Master GDPR-compliant cold emailing: Learn legal frameworks, assess legitimate interests, and explore dos and don'ts. Get our free EU cold email best practices guide.
Even though the General Data Protection Regulation (GDPR) has set clear guidelines on processing the personal data of individuals, the realm of cold emailing still wanders in a gray area. The uncertainty about executing it correctly persists, with a fine line distinguishing GDPR-compliant cold emails from those risking penalties.
Unfortunately, specific cold email laws don't exist. What we have are data privacy laws and regulations that strictly prohibit spam and tightly control unsolicited emails. However, these regulations do leave some leeway for sales teams to operate and execute a lawful cold email strategy.
Explore more privacy compliance insights and best practices
In this piece, we aim to provide a comprehensive guide on how to conduct a legal cold email campaign. At the end, you can download a free guide on the dos and don'ts of cold emailing in the European Union.
The GDPR applies to your campaign if either:
It is important to note that the GDPR also applies to B2B cold emails, as long as they involve personal data that could identify the email recipients.
Cold emails are legal, but only if you do it under the constraints of the law.
When you send cold emails, you use people's personal data, so you need to follow GDPR rules. GDPR doesn't talk about cold emails directly, but its main rules still tell you what is okay and not okay to do in sales.
The tricky part is that you need to make judgments on the lawfulness of processing on a case-by-case basis. There is no simple answer about what is allowed in cold emailing.
The only answer is that it depends.
Cold email outreach and email marketing are not the same, and it comes down to whether someone has signed up for your emails.
A cold email means you're contacting someone new — someone you've never messaged before. You usually find their email online and decide to send them a message because you have something specific to offer them. These messages are somewhat personalized and tailored to the recipient to some degree.
Email marketing is different. It's not about personalization in the same way. These messages are sent out to many people at once, all of whom have chosen to receive updates or offers from you by subscribing to your list. Under the EU regulation, you need consent to send them such emails.
In the following paragraphs, we'll focus strictly on GDPR-compliant cold outreach.
To send a cold email that follows GDPR rules, you need to stick to these rules right from the start of selling something. If you mess up even one part of following these EU rules, everything that comes after that mistake won't be right either.
If you manage to keep your sales process spot-on with data protection, then your effort to reach out to people is legal. But if you slip up just once, the entire thing becomes illegal. It sounds harsh, but that's how it is.
Next, we're going to look at every step of the process, from finding potential customers to actually sending them the email.
The sales journey often kicks off with generating leads. However, before you even start collecting leads, you have to get ready to follow the basic rules of GDPR.
By incorporating these GDPR principles into your sales strategy from the start, you'll avoid a lot of legal troubles later on.
You need to generate leads by complying with the following rules:
This, obviously, bans spam email. In the long run, following these principles may also improve your email deliverability and open rate.
We know this sounds abstract, but we are about to get into the details.
Some people believe that generating leads usually doesn't follow GDPR rules. Although making it compliant can be challenging, it's doable. You just need to apply the following principles:.
If you generate leads by sending cold emails, you’ll likely need only the email address and possibly the personal name of the prospect.
In some cases, you may need other data, such as zip code, place of residence, job position, or other data. The point is to process the least amount of data you need to get in touch with your prospect, and nothing more than that.
If you've obtained a prospect's email address for sending a cold email, you're allowed to use that address solely for the cold email. You shouldn't use the same address to send newsletters or for targeting in social media tools like Facebook Lookalike Audience.
Often, you'll rely on a third-party CRM tool to keep track of prospects' personal information. It's expected that the SAAS provider will ensure data security, which is typically the case with popular CRMs.
However, if your company uses a custom-built tool, the responsibility to protect your data from leaks and breaches falls on you.
Storing personal data that you don’t need is a liability. There are no benefits, but there is a risk of leakage. When a prospect indicates they are not interested in your offer or they are not responsive, remove their data from your database. It is a good practice to clear your databases once a month.
Your legal basis is the gate to lawful processing. Without a legal basis, you must not process any personal data whatsoever.
Your legal basis could be:
Unfortunately, there is no simple answer to what your legal basis for processing will be in any given situation. You need to make judgments on a case-by-case basis. And you need to take responsibility for your own judgments.
All we can give you here is a framework of thinking for determining your legal basis.
First, evaluate if you can send emails based on legitimate interests. If that's not viable, then you should seek consent from your prospects.
The process of using personal data under the guise of legitimate interests starts with conducting a legitimate interests assessment.
You’ll need to conduct the purpose, necessity, and balancing tests.
What would that look like in practice? Before asking for consent, we will conduct a LIA first.
Sales are your purpose.
Answer the following questions:
In most cases related to cold emails, the answer to these questions may be negative. If that is the case with you, proceed with the balancing test.
Answer the following questions:
In many (but not all) cases, cold emails will pass the balance test as long as:
Essentially, if you obtain someone's email, you're allowed to reach out to them for business reasons, provided you don't blast them with mass emails and instead approach them as individuals.
Yet, it's key to use your discretion to ensure that your legitimate business interests don't infringe upon the rights and freedoms of the individual whose email you've collected. If you're unsure, it might be safer to ask for their consent first.
The last step involves sending out the emails and then crossing your fingers for a positive outcome.
There are two important things you have to ensure in your first email to the new prospect:
We understand that this is hard to grasp. Implementing abstract data protection principles is not an easy task if your job is to bring sales to your company.
That's why we created the GDPR-Compliant Email Dos and Donts Guide. You can download it in return for your contact information. That guide is a small part of a GDPR course focused on the sales that we have. If you like the guide, you'll love the course.
