Does the General Data Protection Regulation (GDPR) prohibit cold-calling?

Badis Khalfallah
3 min readNov 13, 2017

Outbound sales is the number one method for many businesses to drive revenues. It is one of the most efficient ways to deliver your sales message to the right people, but mostly, it is a low-cost exercise. Now if you are in Europe you might be in trouble starting from May 25th, 2018. From this date, any commercial communication will require previous opt-in.

Now, how did we get here? After four years of negotiation, the European Union adopted the General Data Protection Regulation (GDPR) in April 2016. This brings significant changes to handling B2B data.

Cold-emailing (could) be forbidden.

The terms of how the GDPR will be applied is yet to be defined. No one is really sure of how each national data agency will apply the European law (which is, after reading, quite open to interpretation). You have to know for example that the GDPR text does not mention once the word: “opt-in”.

However, it is clear that, from May 2018, you need to have an explicit consent of your personal and business recipients to push any commercial communication. This basically could ban cold-emailing.

If you send a commercial email to an individual who has not preciously double opted-in, you could be fined up to €20 million or 4% of our annual turnover. Now sending the first email to ask for consent is still something you can do according to this source:

If cold emailing is at the core of your lead generation strategy, you can obtain consent by sending a consent form as your first outreach email. Make sure that email with a request for consent does not directly promote your commercial content and that it is targeted at the person you are sending it to.

example of cold-email after GDPR: https://medium.com/@nina_cvijovic/the-ultimate-legal-guide-to-email-outreach-18e90a20ffea

But does the new law affect cold-calling too?

The GDPR specifically says that only email and SMS marketing messages need a previous double opt-in so post mail or cold calling is still opt-out. Nevertheless, the law requires you to give people the chance to opt-out of receiving further communication at the end of a call. Now the fun part is, how can you prove a client has given you his consent if it is forbidden to record calls?

Basically, all you can do — and it should be enough — is to demonstrate that you operate on a best efforts basis — you need to prove that you are aware of the new law and are taking measures. Keep a track of the time of your conversations, the date of every conversation, who you spoke to, and mainly if your clients are happy to be called back.

--

--