UK GDPR and Legitimate Interests: How to Prospect B2B Contacts Lawfully

A common myth is that UK GDPR bans cold outreach unless people have opted in. It doesn't. For most B2B prospecting, consent is neither required nor the most practical lawful basis. Instead, businesses rely on legitimate interests – but only if they can show they have thought it through.

This guide explains how legitimate interests works for B2B prospecting in the UK, what you need to document, and how it fits alongside the separate PECR rules for calls and emails. It is general information, not legal advice; the ICO publishes detailed guidance on both.

Why UK GDPR applies to B2B data

Company information on its own is not personal data. But as soon as your prospect list contains named individuals – Sarah Jones, Finance Director, sarah.jones@example.co.uk – UK GDPR applies. So does the Data Protection Act 2018. That means you need a lawful basis for using the data, you must be transparent about it, and the individual has rights over it.

Legitimate interests: the three-part test

Article 6(1)(f) of UK GDPR allows processing that is necessary for your legitimate interests, unless those interests are overridden by the individual's interests, rights and freedoms. In practice the ICO expects you to work through three questions, known as a legitimate interests assessment (LIA):

1. Purpose: is there a legitimate interest? Promoting your products or services to businesses that could use them is a commercial interest the law recognises.
2. Necessity: do you need this data to achieve it? Contacting the head of facilities about a facilities service is necessary; collecting their date of birth is not.
3. Balancing: would the person reasonably expect to be contacted, and is any impact on them justified? A relevant approach to someone in their professional role usually passes. Repeated contact after they have objected, or approaching people with no plausible link to your offer, does not.

Write the assessment down. A one- or two-page LIA per campaign type is normally enough, and it is the first thing you will be asked for if a prospect complains.

What changed with the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 writes into the body of UK GDPR that direct marketing is an example of processing that may be carried out for legitimate interests – something previously only mentioned in the recitals. That is a helpful clarification, but it does not remove the balancing test. Direct marketing is not one of the new “recognised legitimate interests” that skip the balancing step, so you still need an LIA.

Tell people what you are doing

If you collect someone's details from a third party – a data provider, a website, Companies House – Article 14 requires you to give them privacy information. When you use the data to contact them, that must happen at the latest at the first communication, and in any case within a month of obtaining it.

In practice, B2B teams handle this by:

• adding a short privacy line and a link to their privacy notice in the first email;
• briefing callers to explain where the details came from if asked, and offering to send the privacy notice;
• making sure the privacy notice names the data sources and explains how to object.

The right to object is absolute

When someone objects to direct marketing, you must stop – no balancing, no exceptions. Keep a minimal suppression record (for example name, company and email address) so you can make sure they are not contacted again, including by agencies working on your behalf.

Where PECR fits in

UK GDPR decides whether you may use the data. PECR decides whether you may use a particular channel. You need to satisfy both:

• Calls: live B2B calls are allowed without consent, provided the number has been screened against the TPS and Corporate TPS – see our guide to Corporate TPS and cold calling rules.
• Emails: PECR consent rules don't apply to emails sent to corporate subscribers, but they do apply to sole traders and most partnerships.

Good data habits that keep you on the right side

• Only target roles that plausibly buy what you sell.
• Collect the minimum: name, role, company and business contact details are usually enough.
• Set a retention period and delete prospects who never engage.
• Do due diligence on data suppliers – ask how the data was collected and what people were told.
• Make sure your organisation has paid the ICO data protection fee if it is required to.
• Put a data processing agreement in place with any agency that handles your prospect data.

Prefer to outsource your prospecting? Our appointment setting services are delivered within UK GDPR and PECR, and we are happy to talk through how data is handled before a campaign starts.