Many sales teams in China build a list, load it into a tool and send to everyone. It works at home. In Europe the same gesture meets two sets of rules at once. The first is the general data regulation: the name, job title and professional address of a purchasing manager are personal data. The second governs the act of sending marketing by electronic means. The first is European and applied broadly the same way everywhere. The second is transposed into national law, and that is where countries part ways.
Two layers of rules, not one
The data regulation asks you to have a lawful basis before you use someone's data. For cold email, two bases are realistic: consent, or legitimate interest. The rules on electronic communications then add their own layer. For individuals they ask for prior consent before marketing email, with a narrow exception for people who already bought from you and are offered similar products. For companies, they leave the choice to each member state. So an email can be acceptable under the first layer and still be unlawful under the second, in the country where it lands.
Legitimate interest: what it is and what it is not
It is a basis, not a loophole. To rely on it you have to be able to write down three things: the purpose, the reason the email is necessary for that purpose, and why the recipient's interests do not outweigh yours. The test is what the person can reasonably expect. A purchasing manager at a distributor who receives an offer for products in the field they buy for can expect it. The same person receiving an unrelated offer cannot. Keep that reasoning in a short written assessment. And one right has no balancing test: a person can object to direct marketing at any time, and once they do, you stop.
- Relevance to the role. The offer concerns what this person buys or decides. A list sorted by industry only is not enough; sort by function.
- Who you are. Company name, postal address, and, for a company established outside the Union, the representative inside it. The recipient should not have to search for the sender.
- Where you found the address. The person is entitled to know the source. Write it in the message or be able to give it at once if asked.
- An opt-out that works in one step. A link or a reply, with no login, no form, no « tell us why ». If leaving is harder than arriving, the message is already a problem.
- A suppression list you really keep. Every objection recorded in one place and checked before every send, including the ones that came by reply or by phone.
- No disguised sender, no misleading subject line. The name in the « from » field is a real person at the real company, and the subject says what the message is.
The same email, different countries
Two examples show how far apart national rules sit, and a third line stands for all the others. They describe the general approach, not a guarantee, and national guidance changes: check the state you are about to write to before the first send, not after the first complaint.
| Country | General approach to email to business addresses | What it means for you |
|---|---|---|
| France | Prospecting to a professional address is accepted without prior consent if the offer relates to the person's function, they were informed, and they can object easily. | Possible, with a targeted list, a clear notice and a working opt-out. |
| Germany | Unfair-competition law is read strictly: advertising email generally needs prior express consent, including to businesses. | Cold email is high-risk. Open the relationship another way: a fair, an introduction, a request they made. |
| Other member states | Some follow a consent model for everyone, some distinguish companies from individuals, and sole traders are often treated as individuals. | Look up each country before adding it to a list. Do not assume the answer from a neighbour. |
Lists you buy, scrape or inherit
A list vendor who writes « compliant » on the invoice has not moved the responsibility. You are the one who writes to the person, so you answer for the basis and for the source. Addresses collected from a company website were published to be contacted about that company's business, not to feed a campaign. A badge scanned at a fair was given for the exchange that followed. A business card handed over after a conversation supports a follow-up on that conversation, not necessarily a newsletter. And the address of a sole trader or a very small business is often personal data in the strictest sense. When the origin of a contact is unclear, the contact does not go on the list.
A practical setup for a sender based in China
- Choose the countries first, using the table above and the local guidance. Start where the rules allow a cold approach and use other channels elsewhere.
- Write the legitimate-interest assessment for each segment you target, on one page: purpose, necessity, balance. If you cannot write it, the segment is not ready.
- Segment by function and write for the function. One message per role beats one message for the whole list, and it is also what the assessment says you do.
- Put identity, postal address, representative, source of the address and the opt-out in the footer, in the recipient's language.
- Keep the suppression list outside any single sending tool, and check it before every send. Process objections as soon as they arrive.
- Send from a domain you own, with the sender-authentication records set up, from a named person's mailbox. Keep a record of what was sent, to whom, on which basis.
Before the first send, write the sentence you would say if the recipient replied « where did you get my address? ». If the answer is not one clear sentence that you would be comfortable repeating to an authority, the list is not ready. Also ask whether email is the right first contact at all. A fair, an introduction from a mutual contact or a reply to a request they made all give you a basis that nobody has to argue about.