GDPR basics for recruiters doing business development outreach in the UK and EU

A recruiter writing to hiring managers handles personal data, even at a company address. Under UK and EU GDPR the usual basis is legitimate interests, which needs a documented balancing test, and the person can object to direct marketing at any time. UK PECR also governs email. This is not legal advice.

This post is part of the series on recruitment agency business development. It covers the contacts at hiring companies you write to for business, not the candidates you place, which carry their own rules. It is a plain English map, written from sources we read, and it will not replace a lawyer who knows your countries and your facts.

How we sourced this. We read the text of GDPR Articles 6 and 21 and Recital 47 on gdpr-info.eu on 7 November 2026. The ICO's pages on business to business marketing and on electronic mail marketing returned an access error (HTTP 403) when we tried to fetch them on 7 November 2026, so what we say about them comes from our earlier reading on 19 October 2026, also used in is cold email legal. Open the ICO pages yourself before you rely on them. The ICO notes that its B2B guidance is under review because of the Data (Use and Access) Act.

Is a hiring manager's name and email personal data?

Yes. A name, a job title at a named company and a work email that identifies a person are all information about an identifiable person. The ICO's B2B guidance says a work address that identifies a person still falls under UK GDPR "even if they are acting in their business capacity". A generic address such as info@ or sales@ is different, but you are rarely writing to those.

So when you build a list of hiring managers, you are a controller of personal data. That brings the basic duties: a lawful basis, being transparent about what you hold, keeping it accurate and not longer than needed, and respecting individuals' rights.

What lawful basis can a recruiter use for BD outreach?

Article 6 of the GDPR lists six lawful bases. For business development outreach to people who have not asked to hear from you, the realistic candidates are consent and legitimate interests. Most recruiters use legitimate interests, in Article 6(1)(f).

Recital 47 says a legitimate interest may provide a legal basis where the person's interests or fundamental rights do not override it, and that the test looks at the "reasonable expectations of data subjects based on their relationship with the controller". It also says processing for direct marketing "may be regarded as carried out for a legitimate interest". That is permission to rely on the basis, not a free pass.

The usual way to do the work is a three part test of purpose, necessity and balancing, which the ICO describes in its guidance. The EDPB has published Guidelines 1/2024 on Article 6(1)(f); we confirmed the page exists on 7 November 2026 but did not read the full guidelines for this post, so read them before you rely on them:

Write the test down and keep it. The balancing is stronger when the message is relevant to the person's role, such as a recruiter writing to someone who posted a vacancy, and weaker when it has nothing to do with their job.

What does PECR add for email in the UK?

PECR, the Privacy and Electronic Communications Regulations, governs marketing sent by electronic mail. The ICO's guidance, as we read it on 19 October 2026, makes these points:

• Individuals need to have specifically consented to marketing email, with a narrow soft opt in for your own past customers.
• The ICO says "You can email or text any corporate body", such as companies, LLPs and government bodies. The consent rule is aimed at individuals.
• Even so, you must not conceal your identity and you must provide a valid address for opt outs. The ICO recommends keeping a do not email list for businesses that object.
• Sole traders and some partnerships are individual subscribers, treated like individuals with greater protection. A small recruitment firm's client may be one.
• UK GDPR still applies to the personal data in the work address, as above.

So the sending rule can be light and the data rule still applies. Do not read the corporate subscriber point as "no rules".

What about the EU?

In the EU, the GDPR is directly applicable, and the email rules sit in each country's law implementing the ePrivacy Directive. Those national rules differ, and some countries require consent for marketing email even to business addresses. We did not read each country's law. Before you send into a country you have not checked, ask a local lawyer. The same goes for LinkedIn messages: the platform's rules are separate from the law, and your own national rules on electronic marketing may still cover a private message.

What is the right to object and how do you handle it?

Article 21(2) says that where personal data are processed for direct marketing purposes, the person has the right to object at any time. Article 21(3) says that after an objection the data "shall no longer be processed for such purposes". Article 21(4) says the right must be brought to the person's attention at the latest at the time of the first communication and presented clearly and separately.

In practice:

1. Tell people in your first message that they can ask you to stop, with a plain sentence or a clear way to say so.
2. Treat any "no", "stop" or "unsubscribe" as an objection, on every channel, not only the one it came in on.
3. Keep a suppression list of the people who objected. Deleting the record makes it easy to contact them again by mistake, so keep the minimum needed to remember the objection.
4. Do not reinterpret. A rude reply is still an objection.

Sellinger puts an opt out reply on the team's suppression list, stops the agent and closes the lead, and it checks the list before every send on email, LinkedIn and WhatsApp. That supports your compliance. It does not make an unlawful campaign lawful.

What should a first message tell the person?

The UK and EU rules around transparency point to the same minimum:

• who you are and which agency you work for;
• why you are contacting them, in a sentence;
• where you found their details, for example "your public job post" or "your LinkedIn profile";
• how to stop further messages;
• where to find your privacy notice.

A made up closing line: "I found your details through the vacancy on your careers page. If you would rather I did not write again, reply stop and I will not. My privacy notice is at [your link]."

Keep your privacy notice factual. List the categories of data you hold, the source, your purpose and basis, how long you keep it and how to exercise rights.

A checklist before the first send

1. Written legitimate interests test, saved with a date.
2. A privacy notice that covers business contacts, linked in your first message.
3. A suppression list that all channels share.
4. A rule for deleting contacts you no longer need.
5. A decision per country you target: UK, and each EU country, with its email rules checked.
6. A named person who answers a data request within the legal time.
7. A processor agreement with every tool that handles the data. Sellinger's is the data processing agreement.

When do you need a lawyer?

Always before you start in a new country, when a regulator or a contact complains, when you want to move beyond business contacts to personal email addresses, and when you intend to use contact data for more than the stated purpose. This is not legal advice, and nothing here replaces advice on your own facts. For the wider comparison of email regimes see is cold email legal and for what Sellinger enforces on every message see the outreach rules.