GDPR and B2B Prospecting: The Rules You Need to Know

No, GDPR does not prohibit B2B email prospecting. It regulates the practice: legal basis, prospect information, a simple right to object to exercise. Many companies give up on B2B cold emailing out of excessive caution, or on the contrary use it without respecting the basic rules.

This article explains which legal basis to invoke to contact a professional prospect, what data you are allowed to collect, and how to write a compliant email. You will also see how to concretely handle an unsubscribe or data deletion request, and which mistakes come up most often in B2B campaigns.

No, GDPR does not prohibit B2B email prospecting. This is a misconception that leads many companies to give up on cold emailing when the practice remains legal, provided a precise framework is respected.

What the regulation says, broadly speaking:

You can contact a professional by email without having obtained their prior consent, unlike prospecting towards an individual.
The message must relate to the recipient's professional activity: an email sent to a construction company offering a site management software is legitimate, a generic email with no connection to their sector is not.
The recipient must be able to easily object to any further contact.

Concrete example: you collect the professional email of a restaurant manager to offer them an online booking tool. This is permitted, because the product matches their activity and you comply with the identification and opt out rules.

The question is therefore not "am I allowed to prospect", but "what legal basis am I relying on and what data am I using". This is what the following sections detail.

Which legal basis should you use to contact a business prospect

In B2B, the most commonly used legal basis for email prospecting is legitimate interest. Unlike consent, it does not require you to obtain prior agreement from the prospect, but it imposes three concrete conditions.

The three conditions of legitimate interest

The contact must have a direct link with the recipient's professional activity. You contact a purchasing manager for inventory management software, not for a product unrelated to their job.
The message must not cause disproportionate harm to the person's privacy. A single targeted email respects this principle, repeated follow ups without a response undermine it.
The person must be able to object easily and at any time, from the very first contact.

Concrete example: you find a plumber in a professional directory and send them an email presenting an online quoting tool. Legitimate interest applies here, since the product directly relates to their business activity.

If the link to professional activity is too weak, or if the prospect is actually a person hard to distinguish from a private individual, legitimate interest is no longer sufficient: you must then switch to explicit consent.

What data are you allowed to collect and use

Public professional data is data that a company shares itself in order to be contacted: trade name, address, phone number, generic or named email published on its website, the manager's role. This information appears in professional directories, company websites or legal registers, so you can collect it and use it for prospecting related to the company's activity.

Concrete example: an accounting firm's website displays the email contact@cabinet.fr and the name of the managing partner. You can use these two pieces of data to offer invoicing software.

Limits to respect

Do not use data obtained through hacking or untraceable resale.
Do not cross this data with private information (personal life, opinions, health).
Check that the data remains public at the time of sending: an email removed from a website must be removed from your database.
Keep proof of the source for each contact, in case of an audit.

The simple rule: if the information is used to reach a professional for a reason related to their activity, it can be used. If it is used for something else, it can no longer be used.

How to write a compliant prospecting email

A compliant email follows a precise structure. Here are the steps to build yours.

Identify yourself clearly. Your company name, your name, and a way to contact you directly. Example: "I am [first name last name], from [company]".
Explain why you are writing to this person. Mention that their profile or company matches your target: "I identified your business in sector X in Lyon".
Specify the purpose of your outreach. One sentence is enough: presenting a service, proposing an exchange, sharing a resource useful to their business.
Indicate the source of the data if it is not obvious. For example: "I found your contact on your professional website".
Add a clear way to opt out. A line at the end of the email: "If you no longer wish to receive these messages, simply reply STOP."
Keep it brief. A compliant prospecting email fits in a few lines, not several screens.

This structure protects your recipient as much as your business.

How to handle the right to object and unsubscription

The right to object is not optional: as soon as a prospect asks to no longer be contacted, you must stop immediately, with no justification required on their part.

What you need to do in practice

Process the request without delay. A "STOP" or "unsubscribe me" must be applied before the next send, not at the next campaign.
Maintain a suppression list. Keep a record of addresses that have opted out, so you never contact them again, even via another list imported later.
Delete data on request. If a prospect requests complete erasure of their data (not just a stop to emails), you must be able to do so and confirm it.
Don't ask the same person for consent again. Once opted out, they remain opted out, unless they contact you again themselves.

Mistake to avoid

Continuing to send emails after an opt out because the contact was re imported from another source. The rule applies to the person, not the file.

Managing this properly requires knowing who was contacted, when, and with what response: without centralized tracking, the opt out gets lost in your spreadsheets.

The same mistakes come up in most B2B campaigns. Here they are, along with what they actually cost.

Buying a ready made contact database. You don't know where the addresses came from, nor whether the people have already been over solicited or have opted out elsewhere. In the event of an audit, you can't justify any specific legal basis.
Not tracking who has unsubscribed. A contact who switches tools or files becomes "new" again in your team's eyes, even though they've already refused to be contacted.
Collecting non professional personal data. Getting hold of a private mobile number or information from a personal profile falls outside the B2B scope and changes the applicable legal basis.
Sending from an anonymous address. Without clear sender identification, the email doesn't meet the transparency requirement, even if the content is relevant.
Following up indefinitely without a reply. Prospecting any contact without limit, with no link to your business, weakens the legitimate interest argument.

Each of these mistakes is fixed by a clear collection and tracking method, not by an isolated technical detail.

How to structure compliant prospecting on a daily basis

GDPR compliance in B2B prospecting mainly depends on your organization. If collection, enrichment and follow-up of exchanges are scattered across several tools, you lose the traceability needed to prove compliance with the right to object.

A simple structure to set up:

Centralized collection. Gather public business data (name, address, phone, website) in a single workspace, with your search criteria documented.
Traced enrichment. Complete profiles with available public information (professional email, Contact pages or legal notices) when you actually need it, not in advance in a generic file.
Interaction tracking. Record every outreach, every reply and every objection request on the relevant prospect's file.

ScrapLift works on this principle: Google Maps collection, enrichment and a lightweight CRM with interaction history are all found in a single dashboard. You stay in control of your lists, you know who was contacted and when, and you can delete a record as soon as a prospect exercises their right to object. Details are available on the features page.

What to remember

B2B email prospecting remains permitted, but it relies on precise conditions: a legitimate interest legal basis, professional data only, clear identification of the sender, and an easy-to-exercise right to object.

Before sending your next campaign, check these points:

Your contacts are public professional data, not personal emails collected without a legal basis.
Your email states who you are, why you're writing, and how to unsubscribe.
You track every consent, every send and every objection request.
No list was purchased without verifying its origin.

A quick audit of these four points before each send spares you most disputes. If you want to centralize this traceability (collection, enrichment, contact history) in a single tool, check out ScrapLift's features page.

Does the GDPR prohibit B2B email prospecting