GDPR legitimate interest

Also called: Legitimate interests, Article 6(1)(f).

GDPR Article 6(1)(f) allows processing that is necessary for your legitimate interests, unless the person's rights and interests override them. Recital 47 adds that processing for direct marketing "may be regarded as carried out for a legitimate interest." So B2B cold email can rely on it, but only with conditions.

You need a documented balancing test: what you want to do, why it's necessary, and why it's fair to the person (relevance to their job helps; high volume and irrelevant offers hurt). You must tell people where you got their data, at the latest when you first contact them. And Article 21 gives an absolute right to object to direct marketing: when someone says stop, you stop.

Legitimate interest covers the data protection side only. Email marketing is also governed by each country's electronic marketing rules. In the UK, PECR lets you email companies without consent but treats sole traders as individuals; Germany's unfair competition law requires prior consent for email advertising even to businesses. Check both layers.

A business email with a person's name in it is personal data. A generic info@ address of a company may not be, but treat it carefully anyway.

Example

A UK agency emails limited companies about local SEO. It records a balancing test, says in each email where it found the address, and suppresses anyone who objects, but it excludes sole traders unless they've consented.