105,000 for over 67 million marketing emails. That case concerned B2C-style consent, not corporate subscribers.
Andy Curry, the ICO's Head of Investigations, said: "The law here is clear: businesses must only send marketing messages to people who have freely and knowingly consented to receiving them." (ICO, 2026)
Recent ICO fines for calls and texts
Recent penalties have mostly hit calls and texts rather than email. According to TrustKeith's 2026 compilation of ICO monetary penalty notices, Jacksons Marketing Ltd was fined £130,000 and Energy Prices Direct Ltd £160,000 in March 2026. Thermotech Wall and Loft Surveys Ltd was fined £240,000 and KRA Consultancy Ltd £300,000 in May 2026.
Horizontal Bar chart: Recent ICO PECR fines, March–May 2026 (calls and texts). Highest: KRA Consultancy Ltd (May 2026) at £300,000.
Keep a suppression list and apply it across every tool and sender.
Record data sources and dates for each contact.
Honour objections quickly, because complaints are what trigger investigations.
Who is this guidance not for?
UK GDPR legitimate interest guidance for B2B cold email is a general explainer for compliance and sales leads, not legal advice, and it does not fit every sender. It covers B2B email to UK prospects and gives an EU overview, but calls, texts, B2C marketing and country advice need qualified counsel. According to GRC Solutions, the ICO issued 49 PECR penalty notices worth £4.63 million from March 2022 to April 2025 (2026).
That tally combines calls, texts and emails, so it shows the scale of PECR enforcement rather than email risk alone. Some further limits:
The ICO updated its direct marketing guidance on 28 April 2026 for a charitable-purpose soft opt-in (Bates Wells, 2026). That does not affect commercial senders, but it shows guidance is still changing, so re-check before each campaign.
Confirm commencement dates for each DUAA provision against the ICO's own statements.
Canada, the US and Australia have different regimes, such as CASL and CAN-SPAM, that this article does not address.
If your list is mostly sole traders, individual consent rules apply and legitimate interests will not rescue the campaign.
Frequently Asked Questions
Is cold email legal under GDPR?
Yes, cold email can be legal under GDPR, but the rules depend on who you email and where. GDPR requires a lawful basis, and legitimate interests can be one for B2B outreach. Separate ePrivacy rules, such as PECR in the UK, may still demand consent, particularly for individual subscribers like sole traders.
Is cold B2B email GDPR-compliant in the EU?
Cold B2B email can be GDPR-compliant in the EU, but GDPR alone does not decide it. Each member state's national ePrivacy law sets the consent rules for email, and they differ by country. Check the national law or data protection authority guidance for each country before sending, and document your lawful basis.
Does the soft opt-in apply to B2B cold email?
No, the soft opt-in does not cover true cold outreach. It only applies to existing customers or people who have negotiated a sale with you, and it needs a clear opt-out. The ICO fined Allay Claims Ltd £120,000 in January 2026 for misusing the exemption on marketing texts.
Is a work email address personal data under UK GDPR?
A work email address is personal data under UK GDPR when it identifies a living person, such as firstname.surname@company.com. Generic addresses like info@company.com are less likely to identify anyone. Because named addresses are personal data, you still need a lawful basis, transparency and a way to honour objections.
Conclusion
UK GDPR legitimate interest can support B2B cold email, but only after PECR clears the recipient. Keep these points in front of your team:
Screen every list for corporate and individual subscribers before sending.
Document purpose, necessity and balancing in an LIA.
Record data sources, honour objections and keep a shared suppression list.
Treat each EU country under its own ePrivacy law.
Plan for PECR fines of up to £17.5 million or 4% of turnover (Clifford Chance, 2026).
Our data: SendPotion's customer case study shows GrowPronto booked 45 meetings and closed 7 accounts with Potion. Outreach that performs still has to clear the PECR test first.
Carlos Agüero builds tools that help B2B sales teams sell smarter. As part of TargetGrid.ai, Skale.email, and Potion, he's focused on multi-channel outreach automation, inbox deliverability, and AI-powered video. Berkeley Haas COBE. Based in Santiago, Chile. Passionate about helping sales teams close more, faster, with less manual work.
Carlos AgüeroNov 10, 2026
