B2B outreach law in the EU: the five rules that apply everywhere

A manufacturer looking for distributors in another EU country runs into two layers of law before the first message goes out. The General Data Protection Regulation (GDPR) governs any use of information about an identifiable person, including a buyer's name and work e-mail. The ePrivacy Directive (2002/58/EC) adds channel-specific rules for e-mail, fax, automated calls and, in most countries, telephone. The GDPR is the same everywhere; the ePrivacy rules are implemented by each country and differ, sometimes sharply.

Putting it simply: you may contact a company in another EU country about your products, but you must (1) have a lawful basis for using any personal data, (2) tell people where you got their details, (3) respect the national e-mail rule, which ranges from "opt-out for companies" to "consent for everyone", (4) stop the moment someone objects, and (5) be able to show all of this on paper.

The five rules below apply in every member state. The country articles in this section cover what changes at the border.

Rule 1: you need a lawful basis, and "legitimate interest" is the usual one

Whenever you process data about a person (a named purchasing manager, a sales director's address), Article 6 GDPR requires a lawful basis. For B2B prospecting the realistic basis is Article 6(1)(f), legitimate interest. Recital 47 says in terms that "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest".

That does not mean anything goes. Legitimate interest requires you to balance your interest (finding a distributor) against the reasonable expectations of the person. A purchasing manager at a wholesaler that already sells your product category can reasonably expect a relevant supplier enquiry. An accountant at the same company cannot. Write the reasoning down once and apply it to each list you build.

Generic mailboxes (info@, sales@, contact@) usually contain no personal data, so the GDPR layer is lighter there. The ePrivacy layer (Rule 3) still applies.

Rule 2: tell people where you got their data

Article 14 GDPR covers data you did not collect from the person: a name from a contract award notice, a website, a trade-fair catalogue. You must give the person the usual privacy information (who you are, why you hold the data, the source, their rights) within a reasonable period and at the latest within one month, and, if you use the data to contact them, at the latest at the first communication — whichever comes first; holding a list for months until you write is not allowed.

In practice: your first message carries a short notice and a link to a privacy page that names the source ("public contract award notices", "your company website"). Public availability does not remove the duty; it only changes what you have to say.

Rule 3: the ePrivacy e-mail rule, and why it splits the EU

Article 13(1) of the ePrivacy Directive prohibits e-mail (and fax and automated calling) for direct marketing without the prior consent of the subscriber or user. Article 13(5) then says that paragraph applies to subscribers who are natural persons, and that member states must "also ensure" that the legitimate interests of other subscribers, that is, companies, "are sufficiently protected". How that is done is left to national law.

That single sentence is why the map looks the way it does:

• Some countries decided that companies are protected by an opt-out: you may e-mail a corporate address until the company says no. The United Kingdom (which kept the rule after leaving the EU), Ireland and Sweden are in this group, with conditions.
• France lands in between: the regulator CNIL accepts prospecting of professionals on legitimate interest when the message relates to the person's role, with information and a right to object; generic company addresses are outside the personal-data rules altogether.
• Others extended the consent requirement to companies. Germany, the Netherlands, Italy and Denmark require prior consent for marketing e-mail regardless of who the recipient is.

Two parts of Article 13 apply everywhere without exception. You may never disguise or conceal the identity of the sender, and every message must carry a valid address to which the recipient can ask you to stop (Article 13(4)). The Court of Justice has also confirmed that "electronic mail" is read broadly: in Case C-102/20 it held that advertising displayed inside an e-mail inbox counts as electronic mail for direct marketing. Treat messaging platforms and website contact forms with the same caution. The existing-customer exception in Article 13(2) does not help with a distributor you have never sold to.

Rule 4: the right to object is absolute

Article 21(2) GDPR gives every person the right to object at any time to processing for direct marketing, and Article 21(3) says that once they object, the data "shall no longer be processed for such purposes". There is no balancing test and no exception. Article 21(4) requires the right to be brought explicitly to the person's attention, clearly and separately from other information, at the latest at the first communication.

For companies, the national ePrivacy opt-out performs the same job. In both cases the operational consequence is a suppression list: every objection is logged, and no address on it is ever contacted again, even by a colleague using a different tool.

Rule 5: keep records you could hand to a regulator

Article 5(2) GDPR makes you accountable: you must be able to demonstrate compliance, not just assert it. Article 30 requires records of processing activities; the exemption for organisations with fewer than 250 employees does not apply where processing is not occasional, and a prospecting programme is rarely occasional.

A workable minimum for a manufacturer:

• for each contact: source, date collected, legal basis, country rule applied;
• for each message: date, channel, the identity and opt-out text used;
• for each objection: date received, date actioned;
• the legitimate-interest reasoning for the campaign, dated.

Where contract award data fits

Public contract award notices, such as those published on TED, are an open source of evidence about which companies sell a given category in a given country. The company name, the contract and the buyer are not personal data, except where the winner is a sole trader whose trading name identifies a person. A named contact person inside a notice is personal data. Cresques keeps the company-level evidence and removes personal details from notices before storing them, so that what you see is the trail of who sells what, not a mailing list.

What this means for a manufacturer

• Decide the lawful basis and write it down before building a list. Legitimate interest covers relevant B2B prospecting; it does not cover unrelated roles.
• Build your first message so that it carries your identity, the source of the data and a one-step way to say stop. That satisfies Articles 13(4) ePrivacy, 14 and 21 GDPR in one footer.
• Check the national e-mail rule before sending anything. In Germany, the Netherlands, Italy and Denmark the answer for a cold e-mail is no; use a letter, a call where allowed, a trade fair or an inbound channel.
• Run one suppression list across the whole company.
• Keep the records. They are cheap to keep and expensive to reconstruct.