GDPR legal basis for B2B prospecting

This is an overview, not legal advice. It draws on the text of the regulation, on the European Data Protection Board's October 2024 guidelines on legitimate interest and on the guidance pages of IMY, the Swedish Authority for Privacy Protection. That is enough to let you walk into your lawyer's office with the right questions, rather than freezing all prospecting while you wait for a verdict that never arrives.

B2B data is not exempt from GDPR

Ask a sales team what GDPR covers and most will say consumers. Wrong. Recital 14 does exclude data about legal persons: the company name, the registration number, the switchboard. But Anna Lindqvist, head of procurement, with her direct line and her email address, is a natural person. Her details in your CRM are personal data in the legal sense, however corporate the domain on the address looks. None of this stops you calling her. It does mean you need a lawful basis for keeping her on the list, and that she has rights you have to be able to act on.

Of the six bases in Article 6, only two are realistic for prospecting: consent and legitimate interest. Consent is often weaker than it sounds. It has to be freely given, specific and as easy to withdraw as to give, and a prospect who has never heard of you has given none. Legitimate interest is the basis that carries almost all B2B prospecting, and GDPR itself points to it: the last sentence of Recital 47 says that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. IMY says the same, adding that you must always stop direct marketing once the person objects.

The balancing test in three steps

Legitimate interest is not a free pass. On 8 October 2024 the European Data Protection Board adopted Guidelines 1/2024 on Article 6(1)(f), in a version released for public consultation. They set three conditions, and all three have to be met: the controller pursues a legitimate interest, the processing is necessary for that interest, and the data subject's interests and rights do not outweigh it. The guidelines also say the assessment has to be made and documented before processing begins. The Court of Justice of the EU confirmed in October 2024, in the case about the Dutch tennis federation KNLTB, that a purely commercial interest can qualify as a legitimate interest so long as it is not contrary to law.

For a sales team the three steps look like this. The interest: selling your service to companies that could reasonably use it. That is legitimate, but state it precisely, since the EDPB only accepts interests that are lawful, clearly articulated and real, not 'growth'. Necessity: IMY's rule of thumb is that processing is not necessary if the same result can be reached with less intrusive means. Storing a decision maker's name, title, company and work number is necessary if you are going to call them. Storing a private mobile number, date of birth or notes about family is not. The balance: what can the person reasonably expect? A head of procurement at a manufacturer expects suppliers to get in touch at work. A nurse does not expect a call at work about a CRM system.

Information: no later than the first contact

This is where most teams slip. When the data did not come from the person, which is the norm in prospecting (bought lists, LinkedIn, trade registers), Article 14 applies. It requires you to inform the person within one month of obtaining the data, or at the latest at the first communication if the data will be used to contact them, whichever comes first. The information must include who you are, the purpose, the legal basis, the legitimate interest you rely on, where the data came from and how long you intend to keep it. The 'disproportionate effort' exception in Article 14(5)(b) is narrow and nothing to build a routine prospecting process on.

In practice, two things cover it. A short paragraph in the first email saying where you found the details and why you are writing, with a link to your privacy notice and a plain way to say no. And, if the person asks on the first call, a sentence pointing to the same notice. What does not work is holding the information back until the prospect replies, or burying it in a policy nobody can find. Back in 2016 the Swedish regulator, then called Datainspektionen, ruled in a decision against Tele2 that customers had not been given enough information about how their data was handled, and required that the information be given at the point of collection. The same principle applies to prospecting.

The objection is absolute

Article 21(2) gives everyone the right to object at any time to their data being used for direct marketing. Article 21(3) says what happens next: the data may no longer be processed for that purpose. No new balancing, no 'but our interest is strong'. Article 21(4) also requires that the right to object is explicitly brought to the person's attention no later than the first communication, clearly and separately from other information. A 'reply STOP and we remove you' in the email meets that. A paragraph on page four of the policy does not.

The practical problem is the CRM, not the law. If an objection means the contact gets deleted, the record of her saying no is deleted with it, and the next list you import adds her straight back. The right move is to flag the contact as 'no marketing' and keep the bare minimum needed to honour the objection. Build that flag before the first send, not after the first complaint.

Where may the data come from?

GDPR does not regulate the source as such, but the source shapes the balance. Details the person made available in their professional role, such as a title and company on LinkedIn or a direct line on the company website, sit within what the person can reasonably expect. Bulk-collected or purchased lists are harder: you need to know the list seller had the right to disclose the data, you carry the Article 14 duty and you must name the source. IMY has published no specific guidance on B2B lists or LinkedIn, and regulators elsewhere in the EU have been tougher on scraped data than on details from open professional profiles. So: tie every contact to a documented source, keep to the details needed to reach the person at work, and treat the platforms' own terms of use as a separate contractual question.

Two documents you need before you dial

1. A legitimate interest assessment on paper: interest, necessity, balance and safeguards (opt-out, retention, limitation to work details), dated and signed by whoever is responsible. The EDPB guidelines require it to exist before processing starts, and Article 5(2) requires you to be able to demonstrate compliance.
2. A record of processing activities under Article 30. The exemption for companies with fewer than 250 employees does not apply when processing is not occasional, and a CRM used every day is not occasional. The record must state purposes, categories of data, recipients and, where possible, the time limits for erasure.

Add a third thing that is not a document: a retention rule. Article 5(1)(e) says data may not be kept longer than the purpose requires. A prospect who has not replied in eighteen months and no longer fits your target segment serves no purpose you can point to, however good the list felt when you bought it.

What the law does not solve

Having the lawful basis sorted does not make the call any good. A prospect who gets an email that says openly where you found their details and why you are writing is far more likely to reply than one who gets an anonymous 'I hope this email finds you well'. The transparency the law demands is exactly what a good conversation demands: a clear reason for getting in touch, put in the recipient's terms. It is a skill you can practise. In Salesprep's Cold call module you meet an AI buyer who asks 'where did you get my number?' and 'why are you calling me specifically?', and the score on your opening tells you whether your answer sounded like an explanation or an apology. Three calls are free, no card required.