# What is GDPR legitimate interest? · Leadraft

URL: https://leadraft.co/glossary/gdpr-legitimate-interest
Summary: GDPR legitimate interest is a lawful basis for processing personal data without consent, which can cover B2B direct marketing after a balancing test.

Glossary · Compliance · Last updated October 31, 2026

# GDPR legitimate interest

GDPR legitimate interest is a lawful basis for processing personal data without consent, which can cover B2B direct marketing after a balancing test.

**Also called:** Legitimate interests, Article 6(1)(f).

GDPR Article 6(1)(f) allows processing that is necessary for your legitimate interests, unless the person's rights and interests override them. Recital 47 adds that processing for direct marketing "may be regarded as carried out for a legitimate interest." So B2B cold email can rely on it, but only with conditions.

You need a documented balancing test: what you want to do, why it's necessary, and why it's fair to the person (relevance to their job helps; high volume and irrelevant offers hurt). You must tell people where you got their data, at the latest when you first contact them. And Article 21 gives an absolute right to object to direct marketing: when someone says stop, you stop.

Legitimate interest covers the data protection side only. Email marketing is also governed by each country's electronic marketing rules. In the UK, PECR lets you email companies without consent but treats sole traders as individuals; Germany's unfair competition law requires prior consent for email advertising even to businesses. Check both layers.

A business email with a person's name in it is personal data. A generic `info@` address of a company may not be, but treat it carefully anyway.

## Example

A UK agency emails limited companies about local SEO. It records a balancing test, says in each email where it found the address, and suppresses anyone who objects, but it excludes sole traders unless they've consented.

## Sources

1.  1.[GDPR Article 6 (lawfulness of processing)](https://gdpr-info.eu/art-6-gdpr/)
2.  2.[GDPR Recital 47 (legitimate interests, direct marketing)](https://gdpr-info.eu/recitals/no-47/)
3.  3.[GDPR Article 21 (right to object)](https://gdpr-info.eu/art-21-gdpr/)
4.  4.[ICO, Sending direct marketing: choosing your lawful basis](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/sending-direct-marketing-choosing-your-lawful-basis/)
5.  5.[ICO, Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/)

## Related terms

-   [CAN-SPAM ActThe CAN-SPAM Act is the US law for commercial email; it allows cold email without consent but requires honest headers, an address and a working opt-out.](https://leadraft.co/glossary/can-spam)
-   [CASLCASL is Canada's Anti-Spam Legislation, which requires consent before most commercial emails, including implied consent for published business addresses.](https://leadraft.co/glossary/casl)
-   [Suppression listA suppression list is a list of addresses or domains you must never email again, such as opt-outs, hard bounces and complaints, checked before every send.](https://leadraft.co/glossary/suppression-list)
-   [Cold emailCold email is a one-to-one business email to someone you have no prior relationship with, sent to start a conversation about a specific offer.](https://leadraft.co/glossary/cold-email)

## Further reading

-   [Cold email laws for B2B](https://leadraft.co/blog/cold-email-laws)
-   [Acceptable use policy](https://leadraft.co/acceptable-use)

## Every business on the map. Every email that works.

500 businesses and 50 checked emails a month, free. No card.

[Start free](https://app.leadraft.co/sign-up)

Last built: 2026-11-09