What Is Legitimate Interest for B2B Outreach?

Legitimate interest for B2B outreach is the GDPR lawful basis that can let you contact a business person without prior consent. Your reason must be real, necessary and not outweighed by their rights. It is not a free pass. This page is general information, not legal advice. Ask a lawyer about your own case.

Key takeaways

• Legitimate interest is Article 6(1)(f) of the GDPR. Recital 47 says direct marketing may be regarded as a legitimate interest.
• You must pass a three-part test: purpose, necessity and balancing. Write the result down.
• Article 21 gives every person an absolute right to object to direct marketing. Honor it fast.
• GDPR is not the only rule. Email and phone rules (ePrivacy, PECR, CAN-SPAM) sit on top and differ by country.

What it is

Legitimate interest is a lawful basis under Article 6(1)(f) of the GDPR: you may process personal data when it is necessary for a legitimate interest, unless the person's rights override it.

It is one of six lawful bases. Consent is another. For B2B prospecting, most teams pick consent or legitimate interest, because the other four rarely fit.

Recital 47 of the GDPR states that processing for direct marketing may be regarded as carried out for a legitimate interest. It also says the controller must consider what the person can reasonably expect. A VP of Sales getting a relevant offer for sales software at a work address is within that expectation. The same person getting an unrelated offer on a personal address is not.

Source: GDPR text, EUR-Lex, September 2026.

How it works

You run a legitimate interests assessment (LIA) before you send anything. The UK regulator, the ICO, describes it as a three-part test: purpose, necessity and balancing (ICO guidance, September 2026).

1. Purpose. Name the interest. "Offer our payroll API to finance leaders at mid-size companies" is a purpose. "Grow revenue" is too vague.
2. Necessity. Ask whether you need this personal data for that purpose. Name, work title and work email are usually needed. A home address and a personal phone number usually are not.
3. Balancing. Weigh your interest against the person's. Would they expect this message? Is it relevant to their role? Can they opt out in one step?
4. Tell them. Say who you are, why you hold their data, and where it came from. GDPR transparency rules apply even when you did not collect the data from them.
5. Give an opt-out. Put a clear unsubscribe in every message and act on it. Article 21 makes this a legal right, not a courtesy.
6. Record it. Keep the LIA, the filters you used and the date. If a regulator asks, this is your answer.

Worked example. You sell a billing tool. Your purpose: reach heads of finance at German companies with 51-200 employees. Necessity: name, title, company, work email. Balance: the offer matches their job, you use only work addresses, you cite the data source, and each email carries an unsubscribe. You write that down as one page and save it with the list.

Legitimate interest vs consent

People confuse the two. Consent needs a clear yes before you start. Legitimate interest needs a documented test and an easy no after you start.

Sources: GDPR Articles 6 and 21, EUR-Lex, September 2026.

When it matters

Cold email to business addresses

Article 6(1)(f) answers the GDPR question. The ePrivacy Directive answers the email question. Article 13 of Directive 2002/58/EC requires prior consent for unsolicited direct marketing to subscribers who are natural persons. For other subscribers, such as companies, it leaves protection to each Member State (ePrivacy Directive, September 2026). So the answer for a work address in Germany differs from one in France. Check the national rule.

Sole traders and small partnerships

An address like jane@acme.com looks corporate. If Jane is a sole trader, many countries treat her as an individual, and the stricter consent rules can apply. Do not assume a business domain means a business subscriber.

Phone and LinkedIn outreach

Legitimate interest can cover the data processing. It does not override separate rules for calls, texts or automated dialing. Treat phone numbers as higher risk, and keep them to people whose role plainly fits your offer.

The US, UK and elsewhere

In the US, CAN-SPAM is an opt-out regime: no prior consent, but a working unsubscribe and honest headers. The UK has its own version of the GDPR and PECR. None of these use the term "legitimate interest" the same way. Match your process to the strictest country on the list.

How LeadOcean handles it

LeadOcean does not decide your lawful basis. Its filters let your list match your LIA. The filters you pick are the record of your purpose and necessity: country, jobFunction, jobLevel and emailType narrow a list to the people your offer is actually for.

• Purpose and relevance: jobFunction and jobLevel tie the list to the role your offer addresses.
• Region: country (254 values) lets you split lists by the national rule you checked.
• Necessity: emailType set to work keeps the list to work addresses. Skip personal-email and phone lookups when your LIA does not need them.
• Size before you spend: a free count call shows how many people match, without spending records.

On 2026-10-02, a count for C-Team people in Sales & Business Development in Germany (country DE, jobLevel C-Team, jobFunction Sales & Business Development, default mailable statuses) returned 926. Counts change with each monthly refresh. The call below adds emailType work, so its total can be lower.

curl -X POST "https://api.leadocean.io/v1/people/search?count=true" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "country": ["DE"],
    "jobLevel": ["C-Team"],
    "jobFunction": ["Sales & Business Development"],
    "emailType": ["work"],
    "limit": 1
  }'

count=true is a query parameter. The response has an empty data array and meta.total, so the call spends no records. meta.total is capped at 100,000. When the number looks right, pull the list with the same filters through POST /v1/exports. The Exports page in the app at app.leadocean.io shows the record price before you start.

Keep the filter set with your LIA. LeadOcean refreshes the dataset monthly and each record carries its own fetched_at date, so you can show how fresh the data was when you used it. For suppression, you handle opt-outs in your own sending tool and remove those people from every future export. LeadOcean has no sequencer, so your sending tool owns the unsubscribe step. See how to automate email outreach with a sequencer and the B2B prospect list template. To pick an address source, read best email finder for outreach. More guides are in the LeadOcean blog. The free plan covers 1,000 records one-off, and Pro is $499 a month: see pricing.

FAQ