Buying a prospecting list does not transfer anything except the file. The permissions the seller claims to hold stay with the seller, and the obligations land on you the moment you start processing. This is a plain reading of what the regulation asks, not legal advice.
The short version
A work email address usually counts as personal data, so the rules apply. Consent the seller collected does not pass to you. If you rely on legitimate interests instead, you need a balancing exercise you could show someone. And because the data did not come from the person, Article 14 requires you to tell them where you got it, at the latest within one month.
A work address is still personal data
People assume B2B sits outside the rules. The test is whether the data identifies a living individual, and firstname.lastname@company.com plainly does. A generic mailbox such as info@ or sales@ is a weaker case, because it may identify no one in particular.
That distinction is worth applying when you buy a list, because the two kinds of address carry different risk and most sellers mix them together without saying so.
Consent does not come with the file
A seller saying their contacts opted in is describing a relationship between those people and the seller. Consent under the regulation has to be specific and informed, and nobody informed them about you.
This is why most B2B senders rely on legitimate interests instead. That route is available, and it is not a formality. It asks you to weigh your interest in contacting someone against their interest in being left alone, and to be able to produce that reasoning later. A relevant offer sent to somebody whose job makes them a plausible buyer sits very differently from a generic blast to a scraped file.
The part almost everyone skips: Article 14
When personal data comes from somewhere other than the person, the regulation attaches an information duty. Two parts of it matter for cold outreach.
Article 14(2)(f) requires you to say “from which source the personal data originate, and if applicable, whether it came from publicly accessible sources”. Article 14(3)(a) sets the timing: “within a reasonable period after obtaining the personal data, but at the latest within one month”.
In practice the only workable moment is the first email, because that is usually the only message a cold prospect opens. A line saying where you found them costs you one sentence and settles the obligation.
| Obligation | Where it comes from | What it looks like in a cold email |
|---|---|---|
| Name the source | Article 14(2)(f) | “I found your details on your company’s team page.” |
| Say who you are | Article 14(1)(a) | Real name, real company, working reply address |
| Give the purpose | Article 14(1)(c) | One sentence on why you are writing |
| Timing | Article 14(3)(a), within one month | Put it in the first message |
| Honour objections | Article 21 | Act on a reply asking you to stop, immediately and permanently |
Where the exceptions do and do not help
Article 14(5) lists situations where the duty falls away, including where the person already has the information, or where providing it would be impossible or take disproportionate effort. The disproportionate effort limb is the one people reach for, and it is aimed at cases such as archiving and research, with safeguards attached.
Sending a sales email is a case where contacting the person is the whole point. If you can reach them to sell, you can reach them to tell them where you got their address.
Questions worth asking the seller before you buy
Most of the risk in a bought list is visible before money changes hands, if you ask.
| Question | Why it matters |
|---|---|
| Where was each record collected, and when? | You have to name the source, so you need to know it |
| What lawful basis did you rely on? | Tells you whether consent is even being claimed |
| Is the file split by country? | National rules on unsolicited email differ across member states |
| Does it separate role addresses from named individuals? | Different risk, and different engagement |
| Can you show the collection notice people saw? | If there is no notice, there was no informed anything |
Frequently asked questions
Is cold email illegal in the EU?
No. The regulation does not ban unsolicited business email. It requires a lawful basis, transparency about where the data came from, and a working way to object. National rules on marketing messages apply on top and vary between member states.
Does GDPR apply if my company is outside the EU?
It can. The regulation reaches processing connected with offering goods or services to people in the EU, so location of the sender is not the deciding factor. Where you send matters more than where you sit.
Can I rely on legitimate interests for any prospect?
Only where the balance genuinely holds. A relevant offer to someone whose role makes them a plausible buyer is a different case from a scraped file sent the same message. The test is whether you could explain the reasoning.
What if someone asks how I got their address?
Answer precisely and immediately. If you cannot name the source, that is the real problem rather than the question. Keeping provenance with each record is what makes the answer possible.
Bottom line
A bought list moves the obligations onto you and brings none of the seller’s permissions with it. Keep the source for every record, choose a lawful basis you could defend out loud, and put the source line in the first email. If a seller cannot tell you where the data came from, no process on your side fixes that.
Related reading
- Google’s bulk sender rules: the technical thresholds that apply whatever your lawful basis is.
- B2B email verification: cleaning a sales list before you send.
- What a catch-all address is: why company domains behave differently.
