Legitimate Interest for B2B Under GDPR: A Practical Guide

Legitimate interest can be a valid lawful basis for B2B marketing under the GDPR, but only if you pass a three-part test (purpose, necessity, balancing) and write the answer down. It is not a loophole for B2B, and it does not replace consent in every case. The channel you use and the type of business you contact change the answer.

This guide is written for New Zealand businesses that sell to people in the UK or EU, or that hold business contacts from those places. We explain the test, the consent question, the difference between a limited company and a sole trader, and how it sits next to New Zealand’s own rules.

TL;DR

• Legitimate interest is one of the lawful bases in the GDPR. It is the most flexible one, but you have to pass a purpose, necessity and balancing test and document it in a Legitimate Interests Assessment (LIA).
• GDPR still applies to B2B data when the contact is a named person, such as a work email address like firstname@company. “B2B” does not exempt you.
• Email rules sit on top of GDPR. In the UK, PECR lets you email corporate subscribers without consent, but sole traders are treated as individuals.
• New Zealand has its own rules: the Privacy Act 2020 and the Unsolicited Electronic Messages Act 2007, which is consent-based.
• Transparency is the fix for most weak spots: tell people in your privacy notice what you do and why.

Table of Contents

• Does GDPR apply to B2B data at all?
• The lawful bases, and where legitimate interest sits
• The three-part test, step by step
• Writing the Legitimate Interests Assessment
• Consent or legitimate interest: which one fits?
• Limited company or sole trader: the line that matters
• What legitimate interest does not give you
• How this sits with New Zealand law
• A worked example: contacts met at an event
• Our perspective
• Using EcoCard to keep contact sharing clean
• A short checklist before you send
• FAQ
• Sources

Does GDPR apply to B2B data at all?

Yes, whenever you handle information about an identifiable person. A business name alone is not personal data. A named contact, their direct email, their job title and their phone number are. The fact that someone is acting in a work role does not remove them from the rules.

There is also the question of whether the GDPR reaches a New Zealand business in the first place. The regulation applies to businesses outside the EU whose processing relates to offering goods or services to people in the EU, or to monitoring their behaviour. A Wellington software firm that actively markets to German companies is in a very different position from one that has a single UK customer who found it on their own. If you are unsure which side you sit on, that is a question for a privacy lawyer with EU or UK experience.

For UK contacts, the relevant law is the UK GDPR, which is written very similarly. The ICO guidance used throughout this article is UK guidance. The EU’s own approach is set out in the European Data Protection Board guidelines on Article 6(1)(f), and national regulators in each EU country add their own views.

The lawful bases, and where legitimate interest sits

The GDPR gives you a short list of grounds for processing. The European Commission lists them: consent, contract, legal obligation, vital interests, public task and legitimate interests. For B2B marketing, two are realistic. The ICO says the two most relevant in this context are consent and legitimate interests.

The ICO describes legitimate interests as the most flexible basis. It is not tied to a single purpose, so it can fit many situations. That flexibility is also the risk. The EDPB’s small business guidance treats it as a basis that needs a real assessment, not a default you tick.

The three-part test, step by step

The ICO frames the test in three parts. You need to pass all three, in order.

1. Purpose: what is your interest?

Name it specifically. “Marketing” is vague. “Telling procurement managers at UK logistics firms about our freight-tracking tool, which fits their role” is a purpose. Commercial benefit counts as a legitimate interest, and Recital 47 of the GDPR says direct marketing may be a legitimate interest in principle. Being allowed to claim the interest is only the first hurdle.

2. Necessity: is this the least intrusive route?

The processing has to be necessary for your purpose. If you could reach the same result another way that uses less personal data, or none, the necessity test is in trouble. A general advertising campaign that never touches a named person’s data is the classic comparison. Document why a targeted approach is needed, not simply convenient. Targeting a role at relevant companies is easier to defend than buying a giant list and mailing everyone on it.

3. Balancing: do their rights outweigh your interest?

Here you weigh the impact on the individual. The factor that decides most cases is reasonable expectation. If a business contact would be surprised or annoyed by how you use their details, your interest probably does not win. A sales director who gave you a card at a trade show and gets a relevant follow-up a week later will rarely be surprised. The same person receiving mail from a firm they have never heard of, using data scraped from somewhere unrelated, probably will be.

The ICO’s guidance is clear that you also have to tell people about your interests in your privacy notice. Transparency does not rescue a processing activity that is plainly unfair, but it keeps an otherwise reasonable one defensible.

Writing the Legitimate Interests Assessment

An LIA is a short written record of the three parts above. The ICO expects you to be able to show your reasoning. Without a written assessment, you cannot demonstrate compliance when a regulator or a complaining individual asks.

Two things catch people out:

• One LIA per purpose. Legitimate interest is not a set-and-forget exemption. If you email prospects for product news and also enrich your CRM from a data provider, those are separate purposes and each needs its own assessment.
• Review it. If the audience, the data source or the message changes, the balance can change too.

A workable LIA is usually one to two pages. It states the purpose, why the processing is necessary, what data you use, who is affected, what safeguards you apply (easy opt-out, limited data, short retention) and your conclusion. If you are weighing how B2B outreach differs from consumer outreach in practice, this overview of B2B versus consumer lead generation shows why targeting by role and sector matters for the necessity argument.

Consent or legitimate interest: which one fits?

The two are not rivals so much as tools for different jobs. Consent is clear and strong, but it must be freely given, and a person can withdraw it at any time. Legitimate interest lets you act without a prior opt-in, but puts the burden of justification on you.

Some channels leave no real choice. The ICO notes that for certain methods, such as automated calls, consent is required. For email to corporate subscribers, legitimate interest is often the fitting basis, provided you pass the test.

If you manage many channels at once, this write-up on how UK and EU GDPR differ helps you choose a lawful basis by channel and by recipient type, especially if your email team sends to both regions.

Limited company or sole trader: the line that matters

This is the mistake we see most often. In the UK, PECR separates corporate subscribers from individual subscribers. A limited company is a corporate subscriber. A sole trader or non-incorporated partnership is treated as an individual.

The ICO’s electronic mail guidance says you can send unsolicited marketing email to corporate subscribers without consent or a soft opt-in. For individual subscribers, you need consent or you must meet all the conditions of the soft opt-in. So the sentence “it’s B2B, so we don’t need consent” is only partly true. Check what kind of entity owns the email address before you assume anything.

PECR is UK law. Other EU countries implement the ePrivacy rules their own way and some are stricter about B2B email. Do not copy the UK position across the continent without checking the country.

What legitimate interest does not give you

It is not a blank check. The EDPB and national regulators stress that it is the most flexible basis and also the one most exposed to challenge. A few limits to keep in view:

• No surprises. If the use falls outside what the person reasonably expects, the balance tips against you.
• No sensitive shortcuts. Special category data needs a further condition; legitimate interest alone does not cover it.
• Objections matter. If someone objects to direct marketing, stop. Make opting out easy in every message.
• Bought lists need homework. Using third-party data does not move the responsibility away from you. Check where the data came from and whether people were told their details might be passed on.

Industry bodies argue the other side. The German Dialogue Marketing Association, in its comments on the EDPB guidelines, says direct marketing serves businesses and consumers alike and that selection criteria under legitimate interest are possible but have limits. Both views point to the same practice: think it through and keep a record.

How this sits with New Zealand law

If you operate from New Zealand, GDPR is not your only framework. Three Acts matter for B2B outreach at home.

• Privacy Act 2020. It governs how agencies collect and use personal information. Use should match the purpose the information was obtained for, or a directly related one. New Zealand’s Act has no “legitimate interests” basis like the GDPR. It works on purpose and principles instead, so an LIA is not a New Zealand legal requirement, though the thinking behind it is useful for any business.
• Unsolicited Electronic Messages Act 2007. This is the anti-spam law. According to a New Zealand law firm’s summary, it rests on consent, clear sender identification and a working unsubscribe option. That is different from the UK corporate subscriber exemption, so a UK-style approach does not carry across.
• Sector codes. The Telecommunications Information Privacy Code 2020 restricts how telecommunications agencies use subscriber information, including for direct marketing, which matters if you work with data from that sector.

In practice, a New Zealand business marketing to both home and UK contacts ends up with the stricter standard for each audience. Consent-based for local email. Legitimate interest with an LIA for qualifying UK corporate contacts. Separate records for each.

A worked example: contacts met at an event

Say your team meets a procurement manager at a UK trade show. They hand over their details and say they would like to hear about your product. That is consent, or at least a clear invitation, and you should record it.

Now say a salesperson scans a badge at a stand and the person said nothing about follow-up. Legitimate interest might support one relevant, expected follow-up to a corporate address, if your LIA says so and your privacy notice explains it. Adding that person to a monthly newsletter is a different purpose and a weaker case.

The same logic applies to contacts you collect through digital cards, QR codes or tap sharing. Where a person chooses to share their details with you, the situation is much clearer than with data you gather elsewhere. For event follow-up that respects privacy, see our guide on how to capture leads at events and follow up, and our notes on contactless networking in NZ.

Our perspective

We build digital business cards, so we spend a lot of time on the moment two professionals swap details. That moment is the best lawful basis there is, because it starts with a person choosing to share. In our experience, most B2B compliance trouble begins later, when a contact turns into a mailing list without anyone deciding what the purpose is.

That is why we favour sharing methods where the person in front of you decides what you receive, and where the details they see are current. With EcoCard, the person receiving a card does not need to install an app, and a card owner can change details and roles live, so nobody is working from an outdated copy of someone’s information. For business accounts, central management means that when staff join or leave, their cards are set up or switched off in one place. That is a privacy benefit as well as a branding one, because ex-employees’ contact pages do not linger.

Our advice: write the LIA before the campaign, not after the complaint. Keep it short. Keep it honest. Revisit it when the audience changes.

— Chris

Using EcoCard to keep contact sharing clean

If your team collects contacts at events and meetings, a digital card gives people a clear, voluntary way to connect. Individual plans are 9.99 NZD per month, with additional EcoCards at 4.99 NZD per month. For businesses, Starter is 19.99 NZD per month, Business is 49.99 NZD per month and Teams is 99.99 NZD per month. Enterprise is available with no published price. See the options on our pricing page, or read how employee digital business cards work for NZ teams.

This article is general information, not legal advice. For a decision about a specific campaign or data source, talk to a privacy lawyer in the country whose law applies, or to the relevant regulator, such as the Office of the Privacy Commissioner in New Zealand.

A short checklist before you send

1. Confirm which law applies: GDPR, UK GDPR, the NZ Privacy Act, or more than one.
2. Identify the channel. Email, phone, text and post each have their own rules.
3. Check the recipient type. Limited company or sole trader?
4. Write the LIA: purpose, necessity, balancing.
5. Update your privacy notice so it tells people what you do and why.
6. Build an easy opt-out into every message and honour it quickly.
7. Record where each contact came from.
8. Review the assessment when the list, message or tool changes.

FAQ

What is the difference between legitimate interest and consent under GDPR?

Consent needs the person to opt in first and lets them withdraw at any time. Legitimate interest needs no opt-in, but you must pass the three-part test and keep a written assessment. Neither is automatically better. The right one depends on the channel, the recipient and what they would reasonably expect.

Does GDPR apply to B2B data?

Yes, when the data identifies a person, such as a named work email address or direct phone number. A bare company name is not personal data. Whether the GDPR applies to a New Zealand business also depends on whether it offers goods or services to people in the EU or monitors them.

Can I email any business contact under legitimate interest?

Not automatically. In the UK, corporate subscribers can be emailed without consent, but sole traders and unincorporated partnerships are treated as individuals. You still need to pass the test and respect objections. In New Zealand, the Unsolicited Electronic Messages Act 2007 is consent-based.

Do I need a written assessment every time?

You need an LIA for each distinct purpose you rely on legitimate interest for. Without one, you cannot show a regulator how you reached your decision. Keep it short and review it when your audience or data source changes.

Sources

• Legitimate interests | ICO
• Business-to-business marketing | ICO
• How do we comply with the PECR electronic mail marketing rules? | ICO
• Guidelines 1/2024 on Article 6(1)(f) GDPR | EDPB
• Process personal data lawfully | EDPB
• Legal grounds for processing data | European Commission
• The GDPR’s Reach: Material and Territorial Scope | Wiley
• Email Marketing Laws in New Zealand | Sprintlaw
• Office of the Privacy Commissioner

Recommended

• Follow Up Within Hours to Capture Leads at Events, Ops & Privacy

This article was produced with AI assistance and reviewed for accuracy. It is provided for general information only and is not professional advice.