Is B2B appointment setting legal under GDPR? Sweden 2026

Yes, B2B appointment setting is generally legal in Sweden. GDPR requires a lawful basis, usually legitimate interest backed by a documented balancing test, telling people who you are and where you got their data within one month and no later than the first contact (Article 14), and stopping as soon as someone objects (Article 21). Sweden's Marketing Practices Act requires prior consent for email and SMS to natural persons, sole traders included (section 19), and bans calls to people who have clearly said no (section 21), for example by registering a private number in the NIX opt-out register.

Checked on 15 October 2026 against Swedish law and guidance from IMY (the data protection authority) and Konsumentverket (the Consumer Agency). Quotes from Swedish sources are our translations. This is not legal advice.

Prices: what meeting booking costs. Email rules: is cold email legal in Sweden.

Two laws: GDPR and the Marketing Practices Act

A name, direct number or work email is personal data, so GDPR applies once you contact a named person. The Marketing Practices Act (marknadsföringslagen) governs the channels, and a call to book a sales meeting counts as marketing (section 3).

GDPR. IMY writes: "Processing of personal data for direct marketing may be regarded as a legitimate interest. You must always stop direct marketing if the data subject objects to the processing." The balancing test must weigh "what the data subject can reasonably expect", and IMY advises: "Always document your assessment." Three duties follow from GDPR:

1. Information. Tell people who you are, why you are contacting them and where you got their data, "at the latest at the time of the first communication" and never later than one month after you obtained it (Articles 14(1), 14(2)(f) and 14(3)).
2. The right to object "shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information" (Article 21(4)).
3. Stop. After an objection, "the personal data shall no longer be processed for such purposes" (Article 21(3)). IMY calls the right "absolute" (IMY).

The Marketing Practices Act. The act separates natural from legal persons, and calls from written messages:

Can you cold call businesses in Sweden to book meetings?

Yes. Section 21: "A trader may use methods of individual distance communication other than those referred to in section 19 unless the natural person has clearly objected to the method being used." The preparatory works say it mainly covers "telephone calls from one person to another" (Government Bill 2003/04:43). Four things decide whether a call holds up:

• A no is a no. Do not call someone who said no again (section 21). GDPR's stop covers all direct marketing to that person, not just calls (Article 21(3)).
• NIX covers private numbers. A consumer who registered their number in NIX-Telefon "is considered to have objected to telephone marketing to that number", the appeal court held (PMÖ 10737-16). NIX covers "consumers and sole traders" (NIX rules) but not "company numbers and subscriptions registered to companies" (NIX). Check sole traders' private numbers against NIX, as Konsumentverket advises for consumer calls; a check is valid for two months.
• Say who you are and who you call for. Sellers who phoned businesses claiming to represent the directory company Eniro misled them; the Market Court ordered the seller "to clearly inform" that it was the sender, under a SEK 750,000 conditional fine (MD 2010:17). GDPR also requires telling people who the controller is (Article 14(1)(a)), which is the client when the agency is a processor (our reading).
• Automated calls need consent from natural persons. Section 19 covers "automatic calling machines or other similar automated systems for individual communication that are not operated by a person". In our reading, an AI voice calling without a human running the conversation is such a system.

Watch the inquiry. By 15 January 2027 a government inquiry will report on prior consent or a ban for "telephone sales to consumers made on the trader's initiative" (HR2026/01525); Konsumentverket has proposed "a comprehensive ban on telephone sales". The effect on sole traders is unclear.

Email, SMS and LinkedIn

• Email to a limited company needs no consent, but every email needs "a valid address" for opting out (section 20). Sole traders need consent, as the preparatory works protect "consumers and natural persons who are traders". For named employees there are only industry rules (SWEDMA).
• SMS is electronic mail: the term "according to recital 40 expressly covers SMS messages" (Government Bill 2003/04:43), so the email rules apply.
• LinkedIn: we found no Swedish guidance. The act's definition of electronic mail is technology-neutral (section 3), so a private LinkedIn message can be covered (our assessment). Denmark and the UK treat private social media messages as electronic mail; see cold email laws by country.

Can an appointment-setting agency record calls?

Yes, if it follows GDPR. Sweden's Penal Code only bans secretly recording a conversation the recorder "does not take part in" (chapter 4, section 9 a, riksdagen.se), and the caller takes part. But "image and sound recordings can also count as personal data, if you can see or hear who it concerns" (IMY), so a recording needs a lawful basis and information when it is made (Article 13).

IMY, then called Datainspektionen, tested this in 2016: coaching staff was a legitimate interest, but Telia told callers too little, so the interest did not prevail. "Telia and Tele2 must either stop recording customer calls or inform customers better" (IMY). It applied the pre-GDPR Personal Data Act; GDPR sets the same two requirements in Articles 6 and 13 (our reading).

How to inform: "where the first point of contact with a data subject is by telephone, this information could be provided during the telephone call", with the rest by email or link (EU transparency guidelines). Say at the start that the call is recorded, why, and for how long.

Recordings must be secured too: in 2021 IMY fined the processor Voice Integrate SEK 650,000 after recorded calls to Sweden's 1177 health line sat open online (IMY).

Conversation intelligence. Transcripts and AI analysis use the same personal data, so the same rules apply. Since 2 February 2025 the AI Act has banned AI systems "to infer emotions of a natural person in the areas of workplace and education institutions", except for medical or safety reasons (Article 5(1)(f), EUR-Lex). The European Commission's example: a call centre tracking employees' emotions by voice "is prohibited"; tracking customers' emotions "is not prohibited by Article 5(1)(f)" (guidelines).

Agency or you: who is responsible?

Under GDPR the agency is normally your processor. A company hired "to handle marketing mailings on the client's behalf" is one of IMY's examples of a processor (IMY). That requires a written data processing agreement (Article 28(3) and 28(9)), and you remain the controller.

Own lists change that. The controller is "the one who decides for what purposes the data are to be processed and how the processing is to be carried out" (IMY), and a processor that itself determines the purposes and means of processing "shall be considered to be a controller in respect of that processing" (Article 28(10)).

Under the Marketing Practices Act you stay liable. "A trader thus cannot avoid or reduce its responsibility by commissioning someone else to carry out marketing activities", the appeal court wrote in the call-centre case (PMÖ 10737-16). A fee can also hit another trader that "has substantially contributed to the infringement" (section 29), which can include the agency.

Bought lists. You must tell people where you got their data (Article 14(2)(f)). The EU transparency guidelines: "The specific source of the data should be provided unless it is not possible to do so", otherwise at least the type of source. The closest EU case: in 2024 France's CNIL fined KASPR, a LinkedIn contact-data tool, €240,000, partly for lacking a legal basis and failing to inform people under Article 14 (EDPB).

Fines and real cases

We found no decision by IMY, the Consumer Ombudsman (KO) or the Patent and Market Court on B2B appointment setting itself. The closest:

Maximum penalties: a market disruption fee from SEK 10,000 up to 4% of turnover (sections 29 and 31), and under GDPR up to €20 million or 4% of worldwide annual turnover for breaching data subjects' rights (Article 83(5)).

Calling Denmark, Norway or Finland

Business calls are allowed there too, but the opt-out lists differ:

Automated calls need prior consent from natural persons in all four countries, and in Denmark from every recipient.

Checklist for in-house teams and agencies

1. Document the balancing test before the first call.
2. Check the legal form. Sole traders need consent for email and SMS, and a NIX check before calls.
3. Open every call with your name, your client, the purpose, your data source and the right to say no. Send the rest by email or link.
4. Keep one suppression list across channels: a no by phone also stops email and LinkedIn.
5. Put a valid opt-out address in every email and SMS.
6. Record only after telling people, and set retention and access.
7. Require a data processing agreement from the agency and your call-analysis vendor, plus answers on list sources, NIX checks and opt-outs.
8. No automated calls or AI voices to natural persons without consent.

Revexa, which publishes this guide, builds Leo, a buying-signal agent that does not make calls: it writes on LinkedIn and email, and in review mode you read every draft before it is sent. For phone-booked meetings it is the wrong choice.

Common questions

Is B2B appointment setting legal under GDPR?

Generally yes, in Sweden. It can rest on legitimate interest (Article 6(1)(f)) if you document the balancing test, tell people who you are and where you got their data within one month and no later than the first contact (Article 14), and stop at the first objection (Article 21).

Can you cold call businesses in Sweden?

Yes. Section 21 of the Marketing Practices Act allows calls with a human speaking unless the person has clearly said no, and a private number registered in NIX counts as a no. Automated calls to natural persons need prior consent.

Can an appointment-setting agency record sales calls?

Yes, if GDPR is followed. Swedish criminal law only bans secretly recording conversations you are not part of. The recording needs a lawful basis and, at the start of the call, information on purpose, retention and rights.

Do we need a data processing agreement with our appointment-setting agency?

Yes, when it contacts people on your behalf: IMY treats a company handling marketing mailings for a client as a processor, and Article 28 requires a written agreement. With its own lists, the agency can become a controller.