Legitimate interest (GDPR)

GDPR Article 6(1) lists six lawful bases for processing personal data. Point (f), legitimate interests, allows processing that is necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the interests, rights or freedoms of the person. Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest.

The UK ICO frames it as a three-part test: a purpose test (is there a legitimate interest?), a necessity test (is the processing necessary for it?) and a balancing test (do the person's interests override it?). Organisations usually record this in a legitimate interests assessment (LIA). The person's reasonable expectations matter: a relevant work email to someone in their professional role sits differently from contacting them about something unrelated.

Under Article 21, people can object to processing for direct marketing at any time, and once they do, their data must no longer be processed for that purpose. Separate electronic marketing laws (such as national ePrivacy rules) may also apply. This is general information, not legal advice; take advice for your situation.

Most B2B cold outreach in the EU and UK relies on legitimate interests rather than consent. That only holds up if targeting is relevant, people are told who you are and how you got their details, and opt-outs are honoured promptly and permanently through a suppression list.

Skrap.ai supports your compliance work but can't decide your lawful basis for you. Customers are the data controller for contact data they submit, and Skrap processes it on their instructions. A team-wide do-not-contact list (emails and domains) in Lists helps you honour objections, and Settings offers self-serve data export and account deletion. See GDPR and data protection.