When is a business address personal data?
Personal data is any information about an identified or identifiable natural person (Article 4(1)). A general company address such as info@company.com usually identifies a company, not a person. An address with a person's name in it is personal data, and so is any address of a sole trader or one-person business, because that business is a person. Being published on a website does not change this: public personal data is still personal data.
Your lawful basis: legitimate interest
Processing personal data needs a lawful basis (Article 6). For business-to-business prospecting the usual one is legitimate interest (Article 6(1)(f)), and Recital 47 says direct marketing may be regarded as carried out for a legitimate interest. It is not automatic: you must be able to show a real interest, that contacting the person is necessary for it, and that it is not outweighed by their interests and expectations. Writing that assessment down is how you show it.
What to tell the people you email
When you did not get the details from the person directly, Article 14 lists what they must be told: who you are and how to reach you, the purpose and legal basis, the categories of data, the source it came from and whether that source is public, how long you keep it, and their rights. If you use the data to contact the person, this is due at the latest in your first message (Article 14(3)(b)). Their right to object must be pointed out explicitly and separately from other information (Article 21(4)).
When someone says stop
Anyone may object to direct marketing at any time, and you must then stop using their data for it (Article 21(2) and (3)). There is no balancing test here: the objection always wins. Keep a do-not-contact list, so an address that has objected is not emailed again when it turns up in a later list.
The email rules differ by country
The GDPR is not the only law. Marketing email is also governed by the ePrivacy Directive (2002/58/EC), as each country has written it into national law. Its Article 13 requires prior consent for marketing email to subscribers who are natural persons, apart from existing customers, and leaves each country to decide how companies are protected. So the rule for emailing a business depends on the country, and the two laws work together: German regulators, for instance, say that where the email rules forbid a channel, there is no legitimate interest for it either.
| Country | Emailing businesses | Official source |
|---|---|---|
| Netherlands | Prior consent needed, businesses included, apart from existing customers.Autoriteit Persoonsgegevens | Autoriteit Persoonsgegevens |
| Germany | Prior express consent needed from every recipient, businesses included, apart from existing customers.UWG § 7 | UWG § 7 |
| France | Professionals may be emailed about their profession if they are informed and can object; private individuals need prior consent. Generic company addresses such as contact@ fall outside these rules.CNIL | CNIL |
| Spain | Prior request or express authorisation needed, businesses included, apart from existing customers.LSSI, art. 21 | LSSI, art. 21 |
| Italy | Prior consent needed, companies included.Garante privacy (2013) | Garante privacy (2013) |
| Portugal | Companies may be emailed until they object or join the national opt-out list; individuals need prior consent.ANACOM | ANACOM |
| Türkiye | No prior consent needed for merchants and tradespeople, but they can refuse; senders must register the addresses in İYS and check it for refusals before sending.T.C. Ticaret Bakanlığı | T.C. Ticaret Bakanlığı |
| United Kingdom | Companies may be emailed without consent if you identify yourself and offer an opt-out; sole traders and some partnerships need consent. The ICO says this guidance is under review.ICO | ICO |
| United States | No prior consent needed, business email included; messages need accurate headers, a postal address and an opt-out honoured within ten business days.FTC (CAN-SPAM) | FTC (CAN-SPAM) |
Checked against each official page on 23 September 2026. Rules change, and this guide covers email only; read the linked page before a campaign.
Before you send
- Check the email rule of each recipient's country in the table above.
- Prefer a company's general address; use a named address only where you have a reason to.
- Write down your legitimate-interest assessment for the campaign.
- In the first email, say who you are, where you got the address and how to object.
- Honour every objection at once and keep a do-not-contact list.
- Delete what you no longer need.
What DataFacilitator supplies
A search returns the contact details businesses publish about themselves, usually a company's general address. There is no search by person. Once you download a file you decide how it is used, so the rules above apply to you as the sender. Our privacy policy sets out our own part.