Does legitimate interest automatically permit cold email?

No. It may be an available lawful basis for particular processing, but the sender must assess purpose, necessity, the person’s interests and expectations, safeguards, and applicable electronic-marketing rules.

What should a legitimate-interest assessment contain?

Record the commercial purpose, why the processing is necessary, the data and audience used, the expected impact, safeguards, transparency plan, objection route, and the conclusion with its date and owner.

Is a business email address always safe to use?

No. A named work address can still be personal data, and a business address can belong to an individual or sole trader. Relevance, context, source, jurisdiction, and the message all matter.

Legitimate Interest and Cold Email: Questions to Ask

Legitimate interest is not a permission slip. It is a documented question: is this particular processing necessary for a legitimate purpose, and are the person’s interests, rights, and reasonable expectations outweighed by that purpose? For cold email, the answer depends on the facts, the recipient, the data source, the message, and the jurisdiction.

This article is an educational framework, not legal advice. GDPR, UK GDPR, PECR, and other local rules can interact differently. If a campaign targets people in a regulated sector, uses third-party data, or relies on a difficult borderline judgment, ask qualified counsel to review the assessment.

Start with the three-part assessment

A useful legitimate-interest assessment has three connected parts.

1. Identify the purpose

State the purpose narrowly. “Grow revenue” is too broad to test. “Contact operations leaders at mid-sized logistics companies about a service that addresses the routing problem described on their company site” is more specific. A narrow purpose makes it easier to decide whether the person and message are relevant, what data is necessary, and when the campaign should stop.

The legitimate interest can belong to the sender or a third party, but the statement should name whose interest is being pursued and how direct marketing relates to it. The GDPR text on EUR-Lex is the primary source for lawful bases, transparency, objections, and accountability. GDPR’s recital on direct marketing recognizes that it may be a legitimate interest, but that does not remove the rest of the assessment.

2. Test necessity

Ask whether the proposed processing is actually needed for that purpose. List the data fields used: work email, name, job title, company, public role information, or something else. Then ask whether each field changes the decision to contact or the relevance of the message. If a field is not needed, do not collect or use it merely because it is available.

Necessity also covers the audience. A tightly defined role at a company that plausibly needs the service is easier to explain than a broad scrape of every employee. A personal address, a generic address with no professional context, or an unrelated role may make the outreach unnecessarily intrusive. “It was technically possible to find the address” is not a necessity analysis.

3. Balance interests and expectations

Consider what the person would reasonably expect. Was the address published in a professional context? Is the message about that person’s role rather than a personal interest? Is the source clear and reputable? Would the recipient be surprised by the use, or by the level of personalization? What happens if the person does not want further contact?

Document risks as well as benefits. Consider frequency, data freshness, sensitive inferences, profiling, the possibility of misidentification, and whether the content could feel coercive. Add safeguards: minimize fields, segment carefully, keep the message honest, explain identity and relevance, limit follow-ups, provide a simple objection path, and stop promptly when someone objects.

Transparency and objections are part of the design

A lawful basis does not make data provenance optional. If personal data came from a source other than the person, review the applicable transparency requirements and be prepared to explain the source or category of source. Do not claim that a public page equals unrestricted permission. Public availability can help explain context, but it is not a universal opt-in.

The European Commission’s guidance on third-party data for marketing is a useful first-party reference. UK teams should also read the ICO’s direct-marketing guidance, including its treatment of objections and electronic marketing.

When a person objects to direct marketing, do not ask them to persuade you that the objection is valid. Route the request into a suppression workflow. The right to object guidance from the ICO explains the operational importance of stopping direct marketing after an objection. See the unsubscribe requirements checklist for implementation details.

Where RepMail is relevant

RepMail can help operationalize a sending process, but no sending platform can decide whether your purpose is legitimate, whether your audience would reasonably expect the contact, or whether a data source is appropriate. Keep the assessment with the campaign owner, link it to the audience definition, and verify how the platform handles opt-outs before relying on it. The recordkeeping guide shows a practical evidence model.

Sources

This page is educational information, not legal advice.

Final takeaway

A defensible legitimate-interest decision is specific, written, proportionate, and revisited when the audience or message changes. If you cannot explain the purpose, necessity, expectations, safeguards, and objection path in plain language, pause the campaign rather than treating the label as an answer.