ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Legitimate interests for B2B marketing is one of the most common lawful bases marketing teams rely on, and one of the most commonly misused. It can be a sound basis for contacting business people about relevant products and services, but only where you have done a proper balancing test, respect the rules that apply to the channel, and honor objections without argument.
This guide explains how legitimate interests works for business-to-business marketing under the GDPR, where the separate ePrivacy rules override it, how to treat sole traders and named individuals, and what records to keep so the decision stands up if a regulator or a complainant asks about it.
Article 6(1)(f) of the GDPR allows processing that is necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the individual, in particular where the individual is a child. Recital 47 says that processing for direct marketing purposes may be regarded as carried out for a legitimate interest. That recital is often quoted, but it is not a free pass: it says the interest may qualify, and you still have to show that the test is met.
Regulators describe a three-part test. First, is there a legitimate interest, meaning a real and lawful business purpose such as promoting your services to likely customers. Second, is the processing necessary for that purpose, meaning you could not reasonably achieve it with less data or in a less intrusive way. Third, does the balance favor you once you weigh the impact on the individual and their reasonable expectations. The UK Information Commissioner sets out the same structure in its legitimate interests guidance.
People sometimes assume that because they are writing to a business address, data protection rules fall away. They do not. A work email address such as a named person at a company is personal data about that person, and the GDPR applies to it. What changes in a business context is often the balance: a manager receiving a relevant offer for a tool used in their role has a different reasonable expectation from a consumer receiving unsolicited offers at home.
| Question | Points toward legitimate interests | Points away from it |
|---|---|---|
| Relevance | Offer clearly relates to the person’s role | Generic mass mailing to anyone on a list |
| Source of data | Provided by the person or published for business contact | Scraped, bought or of unclear origin |
| Expectation | Existing relationship or clear prior contact | No connection with the person |
| Intrusiveness | Low frequency, easy opt-out | Profiling, tracking or data enrichment behind the scenes |
| Data category | Name, job title, business email | Personal accounts, home details, special category data |
Free legitimate interests assessment
Can you rely on legitimate interests for this processing?
Check whether legitimate interests is available, set out the purpose, test necessity, weigh the impact on people from 25 scenarios and choose the safeguards that tip the balance. Built to GDPR Article 6(1)(f), free.
The GDPR lawful basis is only half of the analysis. Electronic marketing is also governed by the ePrivacy rules, implemented in national law. The ePrivacy Directive requires consent for unsolicited marketing by email, SMS and automated calls to subscribers who are natural persons, with a limited exception for existing customers. Member States decide how to treat legal persons, so the rules for emailing a company differ by country.
In the United Kingdom, the Privacy and Electronic Communications Regulations treat corporate subscribers, such as companies and limited liability partnerships, differently from individual subscribers such as sole traders and some partnerships. Marketing emails to corporate subscribers do not need prior consent under those regulations, but you must identify yourself, give a valid address for opt-outs and honor them. In other countries the position is different, and some require consent even for business contacts. Treat this as a country-by-country check and confirm it with local advice before any campaign. Telephone and postal marketing follow different rules again. Our guide comparing legitimate interests and consent shows when each is the better route.
A sole trader is an individual, even if they use a business name and address. In many countries that means the consumer-style rules apply, including the need for consent for electronic marketing. Check how you classify your list, and if you cannot tell, take the cautious route. Also be careful with role addresses and personal addresses: a generic sales address at a company is usually treated differently from a named person’s personal mailbox.
Document the test in a short legitimate interests assessment before the campaign starts. Record the purpose, why the data is needed, the data source, the expected audience, the likely reaction of recipients, the safeguards and the conclusion. Our article on a legitimate interests assessment example shows a completed record, and the guide to DPIA versus LIA explains when a fuller assessment is needed.
You must tell people what you are doing. Articles 13 and 14 require privacy information that includes the purposes, the lawful basis and, where you rely on legitimate interests, what those interests are. Where you obtained the data from another source, you generally must provide that information within a month, or at your first contact if that comes sooner. Mention the right to object clearly.
The right to object to direct marketing is absolute. Under Article 21(2) and (3), when someone objects to processing for direct marketing, you must stop, and you cannot argue that your interest overrides theirs. Build a suppression list and check every campaign against it. Our guide to the right to object under legitimate interests covers how to handle other types of objection, where a balancing exercise is still needed.
The mistakes are consistent. Teams rely on the recital and skip the assessment. They buy lists with no idea of the source. They combine business contacts with data from social networks and tracking to build detailed profiles the individual never expected. They ignore the channel rules and assume one lawful basis covers everything. They fail to update the privacy notice. And they treat an unsubscribe as a request to be processed when convenient, instead of at once. Reviewing a live campaign against this list often finds a problem or two.
Reforms in the United Kingdom introduce a list of recognised legitimate interests, for which the balancing test is not needed, but direct marketing is not on that list, so legitimate interests for B2B marketing still requires the full assessment. Read recognised legitimate interests for the detail and check the current commencement status before relying on any new rule. In short, legitimate interests for B2B marketing remains a test you must pass and record, not a default setting for every campaign you run.
Keep the assessment, the source records for each list, the privacy notice versions, the suppression list, the opt-out handling procedure and a log of any complaints. These items support the accountability principle, and they let you answer a regulator quickly. Review the assessment at least annually and whenever you change the audience, the channel or the data source. See legitimate interests examples for scenarios beyond marketing.
If you want to avoid building the assessment from scratch each time, the Legitimate Interests Assessment Report and Workbook provides a structured assessment with the three parts, a scoring approach and a workbook for recording outcomes. Whichever format you use, the assessment for legitimate interests for B2B marketing should be completed before the first message is sent, not written afterwards to justify it.
Sometimes. The GDPR allows it if the three-part test is met, but national ePrivacy rules may require consent for email, particularly to individual subscribers such as sole traders. Check the rules for each country you target.
Yes, if it identifies an individual, for example a named person at a company. A generic address such as an info mailbox is less clearly personal data, but the data attached to it may still be.
Yes. The right to object to direct marketing is absolute, so you must stop once someone objects, and you should add them to a suppression list so they are not contacted again.
The GDPR does not name the document, but you must be able to show that the test was met. A written assessment is the usual way to do that and is regarded as good practice by regulators.
You can, but you remain responsible for the lawfulness of using it. Check where the data came from, what individuals were told, whether the supplier can support the use and whether the channel rules allow your message.
September 30, 2026
