Most B2B outbound in the EU and UK operates under the legitimate interest legal basis (GDPR Art. 6(1)(f)). Used correctly, it lets you identify business visitors and email decision-makers without prior consent. Used carelessly, it becomes the thing your data protection officer points at when explaining the fine. This guide covers the framework. It is general information, not legal advice.
What legitimate interest actually is
Legitimate interest is one of six legal bases in GDPR for processing personal data. It lets you process data when: (1) you have a genuine legitimate purpose, (2) the processing is necessary to achieve that purpose, and (3) the individual's rights and interests do not override yours.
Related: Intent Data for Small B2B Sales Teams: Prioritize Outbound
Why it fits B2B outbound
- The purpose — proposing a business relationship to a professional — is recognized as legitimate.
- The data processed is professional contact information, not sensitive personal data.
- The individual is reachable in a professional capacity, not a private one.
- Recital 47 of GDPR explicitly mentions direct marketing as a potentially legitimate interest.
The three-step test you must document
- Purpose test: Is your purpose legitimate? (B2B outreach to professionals about a business product — yes.)
- Necessity test: Is the processing necessary, or could you reasonably achieve the same outcome another way?
- Balancing test: Do the data subject's rights and interests override yours? Consider: do they reasonably expect this contact, is it disruptive to their private life, what's the intrusiveness level?
Related: AI Outbound platform
Writing a legitimate interest assessment (LIA)
An LIA doesn't need to be a legal epic. A single page covering purpose + necessity + balancing, signed by a senior stakeholder, dated, and kept in your compliance folder is enough for most B2B outbound motions. Update it when your processing changes materially.
Seven operational requirements
- Clear privacy notice on your website.
- Working, one-click unsubscribe in every email.
- Global suppression list — opt-outs applied across all sequences.
- Easy-to-find opt-out page for data subjects who never received an email from you.
- Data subject access request (DSAR) process.
- DPA with every vendor who processes your outbound data.
- Retention policy — don't keep contacts indefinitely without a purpose.
Where legitimate interest fails
- Consumer (B2C) contact data. Consent is required.
- Sensitive categories (health, political, sexual orientation) — not applicable anyway in B2B.
- Sole-trader personal email with domain matching their name (e.g.
firstname@firstname.com) — treat with more care, often closer to consumer. - High-volume untargeted blasts — the balancing test fails when your practice looks like spam.
- Germany. The German interpretation is often stricter; consult local counsel.
Happierleads' role in your legitimate-interest posture
- We process data as your processor under a DPA.
- We maintain a public opt-out page — any data subject can request removal from the 175M graph at the source.
- We run an 8-provider waterfall verification so you're not emailing bounces.
- We run LinkedIn real-time checks so you're not emailing people who've moved on. LinkedIn RTV.
- Global suppression list that persists across your workspaces.
Red lines you can't cross
- Never email someone who opted out — ever, on any channel, under any brand.
- Never hide your identity or sender domain.
- Never claim consent you don't have.
- Never re-enrol a DSAR subject.
