Outbound Glossary
GDPR
The EU rule for handling personal data. It governs whether you may hold and use someone's details, not whether you may send them the message.
The General Data Protection Regulation applies whenever you process personal data of people in the EU, and a work email address with a name attached is personal data. It sets out the grounds you may rely on, the information you owe people, and the rights they can exercise.
For B2B outbound the practical picture is narrower than the panic suggests, and also narrower than the reassurance suggests. Business contact data can often be processed under legitimate interest, which is a documented balancing exercise rather than a loophole. But clearing GDPR settles the data question only. Whether the message itself may be sent is decided by the ePrivacy rules as each country wrote them into national law, and those genuinely differ. None of this is legal advice, and it is the kind of thing worth having a lawyer confirm once for your own setup.
Which lawful basis applies to outbound, and what the separate ePrivacy rules add on top of it, is set out with the article text quoted in cold email and GDPR in Europe.