Even though the General Data Protection Regulation (GDPR) has set clear guidelines on processing the personal data of individuals, the realm of cold emailing still wanders in a gray area. The uncertainty about executing it correctly persists, with a fine line distinguishing GDPR-compliant cold emails from those risking penalties.
Unfortunately, specific cold email laws don't exist. What we have are data privacy laws and regulations that strictly prohibit spam and tightly control unsolicited emails. However, these regulations do leave some leeway for sales teams to operate and execute a lawful cold email strategy.
In this piece, we aim to provide a comprehensive guide on how to conduct a legal cold email campaign. At the end, you can download a free guide on the dos and don'ts of cold emailing in the European Union.
Does the EU GDPR Apply to Your Cold Email Campaign?
The GDPR applies to your campaign if either:
- You are based in the European Union, and EU law applies to you at all times.
- You operate from outside the EU, but you process the personal data of EU citizens.
It is important to note that the GDPR also applies to B2B cold emails, as long as they involve personal data that could identify the email recipients.
Legality of Cold Emails
Cold emails are legal, but only if you do it under the constraints of the law.
When you send cold emails, you use people's personal data, so you need to follow GDPR rules. GDPR doesn't talk about cold emails directly, but its main rules still tell you what is okay and not okay to do in sales.
The tricky part is that you need to make judgments on the lawfulness of processing on a case-by-case basis. There is no simple answer about what is allowed in cold emailing.
The only answer is that it depends.
Difference Between Cold Email Outreach and Email Marketing
Cold email outreach and email marketing are not the same, and it comes down to whether someone has signed up for your emails.
A cold email means you're contacting someone new — someone you've never messaged before. You usually find their email online and decide to send them a message because you have something specific to offer them. These messages are somewhat personalized and tailored to the recipient to some degree.
Email marketing is different. It's not about personalization in the same way. These messages are sent out to many people at once, all of whom have chosen to receive updates or offers from you by subscribing to your list. Under the EU regulation, you need consent to send them such emails.
In the following paragraphs, we'll focus strictly on GDPR-compliant cold outreach.
Sending Cold Emails Without Violating the GDPR
To send a cold email that follows GDPR rules, you need to stick to these rules right from the start of selling something. If you mess up even one part of following these EU rules, everything that comes after that mistake won't be right either.
If you manage to keep your sales process spot-on with data protection, then your effort to reach out to people is legal. But if you slip up just once, the entire thing becomes illegal. It sounds harsh, but that's how it is.
Next, we're going to look at every step of the process, from finding potential customers to actually sending them the email.
Best Practices for Lead Generation for Cold Email Outreach
The sales journey often kicks off with generating leads. However, before you even start collecting leads, you have to get ready to follow the basic rules of GDPR.
By incorporating these GDPR principles into your sales strategy from the start, you'll avoid a lot of legal troubles later on.
You need to generate leads by complying with the following rules:
- You need a legal basis for the data processing
- The processing must be fair
- You need to process only the minimum necessary data
- You must process the data only for sales purposes and nothing else
- Your data must be secure
- You need to delete the data once you don’t need it anymore
This, obviously, bans spam email. In the long run, following these principles may also improve your email deliverability and open rate.
We know this sounds abstract, but we are about to get into the details.
How to Stay Compliant While Building Your Cold Email List
Some people believe that generating leads usually doesn't follow GDPR rules. Although making it compliant can be challenging, it's doable. You just need to apply the following principles:.
Process only the minimum necessary data
If you generate leads by sending cold emails, you’ll likely need only the email address and possibly the personal name of the prospect.
In some cases, you may need other data, such as zip code, place of residence, job position, or other data. The point is to process the least amount of data you need to get in touch with your prospect, and nothing more than that.
Process the data only for sales purposes and nothing else
If you've obtained a prospect's email address for sending a cold email, you're allowed to use that address solely for the cold email. You shouldn't use the same address to send newsletters or for targeting in social media tools like Facebook Lookalike Audience.
Your data needs to be secure
Often, you'll rely on a third-party CRM tool to keep track of prospects' personal information. It's expected that the SAAS provider will ensure data security, which is typically the case with popular CRMs.
However, if your company uses a custom-built tool, the responsibility to protect your data from leaks and breaches falls on you.
Delete the data you don’t need anymore
Storing personal data that you don’t need is a liability. There are no benefits, but there is a risk of leakage. When a prospect indicates they are not interested in your offer or they are not responsive, remove their data from your database. It is a good practice to clear your databases once a month.
Ensure that you have a legal basis for processing and that the processing is fair
Your legal basis is the gate to lawful processing. Without a legal basis, you must not process any personal data whatsoever.
Your legal basis could be:
- User’s explicit consent
- Legitimate interests
Unfortunately, there is no simple answer to what your legal basis for processing will be in any given situation. You need to make judgments on a case-by-case basis. And you need to take responsibility for your own judgments.
All we can give you here is a framework of thinking for determining your legal basis.
GDPR Legitimate Interests Assessment for Compliant Cold Email Outreach
First, evaluate if you can send emails based on legitimate interests. If that's not viable, then you should seek consent from your prospects.
The process of using personal data under the guise of legitimate interests starts with conducting a legitimate interests assessment.
You’ll need to conduct the purpose, necessity, and balancing tests.
What would that look like in practice? Before asking for consent, we will conduct a LIA first.
Purpose test
Sales are your purpose.
Necessity test
Answer the following questions:
- Is it necessary to collect email addresses in order to reach potential customers?
- Can you do it in any other less privacy-intrusive way?
- Is email collection a reasonable way to process data for contacting people?
In most cases related to cold emails, the answer to these questions may be negative. If that is the case with you, proceed with the balancing test.
Balancing test
Answer the following questions:
- Would the person expect you to use their data for cold emailing?
- Is the data you use sensitive?
- Would the person who receives the email get any benefit from it?
- Are many people likely to object to it or find the cold emails intrusive?
- What is the possible impact on the individual?
- Can you offer an opt-out?
- Can you inform the prospect how you got their email and why you have processed it?
In many (but not all) cases, cold emails will pass the balance test as long as:
- They are tailored to the person who receives the email
- You inform them how you’ve got their email and why you contacted them
- You allow them to object (if they tell you they don’t want to be contacted again, you delete their email from your database)
- You process only their email address and personal name
- You do not process any sensitive personal data
Essentially, if you obtain someone's email, you're allowed to reach out to them for business reasons, provided you don't blast them with mass emails and instead approach them as individuals.
Yet, it's key to use your discretion to ensure that your legitimate business interests don't infringe upon the rights and freedoms of the individual whose email you've collected. If you're unsure, it might be safer to ask for their consent first.
Sending GDPR-Compliant Cold Emails
The last step involves sending out the emails and then crossing your fingers for a positive outcome.
There are two important things you have to ensure in your first email to the new prospect:
- You have to inform them how you got their email address. The GDPR requires you to inform users that you are processing their data, how you obtained it, and how to unsubscribe.
- Your emails should contain an unsubscribe link. This gives recipients the ability to opt-out if they don't want their data used anymore, fulfilling their right to object. Including this option not only respects their preferences but also helps you adhere to the CAN-SPAM Act, should it be relevant to your situation.
GDPR-Compliant Cold Email Dos and Donts
We understand that this is hard to grasp. Implementing abstract data protection principles is not an easy task if your job is to bring sales to your company.
That's why we created the GDPR-Compliant Email Dos and Donts Guide. You can download it in return for your contact information. That guide is a small part of a GDPR course focused on the sales that we have. If you like the guide, you'll love the course.
