Honest Intros Sign in

Glossary

Legitimate interest

Legitimate interest is one of the lawful bases for processing personal data under the GDPR, allowing processing that is necessary for a genuine interest of the organisation, provided the person's rights do not override it.

Updated · By Otman Ounana · How we research

Why it matters when you send from your own Gmail

GDPR Recital 47 says that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.[1] Two limits matter for cold email. The right to object to direct marketing is absolute, so you must stop when asked.[2] And data protection law is separate from the rules on email itself: some countries, Germany among them, require prior express consent for electronic advertising unless an exception applies.[3] Tell recipients where you found their address if they ask.

Example

A French or Irish business email, relevant to the recipient's job, can rest on legitimate interest. You record why, you include an opt-out and you stop as soon as someone objects.

What to do

Write down, for your own records, why the email is relevant to the recipient's role and what you did to limit the data you use. Answer any objection immediately and stop writing to that person.

Related terms

All terms are on the glossary.

Read next

  • France (CNIL)The CNIL's rules for B2B cold email in France, quoted in French with our translation: legitimate interest, a message related to the person's job, informing people, and an easy way to refuse.
  • Germany (UWG § 7)Germany's UWG § 7 on cold email, quoted in German with our translation: why B2B cold email needs prior express consent, the narrow existing-customer exception, and what to do instead.
  • CASLCASL is Canada's Anti-Spam Legislation, a consent-based law that prohibits sending a commercial electronic message unless the recipient has consented, expressly or by implication.
  • Double opt-inDouble opt-in is a sign-up process in which a person first asks to join a list and then confirms by clicking a link sent to their address.

Sources

  1. European Union, GDPR, Recital 47. “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Read on 1 October 2026.
  2. UK Information Commissioner's Office, Right to object. “This is an absolute right and there are no exemptions or grounds for you to refuse.” Read on 1 October 2026.
  3. Germany, Federal Ministry of Justice, Gesetz gegen den unlauteren Wettbewerb (UWG), § 7. “bei Werbung unter Verwendung einer automatischen Anrufmaschine, eines Faxgerätes oder elektronischer Post, ohne dass eine vorherige ausdrückliche Einwilligung des Adressaten vorliegt” Read on 1 October 2026.