GDPR. It applies the moment you email a single person sitting in Europe.

01What GDPR actually is

GDPR is a European Union regulation, effective 25 May 2018, that governs how personal data may be collected, stored, processed, and shared. Personal data is defined broadly: any information that can identify a natural person, directly or indirectly. This explicitly includes business email addresses (because they typically contain a name and identify an individual), titles, company affiliations, and even IP addresses in many cases.

The regulation replaced the 1995 EU Data Protection Directive with three structural changes that matter for outbound sales:

1. Extraterritorial scope. Unlike the 1995 directive, GDPR applies to any organization processing personal data of EU residents, regardless of where the organization is based. A US-based SDR emailing a German CTO is processing the German CTO's personal data; GDPR applies to that processing. The 2024 Schrems II ruling further tightened the rules around US-EU data transfers, making the jurisdictional reach explicit.

2. Lawful basis required for every processing activity. Pre-GDPR, opt-out was the default standard for most B2B email in many EU member states. Post-GDPR, every processing activity needs one of six lawful bases (covered in §03), and "we're a legitimate business so it's fine" is not one of them. The basis must be documented before processing begins, not retrofitted after a complaint.

3. Genuine fines. Pre-GDPR penalties for data-protection violations in most EU member states topped out at €500K-1M. GDPR raised the cap to €20M or 4% of global revenue, whichever is higher. Multiple companies have been fined €100M+. The threat is real and the regulators have an enforcement record.

02When it applies to you

The "does GDPR apply to my outbound campaign" question reduces to four sequential checks. If any answer is "yes," GDPR is in play:

The trap most US-based teams fall into is assuming Q1 doesn't apply because their CRM doesn't track recipient location. The regulator doesn't care whether you tracked it; they care whether the recipient was actually there. A German VP traveling to San Francisco when you happen to email them is probably still covered (they're an EU resident); a US VP at a US company who happens to be vacationing in Paris when you email them might be covered (depends on circumstances).

The operational implication: if your TAM includes any meaningful EU exposure, treat GDPR as applying by default to your full outbound program. Trying to selectively apply different rules to different segments creates more risk than just running the whole program to GDPR standards. The good news is GDPR-compliant outbound is basically just good outbound — signal-anchored, well-targeted, individually relevant — so the operational lift is small for teams already running quality outbound.

03The six lawful bases

GDPR Article 6 lists six lawful bases for processing personal data. You need at least one for every processing activity. For B2B outbound, only three are practically relevant:

For B2B outbound at scale, the dominant basis is legitimate interest — consent is impractical because you're contacting prospects who haven't opted in, and contract doesn't apply to net-new outreach. Legitimate interest is contested precisely because the test is judgment-based and subject to regulator interpretation; the next section covers what passes and what doesn't.

04Legitimate interest in operational depth

Article 6(1)(f) lays out the three-prong test. To rely on legitimate interest, you must show:

Prong 1: Purpose test. You have a legitimate interest that the processing serves. For B2B outbound: "we are seeking to identify and contact potential customers who may benefit from our product" is a recognized legitimate interest. Sales prospecting is explicitly named in GDPR Recital 47 as an example of a legitimate interest.

Prong 2: Necessity test. The processing is genuinely necessary to achieve the interest, and you can't reasonably achieve it through less intrusive means. For B2B outbound: you have to make a case that direct outreach is necessary (vs. inbound-only marketing, which is less intrusive). This is usually fine for B2B sales but requires articulation.

Prong 3: Balancing test. The data subject's rights and freedoms don't override your interest. This is the prong where most outbound campaigns fail. Considerations include: did the recipient reasonably expect to be contacted? Is the outreach relevant to their professional role? Is the volume proportionate? Did you make opt-out easy?

What the balancing test looks like in practice

Apply the test to two real cases:

Case A — Passes. A US-based SaaS data-warehouse vendor sends one personalized email to the VP of Data at a 500-person German fintech that just raised Series C funding. The email references the funding, references a specific operational challenge typical of post-Series-C data teams, and offers a 20-minute conversation. The VP's role makes them the obvious decision-maker; the company size and funding stage make them a plausible buyer; the message is individually relevant. Easy one-click unsubscribe; LIA documented; privacy notice linked. Defensible legitimate interest.

Case B — Fails. The same vendor sends a generic "want to learn about our data warehouse?" email to 5,000 EU recipients from a purchased list. Recipients include accountants, marketers, lawyers, and HR managers — not the obvious target persona. No personalization, no reference to the recipient's actual situation. The recipient could not reasonably have expected this outreach. The volume is disproportionate to the interest. Fails the balancing test; not defensible under legitimate interest.

The diagnostic question to internalize: could a regulator reading this campaign reasonably conclude that the recipient's rights were respected? If the answer involves "well, the volume was high but..." you've already lost the argument. Volume is itself evidence against the balancing test.

05The seven data-subject rights

Every individual whose personal data you process has seven rights under GDPR. Your outbound program must be able to honor each within statutory time limits (usually 30 days). The rights:

Two practical implications. First, every request triggers a 30-day clock. Process them centrally with logged response times — regulators investigating complaints check response times first. Second, the right to erasure creates a permanent suppression obligation. The deleted contact must stay deleted forever, even if their email later appears on a new list, even if a different team re-imports them. The suppression list is the artifact every GDPR-compliant outbound program needs.

06The fine structure (and enforcement reality)

GDPR has two fine tiers, and a third unofficial category — the "real" exposure most B2B teams actually face:

Two enforcement patterns to internalize:

Complaints drive enforcement. Regulators generally don't proactively scan for violations — they investigate when individuals file complaints. The path to a B2B outbound investigation usually runs: individual receives spammy cold email → individual files complaint with their national data-protection authority → DPA opens investigation → fines or cease-and-desist. The complaint-driven model means the worst-targeted, most-irritating outreach is what gets investigated. Quality outbound rarely triggers complaints.

Cross-border investigations are coordinated. The European Data Protection Board coordinates investigations across member states. A US-based company hit with a complaint in Germany may face a coordinated investigation that includes Austria, Belgium, and France if similar campaigns ran there. The geographic exposure compounds quickly.

The honest assessment: most B2B teams running well-targeted outbound at moderate volumes have low enforcement exposure. Most teams running purchased-list blasts at high volumes have high enforcement exposure. The gap between the two is mostly about quality of targeting, which is also the gap between effective and ineffective outbound. Compliance and effectiveness point the same direction.

07The operational checklist

What a GDPR-compliant B2B outbound program actually looks like, in concrete operational terms:

1. Maintain a Record of Processing Activities (RoPA). A single document listing every processing activity (e.g., "outbound prospecting"), the lawful basis, the data categories, the data sources, the retention period, and any data sharing. Required under Article 30. Regulators ask for this first in any investigation.
2. Conduct a Legitimate Interest Assessment per campaign type. One page documenting the three prongs (purpose, necessity, balancing). One LIA per campaign type, not per send. Re-review annually. The artifact that proves you actually did the legitimate-interest analysis.
3. Provide a privacy notice in every outbound email. Either a link in the email body ("we got your contact data from [source]; you can opt out here; full privacy notice at [link]") or a clear footer. Article 14 requires this when data wasn't collected directly from the data subject — which is the entire premise of outbound.
4. Implement one-click unsubscribe + 30-day deletion processing. Unsubscribe must work in one click (no form, no login). Deletion requests must be processed within 30 days of receipt. Both must be logged with timestamps so you can prove compliance if challenged.
5. Maintain a permanent suppression list. Anyone who has opted out, exercised right to erasure, or filed a complaint must never appear in your outbound again — across all systems, forever. Re-imports from any source must be cross-checked against the suppression list.
6. Sign Data Processing Agreements with every vendor that touches the data. Your enrichment provider, your sequencer, your CRM — each is a "processor" under GDPR and needs a signed DPA. Most reputable B2B vendors offer template DPAs; you have to actually sign them.
7. Designate someone responsible for GDPR. Doesn't have to be a formal DPO unless you meet the scale thresholds, but someone needs to own the program — review LIAs, handle data-subject requests, audit suppression list integrity. This is operational ownership, not just legal-on-paper.
8. Document everything. The single biggest predictor of regulatory outcomes isn't whether you got the compliance perfect — it's whether you can show you took it seriously. Documented LIAs, RoPAs, training records, vendor DPAs, and request response logs collectively demonstrate good-faith effort, which materially reduces fines even when violations are found.

08Common mistakes

09Related terms

GDPR is the most consequential compliance regime for B2B outbound but not the only one. To go deeper: