Outbound Glossary
Legitimate interest
The GDPR ground most B2B outbound relies on. It is not consent and not a loophole, it is a balance you have to be able to show.
Legitimate interest lets you process personal data where you have a real business reason, the processing is necessary for it, and that reason does not override the rights and reasonable expectations of the person. For reaching a decision maker about something close to their actual job, that case can often be made. The further the message sits from what they are responsible for, the harder it gets.
What makes it hold is the record. A written assessment of why you believe the balance falls your way, kept before the campaign rather than after a complaint, is the difference between a defensible position and an assertion. And it settles one question, not two: a lawful basis under GDPR does not override a national rule that requires consent before an unsolicited message is sent.
The three conditions the European Data Protection Board says all have to hold, and the line that closes the everyone-does-it argument, are quoted in cold email and GDPR in Europe.