GDPR Legitimate Interest for Signal-Led Prospecting: What Recruiters Can and Can't Do (2026)

TL;DR

Not legal advice. This guide is a practical orientation for recruitment agency owners and BD consultants, not a legal opinion. Check your own setup with a data protection lawyer.

Legitimate interest (Art. 6(1)(f) GDPR) can be a valid lawful basis for B2B prospecting, and the ICO lists direct marketing as a possible legitimate interest [1]. But the lawful basis is only one of three layers. You also need the right channel rule (PECR in the UK, §7 UWG in Germany), and you must honour transparency and objection duties [8] [9]. In the UK you may email corporate subscribers without prior consent, but sole traders and some partnerships count as individuals [3]. In Germany, email advertising needs prior express consent and B2B phone advertising needs at least presumed consent [10] [12]. Signal-led BD helps because company-level signals (funding, job-posting velocity, expansions) are mostly not personal data, and a consultant who verifies and sends every message keeps the outreach relevant and defensible. boilr is built around that model.

Why Recruiters Get GDPR Wrong in BD

Recruiters handle personal data all day, yet BD prospecting often runs on gut feel. The same four misunderstandings come up again and again:

• "B2B means GDPR does not apply" - wrong. The ICO is explicit that if you can identify an individual, even in their business capacity, it is personal data [2].
• "Legitimate interest means I can do anything" - wrong. It is a test you must pass and document, not a loophole [1].
• "One lawful basis covers the whole campaign" - wrong. GDPR and the e-privacy rules sit side by side. Passing one does not satisfy the other [1].
• "UK rules apply in Germany too" - wrong. Germany's UWG is stricter on email and phone than the UK is for corporate subscribers [10].

The Three Layers: Lawful Basis, Channel Rule, Transparency

Think of every outreach message as passing three gates. Fail any one and the message is a problem, however good the signal behind it was.

Layer	Question	UK source	German source
1. Lawful basis	May we process this person's data at all?	UK GDPR Art. 6(1)(f) [1]	GDPR Art. 6(1)(f) [6]
2. Channel rule	May we send this email or make this call?	PECR [3]	§7 UWG [10]
3. Transparency and rights	Did we tell them, and can they stop us?	Art. 14 and 21 [8] [9]	Art. 14 and 21 [8] [9]

Layer 1: Legitimate Interest and the Three-Part Test

The ICO breaks Art. 6(1)(f) into a three-part test, and you must satisfy all three before you start using the information [1]. The EDPB describes the same three cumulative conditions for the EU [6].

Purpose test

• Be specific - "we have a legitimate interest in using prospect information" is too vague. Name the purpose, for example "contacting hiring decision-makers at companies showing a hiring signal, to offer recruitment services" [1].
• Commercial is allowed - the CJEU has accepted that a purely commercial interest can qualify (case C-621/22), though it still has to be lawful, clearly articulated and real [7].

Necessity test

• Targeted and proportionate - could you reach the same goal with less data? Contacting the one hiring manager for a live brief is more defensible than scraping every employee at the company.
• Data minimisation - a name, job title, business email and the signal that triggered the contact is usually enough. You do not need a prospect's home address or personal social profile.

Balancing test

• Reasonable expectations - if people would not expect your use, their interests can override yours [1]. A head of talent receiving a relevant note about a role they have just opened is within expectation. The same person being tracked across personal channels is not.
• Impact - the ICO flags a "serious mismatch" between your interests and the person's rights as the point where interests override [1]. Low-intrusion B2B outreach with a one-click opt-out sits at the low end.

Write a Legitimate Interests Assessment (LIA)

A short written LIA is how you prove you did the thinking. One page per prospecting use case is plenty:

1. Purpose - what exactly are you trying to achieve, and why does it matter to the agency?
2. Data - which fields, from which sources, held for how long?
3. Necessity - why is each field needed, and what did you decide not to collect?
4. Balancing - expectations, impact, safeguards (opt-out, suppression, review).
5. Outcome - approved, approved with conditions, or rejected, with a review date.

Layer 2: The Channel Rules

United Kingdom: PECR

The ICO states you can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body) without prior consent, but sole traders and some partnerships are treated as individuals and need specific consent [3]. The soft opt-in does not help you here: it covers your own customers and "does not apply to prospective customers or new contacts" [3].

For live B2B calls you must not call numbers registered with the CTPS or TPS unless the business has consented [2]. The ICO also recommends a "do not email or text" list for any business that objects [3].

What the Data (Use and Access) Act 2025 changed

• Bigger PECR fines - since 5 February 2026 the maximum for PECR breaches rose from £500,000 to UK GDPR levels: £17.5 million or 4% of global annual turnover [5]. The ICO describes the aim as bringing PECR enforcement into line with UK GDPR [4].
• Direct marketing defined - PECR now carries a definition of direct marketing as communication of advertising or marketing material directed to particular individuals [4].
• Direct marketing and legitimate interests - the Act amends Art. 6 UK GDPR to say that direct marketing can be a legitimate interest [11], which matches ICO guidance that already listed it as a possibility [1]. It does not remove the need for the balancing test or PECR compliance.
• "Recognised legitimate interests" are not for BD - the new category covers areas such as national security, crime prevention and safeguarding [5]. Sales prospecting still needs the full three-part test.

Germany: §7 UWG

The German rule is stricter than the UK corporate-subscriber exemption. Under §7 Abs. 2 UWG, advertising by email requires prior express consent regardless of whether the recipient is a consumer or a business [10] [12]. For phone advertising, B2B calls are permitted with at least presumed consent (mutmaßliche Einwilligung), which requires concrete circumstances showing the recipient would expect or welcome the call [12].

• Double opt-in - this is a market practice for proving email consent, not a term in the statute itself. You should be able to evidence who consented, when, and to what.
• Existing-customer exception - §7 Abs. 3 UWG has narrow conditions for emailing your own customers. It does not cover cold prospects [10].
• Practical consequence - cold email to German hiring managers is a high-risk channel. Phone with a documented, signal-based reason, or a warm route such as an introduction, is the safer path.

Channel comparison

Channel	UK (PECR)	Germany (UWG)
Email to a limited company	No prior consent needed; UK GDPR still applies to named individuals [2]	Prior express consent required [12]
Email to a sole trader	Treated as an individual: consent needed [3]	Prior express consent required [12]
Live B2B call	Screen against CTPS and TPS [2]	At least presumed consent [12]
Soft opt-in / existing customer	Own customers only [3]	§7 Abs. 3 UWG, narrow [10]

Company Signals vs Personal Data: Where Signal-Led BD Has an Edge

The strongest compliance argument for signal-led BD is data minimisation by design. Most triggers are about the company, not a person. Here is how typical recruitment signals sort out:

Signal	Mostly company-level?	Personal data risk
Funding round announced	Yes	Low until you pick a named contact
Job-posting velocity (ten new engineering roles)	Yes	Low; the posting names a role, not a person
New office or market expansion	Yes	Low until a named contact is added
New CFO or Head of Talent appointed	No	Higher: it is about an identifiable person
Director filing on a public register	Partly	Public does not mean free to use for anything; check purpose and expectations

A generic address such as info@ or a switchboard number identifies no one. A named work email does. The ICO is clear that a name-based business address is still personal data under UK GDPR, even where PECR treats the subscriber as corporate [2].

Layer 3: Transparency, Objection and Suppression

Art. 14 notices

When you collect a prospect's data from somewhere other than the person, Art. 14 applies. You must tell them within a reasonable period, at the latest within one month, or at the first communication if you contact them sooner. The notice must include the legitimate interests you pursue and the source of the data [8].

• First message footer - a short line naming the agency, the reason for contact (a hiring signal you observed), the source type and a link to your privacy notice.
• Privacy notice section - a plain-language "business contacts and prospects" section that lists categories, sources, retention and rights.
• Do not lean on the exemption - Art. 14(5)(b) allows an exception for disproportionate effort, but it is framed around archiving, research and statistics [8]. Do not assume outreach qualifies.

The right to object

• Absolute for marketing - where data is processed for direct marketing, the person can object at any time, and once they do you can no longer process their data for that purpose [9].
• Say it clearly - the right must be brought explicitly to the person's attention at the first communication, clearly and separately from other information [9].
• Suppress, do not delete - keep a minimal record (email, company, date of objection) so you do not re-add the person from the next data source. The ICO recommends a do-not-contact list for exactly this reason [3].

What Recruiters Can and Can't Do

You can	You can't
Email a named hiring manager at a UK limited company after a documented job-posting signal, with opt-out and Art. 14 information	Email a UK sole trader or a partnership treated as an individual without consent [3]
Phone a UK business after screening against CTPS and TPS [2]	Call a CTPS-registered number without the business's consent [2]
Phone a German company where concrete circumstances support presumed consent [12]	Send cold email to a German hiring manager without prior express consent [12]
Rely on legitimate interest for B2B data processing, with a written LIA	Treat legitimate interest as a free pass for the channel rules [1]
Keep a minimal suppression record after an objection	Keep messaging someone who has objected to direct marketing [9]

A Compliant Workflow With a Human in the Loop

Here is a workflow an agency can adopt, with eight concrete steps:

1. Define the use case and LIA - for example "UK tech 360 desk contacting hiring leaders at scale-ups with open engineering roles".
2. Set the ICP and the signals - only act on signals that tie to a genuine, current hiring need.
3. Classify the entity - limited company or LLP versus sole trader. Route anything ambiguous to review rather than sending.
4. Check the market rule - UK email to corporate subscribers is possible, Germany needs consent for email, calls need CTPS/TPS screening in the UK.
5. Screen against suppression - your do-not-contact list is checked before any draft reaches a consultant.
6. Consultant verifies - the person reads the signal, confirms it is real and relevant, checks the contact, and edits the draft.
7. Send with Art. 14 and opt-out content - a clear sender, a clear reason, an easy way to say no.
8. Log and honour objections - record the opt-out in the CRM the same day and review the LIA at least annually.

How boilr Fits In

boilr is an AI sales employee for recruitment. It finds and enriches client companies, detects hiring signals such as funding, executive moves and hiring activity, and prepares finished Tasks with contact details, an outreach angle and a draft message. The consultant verifies and sends, which takes minutes a day, not hours. Here is how each part supports the workflow above:

• Signals - company-level triggers give you a documented, specific reason for every contact, which is the core of the purpose test.
• ICP scoring - contacting only well-fitted companies supports necessity and proportionality.
• Tasks with human verification - every message is reviewed and sent by a consultant, so nothing goes out unseen.
• Company Brain - shared agency memory can hold your ICP, markets you do or do not contact and lessons from objections, so the rules survive consultant churn.
• Integrations - boilr connects to Bullhorn, RecruiterFlow and Spott, which is where your suppression and consent records should live.

Be honest about the limits. Software does not make you compliant. Your agency remains the controller for its prospecting, so the LIA, privacy notice, consent evidence for Germany and objection handling stay with you. Keep these human: the final send decision, the call on sole traders and ambiguous entities, and every objection.

Common Mistakes

• Buying a list and emailing it - the soft opt-in "does not apply to prospective customers or new contacts (eg from bought-in lists)" [3].
• Ignoring sole traders - a small contractor-led client may be an individual subscriber.
• Skipping the written LIA - when the ICO asks, "we thought about it" is not evidence.
• Treating Germany like the UK - a UK-style cold email sequence into DACH invites UWG trouble [12].
• No suppression discipline - a re-added objector is the fastest route to a complaint.
• Ignoring the new fines - PECR breaches now carry UK GDPR-level maximums [5].

KPIs for a Compliant BD Programme

KPI	What it shows	Healthy sign
Share of contacts with a documented signal	Purpose test is real	Close to 100%
Time from objection to suppression	Rights handling	Same working day
Entities classified before send	Channel rule discipline	100%
Drafts edited or rejected by consultants	Human review is real	A visible share, not zero
LIA review date in the past 12 months	Governance	Yes

A 30-Day Plan

• Week 1 - draft the LIA, update the privacy notice with a prospects section.
• Week 2 - build the suppression list in your CRM, add entity classification and market routing.
• Week 3 - add the Art. 14 line and opt-out wording to templates, train consultants on the checks.
• Week 4 - run a pilot on one desk, review objections and edits, then roll out.

Want signal-led BD where every message is verified by a consultant before it is sent? Try boilr free at app.boilr.ai or book a demo.

Frequently Asked Questions

Can recruiters use legitimate interest for cold B2B outreach?

Often yes for the data processing, if you pass the purpose, necessity and balancing tests and document them [1]. But the channel rule is separate. In Germany, cold email additionally needs prior express consent [12].

Do I need consent to email a UK hiring manager?

Not if the recipient is a corporate subscriber such as a limited company or LLP [3]. You do need consent for sole traders and some partnerships. UK GDPR still applies to the named individual [2].

What did the Data (Use and Access) Act 2025 change for prospecting?

It raised PECR fines to UK GDPR levels from 5 February 2026 [5], added a definition of direct marketing to PECR [4] and states that direct marketing can be a legitimate interest [11]. It did not remove the balancing test or the consent rules for individuals.

Is double opt-in required in Germany?

The statute requires prior express consent for email advertising [10]. Double opt-in is the common way to evidence that consent, not a named legal requirement. Keep a record of who agreed, when and to what.

Is a company's funding news personal data?

Generally no, because it concerns the company. It becomes personal data when linked to an identifiable person, such as a named founder or a new executive [2].

Do I need to send an Art. 14 notice to every prospect?

Yes, in principle. You must inform within a reasonable period and at the latest within one month, or at first communication if earlier [8]. Most agencies do it with a short line in the first message plus a link to the privacy notice.

What happens when someone objects?

For direct marketing the right to object is absolute, and you must stop processing their data for that purpose [9]. Keep a minimal suppression record so they are not added again.

Does using AI change any of this?

The lawful basis, channel and transparency rules apply whichever tool prepares the draft. A human who verifies each message and holds the objection list keeps accountability clear. Specific AI rules are a separate topic, covered in our guide to the EU AI Act.

Sources

Information sourced from public regulator guidance, legislation and law-firm analysis as of October 2026. Not legal advice.

1. ICO - What is the legitimate interests basis?
2. ICO - Business-to-business marketing
3. ICO - Electronic mail marketing (PECR)
4. ICO - DUAA 2025: privacy and electronic communications
5. Clifford Chance - Key aspects of the Data (Use and Access) Act take effect
6. EDPB - Guidelines 1/2024 on Article 6(1)(f) GDPR
7. EU Law Analysis - CJEU C-621/22 and the EDPB guidelines
8. GDPR Art. 14 - Information where data are not obtained from the data subject
9. GDPR Art. 21 - Right to object
10. gesetze-im-internet.de - §7 UWG (unzumutbare Belästigungen)
11. legislation.gov.uk - Data (Use and Access) Act 2025 (c. 18)
12. IHK Nord Westfalen - Werbung per Telefon, Telefax oder E-Mail