GDPR and B2B cold email in the Baltics and Finland.

GDPR and B2B prospecting: what legitimate interest actually permits

Foreign manufacturers prospecting in the Baltics or Finland may identify purchasing managers, technical directors and other relevant employees. GDPR applies to identifiable professional contacts, including named company email addresses.

Regulation (EU) 2016/679, Article 6(1)(f), 2016 permits processing necessary for a legitimate interest unless overridden by an individual's rights and freedoms. Recital 47 of GDPR, 2016 recognises direct marketing as a possible legitimate interest, not blanket permission to email.

Assess purpose, necessity and balancing: Is the business interest lawful? Are contact details needed rather than less intrusive options? Would the recipient expect contact, and do their rights outweigh the business interest? The Court of Justice reinforced these requirements in its judgment of 4 October 2024, Case C-621/22.

GDPR governs personal data processing; national electronic marketing laws govern sending. Both must permit the activity. Legitimate interest cannot override required consent.

Lithuania: unsolicited B2B email became easier in 2026

Since 22 April 2026, amended Article 81 of Lithuania's Law on Electronic Communications has removed prior consent for legal person subscribers or registered electronic communications service recipients. Senders must offer a clear, free and easy way to refuse further marketing.

VDAI confirmed this in guidance dated 19 May 2026. Its 2026 FAQ covers generic and named company addresses, including `info@company.lt` and `firstname.lastname@company.lt`, where they belong to the legal entity and suitable opt out arrangements exist. The employee assigned the address may also object.

A German manufacturer may contact a Lithuanian purchasing director without prior consent if corporate communication conditions and GDPR are satisfied. This does not necessarily extend to private mailboxes or individuals outside corporate roles.

Relevant authorities and sources: Lithuanian Law on Electronic Communications, Article 81, amendment adopted 16 April 2026, State Data Protection Inspectorate, VDAI, guidance issued 2026 and Communications Regulatory Authority, RRT, official website, checked 2026.

Latvia: distinguish the company from the individual

Latvia's Information Society Services Law, Articles 8 and 9, consolidated text checked 2026 generally requires prior consent for marketing emails to natural persons, with statutory exceptions. An address obtained in a commercial transaction may be used for similar goods or services under the existing customer exception, with an opportunity to refuse.

Article 9(6) limits consent restrictions to natural persons. For named employees, determine whether the email legally addresses the company or the individual.

DVI explains individual consent in guidance published in 2020. Its 2023 telemarketing guidance distinguishes identifiable individuals from communications without an identifiable recipient. No definitive published DVI exemption for every `firstname.lastname@company.lv` address was found.

Distinguish generic addresses from named employees. Where classification is uncertain, obtain consent or specific local legal advice. Sources: Information Society Services Law, 2026 and DVI, 2020.

Estonia: relevance to the employee's duties matters

Under Section 103¬π of the Electronic Communications Act, consolidated 2025, using a natural person's electronic contact details generally requires consent, subject to an existing customer exception. Company contact details may be used without prior consent if recipients can easily and freely refuse further emails electronically.

The Information Society Services Act, Section 5, consolidated 2024 requires identifiable marketing and advertisers. AKI offers direct marketing, checked 2026 guidance.

In its guidance on electronic contact details, 2015, AKI says a named work address may qualify as a company contact if the offer relates to the employee's responsibilities and decision making authority. Equipment relevant to purchasing duties may qualify; unrelated personal advertising may require consent. Establish the actual connection: a job title alone cannot establish relevance for every offer.

Finland: corporate marketing is permitted, but not every work address qualifies

Finland's Act on Electronic Communications Services, Act 917/2014 distinguishes natural persons and organisations in Sections 200 and 202. Marketing to natural persons generally requires prior consent, subject to the existing customer exception. Section 202 allows organisational marketing unless the organisation has expressly prohibited it. Every message must offer an easy, free way to object.

A named address such as `firstname.lastname@company.fi` identifies an individual. Treat it as organisational only when the offer relates closely to duties and authority, such as equipment purchasing. Otherwise, prior consent is safer.

Source: Act 917/2014, Sections 200 and 202, official English translation.

Comparison: B2B cold email rules in four countries

Sources: Lithuania, VDAI 2026, Latvia, Information Society Services Law, 2026, Estonia, Electronic Communications Act, 2025, and Finland, Act 917/2014.

The table concerns initial unsolicited business marketing. GDPR still applies whenever personal data are processed.

What a compliant first email should contain

Make the first email specific and transparent. Include:

1. Sender identity. Name the manufacturer and the person contacting the prospect.
2. Reason for contact. Explain relevance to the recipient's professional responsibilities.
3. Source of personal data. Identify where the address came from, such as the company website, where applicable.
4. Privacy notice. Link to an accessible notice covering the controller, purpose, legal basis, retention and individual rights.
5. Opt out. Offer a working reply address or another simple way to stop marketing.

GDPR Article 14 governs information and disclosure timing when data come from another source, including the first communication where applicable. Article 21 gives individuals a right to object to direct marketing. Source: GDPR, Articles 14 and 21, 2016.

A privacy notice link does not replace required direct disclosures. An unsubscribe facility does not legitimise prohibited emails.

Handling opt outs and suppression lists

An objection stops direct marketing concerning that individual. GDPR Article 21(3) prohibits processing their data for that purpose after objection. Source: GDPR, 2016.

Record the address, objection date, scope and source. Suppress it across sales and marketing systems, inform outsourced prospecting providers where necessary, and prevent reactivation through imported lists. Keep only the minimum information needed to honour objections, with an appropriate legal basis and retention policy. Suppression records must not become another marketing database.

Coordinate objections across teams to prevent renewed contact from old lists.

What records should a sales organisation keep?

Document a legitimate interest assessment before campaigns, covering commercial purpose, necessity, reasonable expectations, privacy impact and safeguards. Record contact sources, acquisition dates, privacy notices, national sending rules, consent evidence where required, campaign activity, objections, suppression actions and instructions to external providers.

GDPR Article 5(2) makes controllers responsible for demonstrating compliance. Article 30 requires processing activity records, subject to conditions and exceptions. Source: GDPR, Articles 5 and 30, 2016.

Outsourcing does not remove responsibility. Define roles and contracts before sharing contact data.

Conclusion

B2B cold email requires a lawful basis to process personal data and separate permission to send marketing under national law. Lithuania's 2026 changes clarify corporate outreach. Estonia and Finland permit relevant corporate marketing under conditions; Latvia requires caution with identifiable employees.

Prioritise targeted prospecting, documented decisions, transparency and reliable suppression. Clarify uncertain recipient classifications before emailing.

This guide provides general information and is not legal advice.