Glossary

What is legitimate interest under GDPR?

Legitimate interest is one of the lawful bases in Article 6 of the GDPR for using personal data. Many B2B senders rely on it for outreach to named people at companies. It is a balancing test, not a free pass: you need a real interest, the processing must be necessary for it, and it must not override the person's rights.

Published by Sellinger AI. Numbers and settings checked on 24 October 2026 against the fact register. Report an error.

What is the three part test?

The legitimate interests test
Part	Question
Purpose	Is there a legitimate interest, such as offering a relevant product to a business?
Necessity	Is using this person's data necessary for that purpose?
Balance	Do the person's interests, rights or reasonable expectations override yours?

Based on GDPR Article 6(1)(f) and the ICO's description of the test, as summarised in is cold email legal.

What does it not cover?

It does not override national rules on email marketing. In the EU, ePrivacy laws differ by country, and some require consent for marketing email even between businesses. In the UK, PECR sets its own rules on top. Legitimate interest answers whether you may use the data; the email rules answer whether you may send. See PECR.

What about the right to object?

Under Article 21, a person can object at any time to the use of their data for direct marketing, and after that the data must no longer be used for it. Treat an objection like an unsubscribe and apply it everywhere, across campaigns and channels.

How Sellinger handles it

When a contact replies with an opt out such as STOP or unsubscribe, in English, Bulgarian or German among other forms, the contact goes on the team's suppression list, the agent stops and the lead is closed out. A weak or unclear phrase never writes the permanent record: the agent stops and a person decides. Before every send on email, LinkedIn and WhatsApp, the platform checks the team's suppression list and refuses the send when the contact is on it or when the check cannot be completed.

An erasure function takes an email address, phone number or LinkedIn address, anonymizes the matching leads in the workspace and adds the identifiers to the suppression list so the person cannot be imported and contacted again. Where data sits: database, sign in and file storage on Supabase (Amazon Web Services, Stockholm). Application servers and background workers on Google Cloud (Finland). Web hosting on Vercel. This is not legal advice. Laws change and your facts matter, so check with a lawyer in the countries you target.

Common questions

Can I rely on legitimate interest for cold email?

Many B2B senders do for named business contacts, after doing the balancing test. National email rules may still require consent. Ask a lawyer.

Do I need to record the test?

It is good practice to write down your assessment, so you can show how you decided.

What happens if someone objects?

You must stop using their data for direct marketing. In Sellinger, a clear opt out reply adds them to the suppression list.

Sources and method

GDPR Articles 6 and 21, as summarised in is cold email legal, read 19 October 2026. Sellinger behaviour from the fact register, checked 24 October 2026.