A few years back, running outbound for a startup in Hamburg, I watched a brilliant SDR freeze. She had a clean list of German and UK prospects, a great pitch, and then someone in a meeting said the word “GDPR.” Just like that, she stopped dialing. For weeks.
And that fear cost us real pipeline. Not because cold calling was illegal, but because nobody had actually read the rules.
So I did. I sat down with the guidance, talked to a data-protection consultant, and rebuilt our process. Turns out you CAN still cold call under GDPR. You just have to do it the right way. Let me walk you through exactly how, without the fear and without the fines.
š Short answer: Yes, you can still cold call under GDPR. B2B cold calling is legal when you rely on a documented "legitimate interest," screen numbers against do-not-call registers, disclose where you got the data, and honor every opt-out. Break those rules and you risk serious fines.
Can You Still Cold Call Under GDPR?
Yes, you can still cold call under GDPR, especially for B2B. The General Data Protection Regulation never banned picking up the phone. It regulates how you handle the personal data behind that call.
Here’s the key distinction most people miss. GDPR governs the DATA (the name, number, and email you hold), while a separate set of rules governs the actual CALL. In the UK that second layer is PECR, and across the EU it’s the ePrivacy Directive. You need to respect both.
And Cold calling rules are actually more forgiving than cold email rules under these laws. So don’t copy your email-consent policy onto your phone process. They’re different games.
The catch? “B2B is totally exempt” is a dangerous myth. A sole trader’s business number is still personal data. So is an employee’s direct dial. So you always need a lawful basis. Let’s cover the one you’ll actually use.
Legitimate Interest: The Lawful Basis for B2B Cold Calling
Legitimate interest is the lawful basis that lets you cold call businesses without prior consent. It means you have a genuine, proportionate reason to contact someone, and your marketing won’t override their rights.
To rely on it safely, run a quick Legitimate Interest Assessment, a simple three-part test:
- Purpose: Do you have a real business reason to call? Selling a relevant product to a relevant company counts.
- Necessity: Is a call a reasonable way to achieve it? Usually yes for B2B.
- Balance: Would the person reasonably expect this contact, and does your interest outweigh their privacy? Calling a marketing director about a marketing tool passes. Calling a random personal mobile does not.
Write that assessment down. The UK regulator’s own guide to legitimate interests stresses that documentation is what protects you if anyone ever asks. A basis you never recorded is a basis you can’t prove.
š Field note: Legitimate interest works for cold CALLS. It does NOT automatically cover cold email to individuals in many EU countries, where soft opt-in or consent often applies. Keep the two channels legally separate.
The Do-Not-Call Registers You Must Screen
Before you dial, you must screen your list against the relevant preference service. This is non-negotiable, and skipping it is the fastest way to a fine. Bake the screen into the way you build your cold call lists so it never gets skipped.
In the UK, there are two registers that matter:
- TPS (Telephone Preference Service): Covers individuals and sole traders who opted out of marketing calls.
- CTPS (Corporate Telephone Preference Service): Covers registered companies that opted out.
You have to screen against both, and re-screen regularly, because numbers get added all the time. You can check and register numbers through the official Telephone Preference Service. Call a number that’s on the list and you’re liable, full stop.
Other EU countries run their own versions, like Bloctel in France. So if you call across borders, check each market’s register. Don’t assume one country’s rules travel.
Your GDPR Cold Calling Checklist
Here’s the compliance workflow I built for our team. Run every call through it and you’re on solid ground.
| Step | What to do | Why |
|---|---|---|
| 1 | Document a legitimate interest assessment | Your lawful basis, on record |
| 2 | Source data from a compliant provider | You inherit their collection practices |
| 3 | Screen against TPS and CTPS | Calling opted-out numbers is illegal |
| 4 | Send an Article 14 privacy notice | Tell people you hold their data |
| 5 | Honor every opt-out instantly | The right to object is absolute |
| 6 | Keep a suppression list | Never call a “remove me” contact again |
That fourth step trips people up, so let’s unpack it.
Article 14 and the Right to Object
Article 14 means you must tell people you hold their data when you didn’t collect it directly from them. Because you bought or sourced a cold list, this applies to you.
In practice, you satisfy it with a short privacy notice, usually a follow-up email or a line in your first contact, pointing to your privacy policy. The text of GDPR Article 14 lays out what that notice should include: who you are, why you’re processing the data, and where you got it.
Then there’s the right to object. Under Article 21, if a prospect says “take me off your list,” you must stop immediately, no debate. So how do you keep them off future lists without illegally storing their data? You add them to a suppression list, ideally just enough info to recognize and skip them. That’s not a violation; it’s how you honor the objection. Where you store and manage all of this matters too ā data privacy in your CRM is part of the same duty.
š” Script tip: When a prospect asks "who gave you my number?", answer honestly: "We identified you through publicly available business data because our product fits companies like yours. Happy to remove you right now if you'd prefer." Honesty defuses the objection fast.
Country Rules Are Not the Same (Germany Is Strict)
GDPR sets the floor, but each country layers its own rules on top, and they vary a lot. This is where cross-border teams get burned.
- United Kingdom: Legitimate interest works for B2B calls, plus mandatory TPS/CTPS screening.
- France: The regulator, CNIL, generally allows B2B prospecting on legitimate interest if the product relates to the person’s job.
- Germany: The strictest of the bunch. German competition law (UWG) requires prior consent for B2B phone calls, effectively overriding legitimate interest.
So the exact same call that’s fine in London can be a violation in Munich. Germany’s and France’s regulators publish their own guidance, and you should read the one for every market you dial into. When in doubt, get local legal advice before a big campaign. And in consent-first markets like Germany, it pays to know how to generate leads without cold calling at all.
Does GDPR Apply If My Team Is Based in the US?
Yes. GDPR follows the person, not your office. If your SDRs sit in Austin but call prospects in Berlin or Paris, you’re processing EU personal data and GDPR applies to you.
This surprises a lot of US teams. And it’s the same principle behind laws like the CCPA in California, which protect residents regardless of where the business sits. So if you sell internationally, build compliance in from day one rather than bolting it on after a complaint.
The Real Risk: What Non-Compliance Actually Costs
Let’s be honest about the stakes, without the scare tactics. You’ll see the “ā¬20 million fine” headline everywhere, but that’s the theoretical maximum, not what a small business faces.
In reality, regulators have fined companies hundreds of thousands for nuisance-call violations, often for ignoring TPS or hammering people who opted out. The bigger day-to-day cost is reputational. Sloppy calling gets your numbers flagged, your brand blacklisted, and your prospects annoyed before you say a word.
The regulator’s guidance on direct marketing using live calls is the clearest source on what’s allowed. Read it once, and most of the fear disappears.
How Clean, Compliant Data Makes This Easy
Here’s the quiet truth. Most GDPR cold-calling problems are really data problems. Bad sourcing, no opt-out tracking, calling numbers you should have screened out.
So the fix is upstream. Source your contacts from a provider that collects data compliantly and gives you business-level information for legitimate outreach, rather than scraping personal profiles. When your list starts clean, most of the checklist takes care of itself. A tool like CUFinder’s contact search is built to surface verified B2B contacts, which keeps your outreach both effective and defensible. And when I prep a call sheet, I fill the phone column with company numbers rather than personal mobiles, which keeps the balancing test comfortably on your side.
And keep your marketing and sales channels honest across the board. If a prospect ignores your calls, meeting them later on social media is a perfectly compliant next step. For more on building compliant call lists that convert, our cold calling lead generation guide goes deeper, and the latest cold calling statistics show why the channel is still worth doing right.
Frequently Asked Questions
Is cold calling banned under GDPR?
No, cold calling is not banned under GDPR. B2B cold calling is legal when you have a lawful basis like legitimate interest, screen numbers against do-not-call registers, and honor opt-outs. GDPR regulates how you handle the data, not whether you can call.
Is cold calling illegal in Europe?
Cold calling is not illegal across Europe, but the rules vary by country. The UK and France allow B2B calls on legitimate interest, while Germany requires prior consent under its UWG competition law. Always check the specific market you’re calling.
Does GDPR cover phone calls?
GDPR covers the personal data behind a phone call, such as the name and number you store. The call itself is also governed by ePrivacy rules like PECR in the UK, which require screening against preference services such as TPS and CTPS.
Can I cold call a personal mobile number from a public LinkedIn profile?
It’s risky and usually not advisable. A number being public doesn’t give you a lawful basis to use it for marketing, and a personal mobile weakens your legitimate-interest balancing test. Stick to business direct dials tied to the person’s professional role.
Are data providers like CUFinder responsible for GDPR compliance, or am I?
Both share responsibility, but you as the caller are the data controller for your outreach. That means you must have a lawful basis, screen your lists, and honor opt-outs. A compliant provider makes your job far easier, but the duty to call responsibly is yours.
Do I have to say a call is recorded on a B2B cold call?
Yes, if you record calls you must inform the other person at the start. Under GDPR the recording is personal data, so disclose it, state your purpose, and have a lawful basis and retention policy for storing the recordings.
Stop Fearing GDPR and Start Dialing
Here’s what I told that frozen SDR back in Hamburg, and what I’ll tell you now. GDPR didn’t kill cold calling. It just made lazy cold calling risky.
So do the simple things. Document your legitimate interest, screen your lists, send the privacy notice, and honor every opt-out the second you hear it. Do that, and you can pick up the phone with total confidence. Then let the craft take over ā these B2B cold calling techniques handle the part the law can’t teach.
You’ve got this. And if you want lists that start clean and compliant, try CUFinder free and build your next campaign on verified, defensible B2B data. Now go make those calls.
Bad
Okay
Good
Amazing
