GDPR legitimate interest

The GDPR allows personal data to be processed on one of six bases. Article 6(1)(f) covers processing necessary for the legitimate interests of the controller, unless those interests are overridden by the interests or rights of the person, and Recital 47 says direct marketing may be regarded as such an interest. B2B outreach in the EU usually relies on it, supported by a written balancing test.

Legitimate interest comes with duties. You must tell people where you got their data and how to object, and under Article 21 a person may object to direct marketing at any time, after which their data may no longer be used for it. Local e-marketing rules sit on top of the GDPR; in the UK, for example, the ICO says corporate subscribers can be emailed without prior consent, provided you identify yourself and give a valid opt-out address.

Sources: GDPR Article 6 (gdpr-info.eu) (gdpr-info.eu, checked oct 22, 2026); GDPR Recital 47 (gdpr-info.eu) (gdpr-info.eu, checked oct 22, 2026); GDPR Article 21 (gdpr-info.eu) (gdpr-info.eu, checked oct 22, 2026); ICO: business-to-business marketing (PECR) (ico.org.uk, checked oct 22, 2026).