Is B2B cold calling allowed under GDPR?

GDPR does not ban B2B cold calling. Recital 47 says direct marketing may be a legitimate interest, so you can often call business contacts without consent if you pass and document the 3-step test. But national rules that implement the EU’s ePrivacy Directive decide whether each call is allowed, and anyone you call can object at any time, with no reason needed.

What GDPR says about sales calls

GDPR applies as soon as you process personal data: a named buyer, a direct dial, a work mobile. The European Data Protection Board (EDPB) notes that marketing to legal persons with no personal data involved falls only under the ePrivacy Directive. In practice, almost every B2B call list names people, so GDPR applies.

The EDPB’s guidelines on legitimate interest (version 1.0, published in October 2024 for consultation; the EDPB page lists no final version as of October 2026) set out 4 points that matter for calling teams:

• Legitimate interest is possible, not automatic. Recital 47 says direct marketing “may be regarded as carried out for a legitimate interest”. The EDPB adds that this does not mean you can rely on Article 6(1)(f) for every kind of direct marketing.
• 3 conditions must all be met. Your interest is legitimate, the processing is necessary for it, and the person’s rights and interests do not override it. The person’s reasonable expectations count: are they a customer, what are you selling, and would they expect a call about it?
• You must tell people. Your privacy information names the legal basis and the specific legitimate interest (Articles 13(1)(d) and 14(2)(b)), and says people can get the balancing test on request.
• The right to object is unconditional. Under Article 21(2), the person needs no reason, there is no balancing test, and you must make objecting easy and free of charge.

National rules decide whether you may call

The EDPB tells controllers to check the national rules that implement the ePrivacy Directive, which “may occasionally impose consent requirements” beyond the Directive, for example for marketing to professionals. If national law does not allow the call, there is no legitimate interest to rely on. Three examples, as of October 2026:

Country	Calls to consumers	Calls to business contacts
Germany	Prior express consent, documented when given and kept for 5 years after it is given and after each use (UWG sections 7 and 7a)	At least presumed consent (“zumindest mutmaßliche Einwilligung”)
France	Prior consent since 11 Aug 2026, with exceptions such as an ongoing contract; by default, calls only Monday to Friday, 10:00 AM–1:00 PM and 2:00 PM–8:00 PM, not on public holidays; proof of consent kept for at least 3 years	Legitimate interest when the offer relates to the person’s job; inform them and let them object simply and free of charge (CNIL)
United Kingdom (UK GDPR and PECR, outside the EU)	No consent needed for many live calls; screen against the TPS and do not call people who objected	Screen against the CTPS and TPS, and honor objections from businesses too (ICO)

Calls made by automated calling machines are stricter: in Germany they need prior express consent from anyone, business or consumer. The ICO marks its live-call guidance as under review, so check it before each campaign. For other EU countries, check the national law, and confirm with your counsel before calling.

What “presumed consent” and “related to their job” mean in practice

Germany’s UWG does not define presumed consent. France’s CNIL gives a plain example of a call it would accept on legitimate interest: a call presenting software to a company’s IT director. Both tests point the same way: the call must make sense for the person’s role.

A practical way to apply this:

• Match the offer to the role. Call the IT director about software, not the office manager. A list built from job titles that fit your product supports both tests; a list of every employee at a company does not.
• Write down the reason. For each campaign, record why this role would expect this call. In Germany, ask your counsel what facts support presumed consent for your offer.
• Watch the source. The CNIL says that when contact data comes from a third party, you must make sure the person was told their number could be used for prospecting and can object.
• Separate consumers. If you cannot tell whether a number belongs to a business or to a person acting privately, such as a sole trader’s personal mobile, apply the consumer rule.

How to handle “stop calling me”

An objection to direct marketing ends the calls, wherever the prospect is in your sequence. On the call:

1. Confirm it: “Understood, we won’t call you again.”
2. Do not ask why or try to change their mind. Under Article 21(2) no reason is needed.
3. Log a “Do not call” outcome before the next dial.
4. Make sure every campaign, rep, and tool checks the same suppression list.

Do not delete the person entirely. The ICO advises keeping a do-not-call list and warns against deleting all record of people who objected, because you need the number to screen future lists.

A GDPR checklist for B2B calling teams

1. Write a legitimate interest assessment for each campaign: the interest, why calling is necessary, and the balancing test. Keep it ready to share on request.
2. Check each country’s national rule before you load a list: Germany, France, and the UK differ, and others may too.
3. Call only roles that fit the offer, and collect only the data you need to make the call.
4. Update your privacy notice with the legal basis and the legitimate interest, and check how third-party data was collected.
5. Suppress objections across every campaign, the same day.
6. Keep records: the assessment, the source of each contact, objections, and any consent proof the country requires (5 years in Germany, at least 3 in France).
7. Never use prerecorded or automated calls without prior express consent.

How DialSavvy handles this

DialSavvy checks every call, before it rings, against your do-not-call list and the calling hours in the contact’s time zone. A rep’s “Do not call” outcome adds the number to the list for every campaign. Rules come from versioned rule packs by country, and a pack past its review date stops dialing to that country. Checks against the UK’s TPS and CTPS registers are coming. See DialSavvy compliance and country coverage.

For calling hours outside the EU, see legal calling hours by country, and for North America, Canada’s telemarketing rules. Before your next European campaign, write the legitimate interest assessment and check each country’s rule first.