Data Protection in Sales: Cold Outreach, Newsletters, and CRM Done Right

Why is data protection in sales more than a compliance chore?

A new salesperson buys an address list, sends 300 managing directors a friendly email, and calls half of them the next day. Three replies come back; one of them is a cease-and-desist letter. This is how many businesses first engage with the topic: too late and at a cost.

It is not only about risk, though. Prospecting cleanly makes you look more serious. A prospect who agreed to a message actually reads it. And a CRM that shows where a contact came from and what they allowed is worth more than a long list without provenance. The three areas that raise the most questions in sales are cold outreach, newsletters, and CRM. So the question is: which rules apply there, and how do you comply with them in everyday work? To answer it, we first clarify which two laws apply, then go through calls, promotional emails, newsletters, and documentation in the CRM, and finally sum it all up in the channel light.

Which two laws govern prospecting?

In everyday practice, two sets of rules are often lumped together. They ask different questions, however, and both must be satisfied.

An example shows why both matter. Storing an email address from a company's website may be permissible under the GDPR. Sending a promotional email to that address is nevertheless generally prohibited under the UWG as long as there is no consent.

Being able to get hold of an address does not mean you may write to it.

May I cold-call business customers?

Under Section 7(2) no. 1 UWG, promotional calls to consumers are only permitted with prior express consent. For businesses and other “market participants,” at least presumed consent is sufficient. This means the circumstances before the call must indicate that the person called is likely to have a genuine business interest in this specific offer.

Where the line lies is decided by courts case by case. According to a widely held view among the Chambers of Industry and Commerce, the mere fact that a company belongs to your target industry is not automatically enough. The closer the link between your offer and the core business of the person called, and the more concrete the occasion, the easier it is to justify presumed interest. An occasion might be a previous inquiry, a conversation at a trade fair, or a public tender.

If you record the occasion in the CRM, you can later show why you called. The guide Trade fairs and events describes how to turn trade fair contacts into conversations.

When may I send promotional emails to businesses?

For emails, the UWG is stricter than for calls. Under Section 7(2) no. 2 UWG, advertising by electronic mail without prior express consent is always an unreasonable nuisance, including toward businesses. Presumed consent is not enough here.

Section 7(3) UWG contains an exception for existing customers. It only applies if all four conditions are met together:

1. You received the email address from the customer in connection with the sale of goods or services.
2. You advertise your own similar goods or services.
3. The customer has not objected to this use.
4. You clearly informed the customer, when collecting the address and with every use, that they can object at any time without incurring costs beyond basic transmission rates.

For cold outreach by email this means: a first promotional email to someone you have never been in contact with is generally not permitted, even if it is polite and personal. The UWG contains no specific rule for direct messages on professional networks such as LinkedIn. Whether and when they are to be treated like emails is something you should have checked legally. The guide LinkedIn social selling describes how to build contacts on networks through posts and comments instead of sending sales messages.

What applies to newsletters and consent?

A newsletter is advertising by email. Outside the existing-customer exception, you therefore need consent that you can prove later. In practice, the double opt-in procedure has become established for this: after signing up, the prospect receives an email with a confirmation link, and only after clicking it are they added. This makes it possible to show that the sign-up came from the owner of the address.

How you ask for consent affects the outcome. D'Assergio, Manchanda, Montaguti, and Valentini (2025) analyzed 1,506 emails in which 1,396 companies asked for permission again after the GDPR took effect in May 2018. 26 percent relied solely on persuasion, meaning benefits or incentives, and 24 percent combined persuasion and information. In a field experiment, purely informative messages produced no additional opt-ins. The combination of clear information about data use and a tangible benefit worked best.

The authors point out that messages without sufficient information may breach the GDPR's transparency obligations. For your newsletter this means: explain briefly and honestly what readers get, how often, and how to unsubscribe. A voucher as bait is rarely necessary in B2B. A clear professional benefit works better. When a newsletter pays off in B2B and how it prepares conversations is described in the guide B2B newsletters.

A second study suggests that clean consent need not hurt business either. Godinho de Matos and Adjerid (2022) studied a large European telecommunications provider. After it obtained consent anew under GDPR rules, customers agreed to more data uses than before but continued to restrict sensitive uses. Sales and the effectiveness of marketing rose afterward. The study concerns consumers of one corporation, but the direction is instructive nonetheless.

How do you document contacts in your CRM in a compliant way?

For storing contact data for marketing purposes, companies usually rely on legitimate interest under Article 6(1)(f) GDPR. Recital 47 of the regulation explicitly names direct marketing as a possible legitimate interest. The guidance on direct marketing issued by the German data protection authorities in February 2022 stresses, however, that a genuine case-by-case balancing is required.

• Record the origin: For every contact, note where the data came from, such as an inquiry, a trade fair, the company's website, or a referral.
• Inform: If the data were not obtained from the data subject, Article 14 GDPR requires you to inform them about the processing, at the latest when you first contact them.
• Respect objections: If someone objects to direct marketing, Article 21 GDPR prohibits further processing of their data for that purpose. Record this on a suppression list so the contact is not approached again through another channel.
• Prove consent: For newsletter subscribers, store the time and method of sign-up and confirmation.
• Clean up: Delete contacts you no longer need, and set a fixed rule for doing so.

These fields are quickly created and just as quickly forgotten. The guide Data quality in your CRM describes how to set rules for mandatory fields that the team actually follows. When buying a CRM, it is also worth asking about the storage location and a data processing agreement, as the comparison CRM for small businesses explains. Under Article 83, GDPR violations can be punished with fines of up to 20 million euros or 4 percent of worldwide annual turnover. For small businesses this is a theoretical ceiling; the effort of dealing with a complaint or a warning letter is not.

The channel light: which route is suitable for what?

So that your team does not have to think it through anew for every contact, I summarize the rules as a channel light. It does not replace a case-by-case review, but it gives direction.

The light also shows where effort pays off. Creating occasions, for example through articles, talks, or trade fairs, shifts contacts from red to yellow and green. The guide Lead qualification describes how to then assess inquiries properly.

What you can put into practice right away

Most risks arise not from bad intent but because nobody on the team knows the rules. A short shared standard helps more than a long manual.

• Check whether sales is sending promotional emails to contacts without consent, and stop it immediately.
• Create CRM fields for the contact's origin, consent with date, and objection.
• Set up a suppression list that covers all channels, including newsletter and phone.
• Check the newsletter sign-up to make sure double opt-in and the unsubscribe link work in every issue.
• For phone prospecting, define which occasions the team considers sufficient, and note the occasion for every call in the CRM.
• Go through the channel light with your data protection officer or a specialist law firm and adapt it to your business.

We started by asking which rules apply to cold outreach, newsletters, and CRM and how you comply with them in everyday work. In short: promotional emails generally require prior express consent, including those sent to companies. Promotional calls are only permitted with at least presumed consent, for which a specific occasion counts for more than the industry, and the CRM records origin, consent, and objection. This does not replace a look at the individual case, which still belongs with your data protection officer or a specialist law firm.