Legitimate interest is one of the six lawful bases for processing personal data under the GDPR (Article 6(1)(f)). Most B2B cold email in the EU and UK relies on it: a business has a genuine interest in offering something relevant to another business, and that interest is weighed against the person's rights.
The three-part test
- Purpose: is there a real, lawful interest? Offering a relevant product to someone in their professional role usually is.
- Necessity: is emailing this person necessary for it, and are you using only the data you need?
- Balance: would they reasonably expect it, and does their interest in privacy outweigh yours? Relevance to their job tips the balance.
Write the assessment down; it's your evidence if asked.
What it requires in practice
- Email people about things relevant to their role only.
- Tell them who you are and where you got their details, by your first email or soon after.
- Stop at once when they object, and keep them on a suppression list.
Country rules (such as PECR in the UK) can add requirements. This isn't legal advice.