Finding decision makers in Europe under GDPR: country rules, sources and a checklist

This guide is for sellers and founders, including those outside Europe, who prospect businesses in the EU and the UK. It explains which rules apply, gives the B2B email rules for six countries from the laws and regulators themselves, shows how to find decision makers in Germany from public records, and ends with a checklist and the questions to put to a data vendor. This is general information, not legal advice. Laws change and depend on your facts; check with a lawyer in each country before you scale a campaign. For the data-protection basics of researching named people, see the account profiling guide.

Two sets of rules: GDPR for the data, national law for the message

GDPR decides whether you may hold and use a person's details. A company's address and revenue aren't personal data; the name, role, work email and phone of a person at that company are. Most prospecting relies on legitimate interests under Article 6(1)(f), and Recital 47 says processing "for direct marketing purposes may be regarded as carried out for a legitimate interest." The European Data Protection Board's draft guidelines on legitimate interest (version for public consultation, adopted 8 October 2024) set three cumulative conditions: a legitimate interest, processing that is necessary for it, and a balance that doesn't favor the person's interests and rights. The EDPB says to assess and document this before you start, and adds that Recital 47 "does not mean that direct marketing always constitutes a legitimate interest."

National law decides whether you may email or call. The ePrivacy Directive (Article 13) requires prior consent for marketing email to people, and leaves each country to decide how to protect "subscribers other than natural persons", meaning companies. The EDPB notes that national rules "may occasionally impose consent requirements" beyond the Directive, including for "direct marketing towards professionals." That's why the same email can be lawful in Paris and unlawful in Munich.

If you're outside the EU, GDPR can still apply. Article 3(2) covers controllers outside the EU whose processing relates to offering goods or services to people in the EU, and Article 27 then requires a written appointment of an EU representative, unless the processing is occasional and low risk. Whether B2B prospecting falls under Article 3(2) depends on your facts; ask counsel.

B2B email rules by country

We read each law or regulator's page on 30 October 2026. "Business contact" means a named person at a company, using a work address.

Calls have their own rules. In Germany, advertising calls to businesses need at least their presumed consent (UWG § 7(2) No. 1), so have a documented reason to expect the call is welcome. In Ireland, marketing calls to a mobile phone need the person's consent (Regulation 13(6)). Check each country's call rules and do-not-call registers separately; for UK calls, see is cold calling legal.

Letters are different. The EDPB notes that direct marketing that isn't sent by electronic means, such as a letter, falls outside the ePrivacy Directive and so doesn't need consent under it. GDPR still applies to the name and address you use, and in Germany advertising to someone who has made clear they don't want it is still an unreasonable nuisance (UWG § 7(1)).

Finding decision makers in Germany

German law makes the people at the top of a company unusually easy to find.

• The Impressum. Section 5 of Germany's Digital Services Act (DDG) requires providers of commercial digital services, such as a company website, to publish their name and address and, for legal entities, the legal form, the people authorized to represent them, and their commercial register and number. On a GmbH's website, that's the managing directors (Geschäftsführer); on an AG's, the management board (Vorstand).
• The commercial register (Handelsregister). Under section 9 of the Commercial Code (HGB), anyone may view the register and the documents filed with it for information purposes. Changes of managing director must be filed (GmbHG § 39), and so must every grant of Prokura, including joint Prokura (HGB § 53).
• Prokura means real signing power. Under HGB § 49, a Prokurist may carry out every kind of transaction that running the business involves, except selling or mortgaging land without a specific grant. A Prokurist is often the head of finance, purchasing or a division, and someone who can sign your contract.

Because cold email needs prior express consent, plan German outreach around channels that don't depend on it: a well-researched letter to a named managing director or division head, events and trade fairs, introductions through partners and customers, and content that makes buyers come to you. When someone gives you consent, record when, how and to what.

UK and other registries

In the UK, Companies House lists every company's current and past officers and its filed accounts, free. Most EU countries run a national business register; for a non-German target, look for the country's official register before buying data, and use the person's role there to check what a vendor's database says.

The GDPR checklist for a European prospect list

1. Write a legitimate interests assessment before you collect. State the purpose, why each data field is necessary, and why the person would reasonably expect contact about their work. Date it.
2. Collect the minimum. Article 5(1)(c) requires data to be "adequate, relevant and limited to what is necessary": name, role, company, work email or phone, the source and the date collected.
3. Record the source of every contact. Article 14 requires telling people which source their data came from.
4. Check the recipient's country against the email table before each send, and keep consent records where you rely on consent.
5. Put the notice in the first message. Article 14(3)(b) requires the privacy information at the latest at the first communication, and Article 21(4) requires the right to object to be presented "clearly and separately from any other information."
6. Treat an objection as final. Under Article 21(3), once someone objects to direct marketing, you must stop processing their data for it. Keep only what you need on a suppression list so you don't contact them again.
7. Set a retention period. Delete contacts who haven't engaged after it ends.
8. Check your data vendors with the questions below.

Article 83(5) allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of the processing principles or people's rights.

I'm writing because [one sentence on why their role makes this relevant].

How I got your details: I found your name and role on [source, e.g. your company's website], and your work email from [source]. [Company] processes them on the basis of our legitimate interest in contacting businesses about [topic]. Our privacy notice explains your rights and how long we keep data: [link].

You can object at any time: reply "no" and I'll stop contacting you and remove your details.

Worked example: one campaign, four countries

Illustrative example. The company and its plan are invented to show the method; the rules are from the sources above.

The seller: Pinecrest Energy Analytics (pinecrest.example), a US company selling energy monitoring software to manufacturers, plans its first European campaign: plant and operations leaders at manufacturers with 200 to 2,000 employees in Germany, the Netherlands, France and Ireland.

Pinecrest wrote one legitimate interests assessment covering all four countries, recorded the source and date for every contact, put the privacy lines in every first email and letter, appointed an EU representative after advice from counsel, and set a 12-month retention period for contacts who never replied.

To build the list itself, Bebop finds companies and contacts matching a plain-language description and explains why each fits; record each contact's source and check the country rules above before you write.

What to ask a data vendor about European contacts

• What lawful basis do you rely on, and have you notified the people in your database under Article 14?
• Can you show the source and collection date for each record?
• Does each record carry the person's country, so we can apply national email rules?
• For Germany, do you hold any consent records, and what exactly was consented to?
• How do you handle objections and deletion requests, and do you pass them on to customers?
• Where is the data stored and processed, and what transfer safeguards apply?
• Will you sign a data processing agreement, and who is the controller for what?

A vendor's own compliance covers its processing, not yours. Some vendors document theirs in detail; the Cognism pricing review summarizes one example.

Common mistakes

• Applying one rule to all of Europe. The email rule changes at each border.
• Assuming B2B means GDPR doesn't apply. A named person's work email is personal data.
• No source recorded. You can't tell someone where you got their details if you don't know.
• Burying the opt-out. It must be clear and separate, in the first message.
• Cold emailing Germany because a vendor said "GDPR compliant". Compliance with GDPR says nothing about the UWG.

Next step: once you know who you may contact, map who decides at each account with the guide to who has buying authority.