See consent and unsubscribe in Lumo
In a demo we show how consent sits on the person, how a campaign checks it and how a GDPR request runs. Or request a trial workspace.
- Home
- Guides
- Email marketing and GDPR
B2B email marketing within GDPR
Newsletters and campaigns to business contacts are allowed, but not to just anyone. This guide explains in plain language when you need consent, how to record it, how to handle unsubscribes and what to agree in your CRM. Practical, with templates.
This is not legal advice
This guide describes how B2B teams handle email marketing and GDPR in practice. Rules differ by country and depend on your situation. When in doubt, get advice from a lawyer or your data protection officer, and check the guidance of the data protection authority in your country.
Why B2B email falls under GDPR too
A common belief: "We only email businesses, so GDPR does not apply to us." That is usually wrong. GDPR is about personal data, and a business address like firstname.lastname@company.com is personal data. It identifies a person. Only a generic address like info@ is usually not.
Next to GDPR there is a second set of rules that matters for email marketing. In the EU these come from the ePrivacy rules, which each country has written into its own law. They cover unsolicited electronic marketing. In some countries, such as the Netherlands, those rules also apply to business addresses. In others, business addresses are treated differently from personal ones. If you email across borders, check what applies in each country.
Does this sound familiar? A sales team collects two hundred business cards at a trade show. Marketing adds them to the newsletter list, because "they took our card, after all". A few weeks later someone calls to ask where their address came from and whether they can be removed. Nobody knows when or how they were added.
That is the real problem. Not that emailing is forbidden, but that you cannot show on what basis you do it. GDPR expects you to be able to demonstrate that. So it is less about the email itself and more about what you record in your CRM: who gave consent, when, for what, and through which form.
This guide helps you get that in order. It is written for marketers and sales teams, not lawyers. It explains the legal bases, how to ask for and record consent, how unsubscribing works and which retention periods to choose. With templates you can copy and adapt.
For the difference with a one to one email to someone who reached out first, see also the guide on lead follow up. A personal reply to a question is different from a newsletter.
The terms you need to know
In plain language. The precise legal definitions are in the law itself.
Consent
Someone actively said yes to a certain kind of email. No pre ticked box, no consent hidden in the terms and conditions. You must be able to show when and how it was given.
Existing customers
Many EU countries have an exception for customers you sold to, for email about similar products or services of your own. The condition: you offered an easy opt out when collecting the address and in every email.
Legitimate interest
A GDPR legal basis where you weigh whether your interest outweighs the recipient's. For marketing email it is often not enough on its own next to the rules for unsolicited messages. Get advice on this.
Unsubscribe
Every marketing email has a clear, working unsubscribe link. Anyone who unsubscribes gets no more marketing email, not through another list or from a colleague either.
Retention period
You do not keep personal data longer than needed. Agree per type of data how long, and clean up after that.
Record of processing
An overview of what personal data you process, why, on which basis and in which systems. Your email tool and CRM belong in it, with where the data is stored.
Set up GDPR compliant B2B email marketing in seven steps
Map who you email
List every group in your mailing list: customers, former customers, leads from forms, event contacts, bought lists, partners. Write down per group how they got there. That decides which rule applies.
Decide the legal basis per group
Customers with an opt out offered: often the existing customer exception. People who signed up: consent. Business cards and bought lists: usually not without consent. When in doubt, treat it as no consent.
Ask for consent the right way
A separate box that is not pre ticked, with a short text saying what people get and how often. Prefer double opt in: the person confirms through a link in an email. Then you know the address is theirs.
Record consent on the person
Store in your CRM per person: whether there is consent, when, through which form or channel, with which wording, and when it was confirmed. Without that you cannot demonstrate it later.
Handle unsubscribes and suppression
Every marketing email has an unsubscribe link that works straight away. An unsubscribe applies to all your marketing email, not just that one list. Hard bounces and complaints are removed permanently.
Choose retention periods
Agree how long you keep unresponsive leads, former customers and unsubscribed addresses. Clean up after that. For unsubscribed addresses, keep only what you need to avoid emailing them again.
Agree how you handle requests
Someone asks what data you hold, or wants to be erased. Agree who handles it, within which time and how you make sure the address does not come back through an import or form.
Template: what you may and must do per group
A practical rule of thumb for many EU countries. Not legal advice. Check it for your own situation and each country you email.
| Topic | Can you send marketing email? | What you record |
|---|---|---|
| Customer who bought | Usually yes, about similar products or services of your own, if you offered an opt out when collecting the address. | That they are a customer, and that every email lets them opt out. |
| Sign up through a form | Yes, for what the consent text promised. | Date, form, wording of the box, confirmation for double opt in. |
| Lead who asked for information | A personal reply to their question, yes. A newsletter only with consent. | The question, and separately whether there is consent for marketing. |
| Business card from an event | Usually not without consent. A personal follow up about your conversation is something else. | Where and when you met, and whether consent was asked. |
| Bought or rented list | Usually not, unless people consented to email from you. That is rarely provable. | When in doubt, do not use it for marketing email. |
| Generic address (info@) | Not personal data, but rules for unsolicited messages may still apply. | Get advice for your situation. |
| Unsubscribed address | No, never marketing email again. | That it unsubscribed, so it does not come back. |
Rules of thumb for practice, November 2026. Rules differ by country and can change.
Templates: consent text, confirmation email and footer
Adapt these examples to your company and have them checked. They show how short and clear it can be.
Consent box on a form
Not pre ticked, separate from the box for terms and conditions:
"Yes, send me the [company] newsletter once a month with practical tips about [topic]. You can unsubscribe at any time with one click at the bottom of every email. Read our [privacy policy]."
Double opt in confirmation email
Subject: Please confirm your subscription
"Hi [first name], you signed up for the [company] newsletter. Click the button below to confirm. Did not sign up? Then you can ignore this email and you will not hear from us."
Footer in every email
"You receive this email because you signed up for the [company] newsletter on [website]. No longer interested? [Unsubscribe]. [Company], [address]."
What you record per person
- Marketing email consent: yes or no.
- Date and time of consent.
- Source: which form, page or event.
- The wording of the box at that moment.
- Date of confirmation for double opt in.
- Date of unsubscribe, if any.
Really store the wording of the box. If you change the form a year from now, you still want to know what someone said yes to back then.
Worked example: cleaning up an existing mailing list
A made up example of how to tackle an existing list. A B2B services firm has 4,000 addresses on its newsletter list. Nobody knows exactly where they all came from.
Step 1: split by source. After an evening with the exports it turns out: 900 addresses are customers or former customers with an invoice. 1,300 came in through the sign up form on the website, with a date. 1,100 are business cards and event contacts. 700 have no recognisable source.
Step 2: decide per group. The firm keeps emailing customers about similar services, with an unsubscribe link. The form sign ups stay, because they gave consent. Event contacts and addresses without a source get no newsletter anymore.
Step 3: one clean question. Instead of a newsletter, the firm has the reps who know the event contacts follow up personally and ask whether they would like the newsletter. Those who say yes sign up through the form with double opt in. Get advice on whether a one time email asking for consent is allowed in your situation. That is not the same everywhere.
Step 4: record it. For every person who remains, the CRM shows the legal basis and the source.
The result in this example: a list of about 2,200 addresses instead of 4,000. Smaller, but every address can be accounted for. And people who said yes themselves read the newsletter more often than people who do not know why they get it.
All numbers in this example are invented.
Email marketing and GDPR pitfalls
Pre ticked boxes
A box that is already ticked does not count as consent. Always leave it empty and let the visitor choose.
Consent hidden in the terms
"By submitting this form you agree to our newsletter" is not a free choice. Make it a separate box.
Unsubscribe per list, but not everywhere
Someone unsubscribes from the newsletter and a week later gets an event invite from a colleague using another tool. Make sure an unsubscribe applies everywhere you send marketing email.
An erased person who comes back
You erase someone at their request, and three months later they are back through an import or a form. Keep a marker that tells you this address must not return, without the rest of their data.
No retention period
Leads from five years ago who never became customers usually do not belong in your database anymore. Pick a period and clean up. The guide on CRM data quality helps with the clean up.
Your email tool missing from the record
Your email tool and CRM process personal data on your behalf. Put them in your record of processing, sign a data processing agreement and know which country the data is stored in.
Checklist for every campaign
Run through this before you click send.
- The segment only contains people with consent or a valid exception.
- Unsubscribed addresses, hard bounces and complaints are excluded.
- The email has a working unsubscribe link and your company name and address.
- Subject line and sender are honest and recognisable.
- The content matches what people consented to.
- A test email has been sent and the unsubscribe link tested.
- You know who handles replies or complaints about this campaign.
- Your email tool is in your record of processing with a data processing agreement.
Consent and unsubscribe in Lumo
In Lumo the marketing consent flag sits on the person. In campaigns, "require explicit consent" is on by default, and consent is checked again at the moment of sending. The segment preview shows who is excluded and why. Every template must contain an unsubscribe link, an unsubscribe applies to the whole workspace, and the one click unsubscribe header is supported. Bounces and complaints are suppressed permanently.
Forms have a consent field type and double opt in: an anonymous submission never switches consent on by itself but sends a confirmation link. Under security and privacy you export everything held about a person, or erase or anonymise them with double confirmation. Erased addresses are kept as a hash, so they do not come back through a form or import.
- Consent required by default and checked again at send time
- Unsubscribe applies to the whole workspace, with one click unsubscribe
- Double opt in on forms
- Export, erasure and retention periods with daily clean up
What to know about privacy in Lumo
Lumo data is stored in London, in the United Kingdom. Include that in your record of processing.When you erase a person, a colleague's privately synced Gmail is not included, so ask colleagues to delete that mail themselves. Campaigns have no daily send limit or approval step, so agree that within your team.
Frequently asked questions about B2B email marketing and GDPR
Does GDPR apply to business email?
Yes, when the address identifies a person, like firstname.lastname@company.com. A generic address like info@ is usually not personal data. This is not legal advice.
Do you need consent for B2B email marketing?
It depends on the country. In some, such as the Netherlands, consent is generally needed for business addresses too. Many countries have an exception for existing customers and similar products, if you offered an opt out. Get advice for your situation.
Can you email people whose business card you have?
A personal follow up about your conversation is different from a newsletter. For marketing email you usually need consent. Ask for it during the conversation or let people sign up through a form.
What is double opt in?
Someone signs up and then confirms through a link in an email. That way you know the address belongs to that person, and you have a confirmation moment to record.
How do you record consent?
Per person in your CRM: whether there is consent, when, through which form, with which wording and when it was confirmed. Keep the wording of the box too, even if you change the form later.
Can you email a bought list?
Usually not for marketing, unless the people consented to email from you. That is rarely provable. When in doubt, do not.
How long can you keep personal data?
No longer than needed for the purpose. Agree a period per type of data, for example for unresponsive leads and former customers, and clean up after that. The law sets no fixed number of years for marketing.
What do you do when someone asks to be erased?
Erase or anonymise their data within the legal deadline, and make sure they do not return through an import or form. Record the request and how you handled it.
Keep reading
