B2B prospecting and GDPR: what the CNIL expects

If you contact professionals by email, you process personal data: a name, a work email address and a job title are personal data, even in a business context. In France, two bodies of rules apply together: the GDPR for the processing of personal data, and the French rules on electronic marketing (article L. 34-5 of the Postal and Electronic Communications Code), supervised by the CNIL. This is how the CNIL presents the B2B case.

Legitimate interest instead of prior consent

For consumers, email prospecting generally requires prior consent. For professionals, the CNIL explains that no prior consent is needed: prospecting can rely on the organisation's legitimate interest, when the subject of the message is related to the profession of the person contacted.

Legitimate interest is not a free pass. Under the GDPR you should be able to explain why your interest is legitimate and why it does not override the rights of the person. In practice, keep a short written note of your reasoning (who you target, why, what data you use).

The message must be relevant to the person's job

This is the condition people forget. An offer for accounting software sent to a head of accounting is related to their profession; the same offer sent to a random employee, or an unrelated offer to anyone, is not. It is the reason a narrow, well-chosen target is both better marketing and safer compliance.

• Choose contacts by job function, not by mass.
• Make the link between your offer and their role explicit in the message.
• The CNIL notes that generic addresses of a company, such as info@ or contact@, concern legal entities and are not subject to these principles. Personal professional addresses are.

Inform the people you contact

People must have been informed that their email address or phone number may be used for prospecting, and be able to object. When you did not collect the data from the person yourself (a data provider, a public source), the GDPR also requires you to tell them where their data comes from. You must do so at the latest at your first message, and in any case within one month of obtaining the data. A short information line in the email, with a link to your privacy notice, covers it.

• Say who you are and which company sends the message.
• Say why you are contacting them and where you found their details.
• Link to a privacy notice that describes the purposes, the retention period and their rights.

Make opting out simple and free

The CNIL requires that objection be simple and free of charge, possible when the data is collected and at any time, in particular with every message. Every email should therefore contain a clear way to stop receiving them, such as an unsubscribe link or a reply address that you actually monitor.

• Honour requests quickly. Under the GDPR, the right to object to direct marketing is absolute: once someone objects, you must stop using their data for that purpose.
• Keep a suppression list with the minimum data needed (the address) so that a person who opted out is not contacted again, including from a new import.
• Treat a reply such as "remove me" as an opt-out, even if it does not use the unsubscribe link.

Good habits that reduce risk

• Minimise data: collect only what you need to send a relevant message.
• Limit retention: define how long you keep contacts who never answered, and delete after that.
• Document your sources: know where each contact came from and when.
• Check purchased or provided lists: you remain responsible for having a lawful basis for the people you contact.
• Answer data subject requests (access, deletion, objection) within the legal deadlines.
• Check local rules if you prospect abroad: some countries require prior consent even for B2B email.

What a tool can and cannot do

Software can help you apply these rules: unsubscribe links, a suppression list checked before every send, data export and deletion, a data processing agreement. It cannot decide for you whether your targeting is relevant or whether your legal basis holds. That responsibility stays with you as the sender.

In Outbly, a one-click unsubscribe header and a suppression list are checked before every send, data export and account deletion are available, and a data processing agreement can be signed. You still need to choose relevant targets and write a transparent message. For the practical side of a first campaign, read how to start B2B outbound; to check your results, see measuring a campaign.