Sending Emails to Companies and GDPR: A Complete Guide for 2026

Introduction: The Rules of the Game You Need to Know

If you are sending emails to companies — whether cold emails, offers, or follow-ups — you are working with personal data. And that means GDPR applies to you.

The first article in this series explained the basic principle: B2B cold emailing is not prohibited, but it has rules. This article goes deeper. It will show you what a complete GDPR-compliant outreach process looks like — from data collection, through sending emails, to processing responses and deleting data.

Note: This article is an informative overview, not legal advice. For specific legal situations, consult a professional.

1. Where You Can Source Company Contact Information

Not all data sources are equal from a GDPR perspective. Where the contacts come from matters.

Publicly Available Sources — Low Risk:

Business registers (Handelsregister, KRS, CEIDG, Firmenbuch, FinStat). Company websites (contact page, impressum). Professional profiles (LinkedIn — publicly displayed data). Databases of chambers of commerce (WKO, IHK). Extracts from public registers.

These sources are public by definition — companies publish them voluntarily or due to legal obligations. Processing this data based on legitimate interest is justified in most cases.

Aggregated Databases — Medium Risk:

Platforms that collect and verify data from multiple public sources. DataSend.ai for example, draws from business registers, public sources, and company websites in 7 countries. The data is verified for deliverability and currency.

When choosing a database, ensure that the provider can demonstrate the legitimate origin of the data and has a transparent personal data processing policy.

Doubtful Sources — High Risk:

Purchased lists from unknown sources. Scraped personal profiles without public context. Databases obtained from data breaches. Contacts from sources where the provider cannot prove the origin.

You should not use these sources — not only due to GDPR but also due to data quality (high bounce rate, low relevance).

2. What Data You Can Process and For What Purpose

GDPR requires that you only process data that you actually need for the given purpose (data minimization principle).

For B2B outreach, you typically need:

Name of the contact person. Position/role in the company. Company email. Company name. Industry and region (for personalization).

You do not need (and should not collect):

Personal phone numbers (private, not business). Personal email addresses. Data about the individual's private life. Any data that is not related to the professional context.

The purpose of processing must be clear: You are contacting the person to offer a relevant B2B service in their professional capacity. Not for the purpose of marketing consumer products, not for profiling, and not for selling data to third parties.

3. How to Document Legitimate Interest

GDPR does not require you to report or register legitimate interest anywhere. It requires that you can demonstrate it — if someone asks.

Simple documentation of legitimate interest:

Write down:

Who you are and what you offer. "We are a marketing agency specializing in Google Ads for e-shops."

Who you are contacting and why. "We are contacting marketing managers and owners of e-shops with a turnover above €100,000 because our service is directly relevant to them."

Where you got the data. "The contact details come from the platform DataSend.ai, which draws from publicly available sources and business registers."

How you protect the rights of recipients. "Every email contains our contact details and an option to refuse further communication. We process deletion requests immediately."

This does not need to be a legal document. An internal record showing that you have thought about legitimate interest and comply with the rules is sufficient.

4. Rules for Email Campaigns

Once you have data from a legitimate source and documented legitimate interest, the campaign itself must meet several conditions:

Personalization and Relevance.

The email must be relevant to the recipient. Not the same message for everyone, but a message that shows you know who you are writing to and why. AI personalization in DataSend.ai — variables such as industry, city, and company website — helps ensure that each email is contextual and relevant.

Sender Identification.

The recipient must know who is writing to them. Your name, company, and contact details must be in the email. No anonymous addresses.

Option to Refuse.

The recipient must have an easy way to stop communication. In a cold email, this usually means the option to reply "not interested" or a short sentence at the end of the email: "If you do not wish for me to contact you, let me know and I will respect that immediately."

Volume and Frequency.

GDPR does not directly regulate how many emails you can send. But excessive volume (sending the same email to the same company every week after they have not responded) can be considered harassment. A reasonable approach: 3-5 emails in a sequence spaced a few days apart. If they do not respond after the entire sequence, stop.

5. What to Do with Responses (Positive and Negative)

Each response requires a different reaction from a GDPR perspective:

"Yes, send the offer." You have interest — continue communication. Legitimate interest is confirmed by the response itself.

"Not interested." Stop communication. The contact remains in the database but is excluded from future campaigns.

"Not interested, delete my data." Stop communication and delete the contact from the database (or anonymize it). Confirm the deletion.

"How did you get my data?" Respond transparently: "Your contact details come from publicly available sources / from a database that draws from business registers and public sources. If you do not wish to be contacted, I will respect that immediately."

In DataSend.ai Unibox automatically categorizes responses — including "Not Interested" and "Blacklist." Contacts with refusals are automatically excluded from future campaigns, eliminating the risk of re-contacting someone who has declined.

6. Data Retention: How Long You Can Keep Contacts

GDPR requires that you only retain personal data as long as necessary for the given purpose (data retention limitation principle).

For B2B outreach, this means:

If you have contacted a company and they did not respond — retaining the contact for further outreach is justified for a reasonable period. What is "reasonable"? There is no exact legal limit, but a reasonable practice is 6-12 months from the last contact.

If the company explicitly declined communication — you must delete or anonymize the data immediately (or retain it solely for blacklist purposes — to avoid contacting them again).

If the company is in active communication or in the Pipeline — retention is justified for the duration of the business relationship.

7. What If You Operate in Multiple Countries

If you are contacting companies in Germany, Austria, Poland, Switzerland, the Czech Republic, Slovakia, or Hungary, you must consider that each country has its own implementation of the ePrivacy directive.

Practical Approach:

Follow the strictest standard (the German UWG is usually the strictest). Personalize emails — a relevant, personalized message complies with the rules in all countries. Identify yourself in every email. Respect refusals immediately. Document legitimate interest.

If you adhere to this, you are in a safe zone across Central Europe. DataSend.ai makes it easier for you to comply with these rules — AI personalization ensures relevance, AI Grammar Variables ensure correct grammar in 6 languages, automatic blacklisting ensures that rejected contacts are not re-contacted, and transparent data origin from public sources covers the requirement for legitimate source.

8. Summary: GDPR-Compliant Outreach in 10 Points

1. Use data from publicly available and legitimate sources.

2. Process only the data you really need.

3. Document your legitimate interest.

4. Personalize emails — generic spam is not legitimate interest.

5. Identify yourself in every email.

6. Provide an easy way to refuse.

7. Respect refusals immediately.

8. Delete data when someone requests it.

9. Do not retain data longer than necessary.

10. Follow the strictest standard if operating in multiple countries.

Conclusion: GDPR is Not a Problem — It is a Quality Standard

Companies that comply with GDPR do not send spam. They send relevant, personalized messages to people who could benefit from their services. They respect refusals. And they protect data.

This is not a limitation — it is exactly what makes good outreach.

Want to reach out to companies in compliance with GDPR? DataSend.ai — data from public sources, AI personalization, automatic blacklisting, transparent data origin. Database, campaigns, and pipeline all in one place.

Try it for free →