GDPR and B2B email: can you contact old leads?

Yes, as a rule you may contact old B2B leads by email on the basis of legitimate interest under Article 6(1)(f) of the GDPR, provided you carry out a documented balancing test, offer an easy way to opt out and target people in their professional role. That is the short version. Here is what actually applies.

Which legal basis applies to B2B email?

The GDPR requires a legal basis for all processing of personal data, and a work email address with a name counts as personal data. For B2B communication the two relevant bases are consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)).

Consent is rarely practical for leads that have sat still for a year. Legitimate interest is the basis most B2B companies lean on, and it is expressly recognized in Recital 47 of the GDPR, where direct marketing is named as an example of what may constitute a legitimate interest.

What is required for legitimate interest to hold?

Legitimate interest is not a free pass. Three conditions must be met, and you should be able to show that you tested them:

1. A real interest. Selling relevant services to companies is a legitimate business interest.
2. Necessity. The processing must be needed for the purpose. Emailing a decision maker requires that you process a name and email address, and that is enough.
3. The balancing test. Your interest must weigh heavier than the recipient's interest in not being contacted. Context matters a great deal here.

The balancing test is best documented in what is called a legitimate interests assessment (LIA). For old leads the balance is often favorable: the person previously showed interest, filled in a form or had a dialogue with you. That is something entirely different from a scraped list of unknown addresses.

What is the difference between B2B and B2C?

The difference is significant. Marketing to consumers by email generally requires consent under the applicable marketing rules. For contact with people in their professional role, where the content is relevant to that role, there is more room and legitimate interest is an established basis.

Note that the line is drawn at the role, not the address format. An email to a head of sales about sales tools targets the professional role. The same email to the same person about a personal loan does not.

How should opt out be handled?

The right to object to direct marketing under Article 21 is absolute. In practice that means:

• Every send must contain an easy way to decline further contact.
• An objection must be respected immediately and without counter-questions.
• The person must be added to an internal suppression list so they are not contacted again, even if the data turns up in a new list later.

Sloppiness here is what most often trips companies up, not the send itself.

What applies when you outsource the sends?

If you engage an external party that processes your leads on your behalf, for example an agency or an AI service, that party becomes a data processor and you remain the data controller. Then Article 28 requires a data processing agreement (DPA) that governs what the processor may do with the data, the security measures and what happens at the end of the contract. Serious vendors have a standard agreement ready; always ask for it before any data leaves your CRM. Revexa, for example, always works under a DPA when Leo processes a customer's lead data.

Who supervises this?

Each country has a supervisory authority responsible for the GDPR, and that is where complaints from data subjects go. These authorities publish guidance on legitimate interest and direct marketing. Having your balancing test and your opt-out handling documented is the best protection the day a question comes.

Common questions

Can you email a lead that is two years old?

There is no fixed time limit in the GDPR. The older the relationship, the weaker the balance, so weigh in how the contact arose and how relevant your matter is to the person's role today.

Is consent required for B2B email?

No, not as a rule. Legitimate interest under Article 6(1)(f) is an established basis for relevant B2B communication to professional roles, provided you have a documented balance and a working opt out.

What happens if someone objects to a send?

You must stop contacting the person for marketing purposes, immediately and permanently. The right to object to direct marketing is without exception.

This is an informative overview, not legal advice. Check your specific situation with a lawyer before putting processes into operation.