Skip to content
Log in
← Glossary

lawful basis

Also called: legal basis for processing, legitimate interest, marketing consent

The legal ground on which personal data may be collected and used, such as consent or a legitimate interest that has been weighed against the person's rights. Under the EU data protection rules and Ukrainian personal data law, outreach needs one, collects only what it needs and lets people object or unsubscribe.

A lawful basis is the legal ground that lets you collect and use someone's personal data. In B2B it is easy to forget that this applies at all, but a work email that identifies a person (name.surname@company) is personal data under the EU's data protection rules (GDPR) and under Ukraine's personal data law. The same goes for names and roles in a CRM, call notes and contact lists shared with partners.

The two bases that usually come up in B2B marketing are consent and legitimate interest. Legitimate interest means you have weighed your interest in contacting the person against their rights: the message is relevant to their job, the kind of contact someone in that role can expect, and easy to refuse. Some countries also require prior consent for marketing email whatever the basis for holding the data, so the rules for each market are worth agreeing with a lawyer once and then following as a routine.

A basis is one of several guardrails that go together: data minimisation (keep only what the outreach needs, plus where it came from), telling people where you got their details, honoring an objection or unsubscribe at once and in every tool, and never buying lists of personal data whose origin you cannot show. This glossary entry describes guardrails, not legal advice: the exact requirements depend on the country and the case.

Example

In autumn 2026 a vendor offered Klasna for Teams a list of 5,000 HR managers, with emails and mobile numbers, for a few thousand hryvnias. Teams declined: the origin of the data was unknown, it could show no lawful basis for using it, the list held more data than outreach needs (mobile numbers) and mostly the wrong people, and a burst of unexpected email would put its sending reputation at risk, including the invoices it sends to real clients.

What it did instead:

  1. Picked companies that fit its customer profile, then the one person whose job is training, for example a head of training whom the company's site lists as the contact for learning partners.
  2. Kept five fields: name, role, company, work email and the source of the contact.
  3. Sent a first message under 100 words: who is writing, why this person, one relevant problem, one small ask, and how to say no.
  4. Put anyone who said no on a suppression list at once, so nobody at Klasna contacts them again.

That outbound channel cost 60,000 UAH and brought 18 leads and 6 opportunities, the best return of the quarter's channels once measured against a baseline.

Common mistakes

  • "Work emails aren't personal data." An address that identifies a person is personal data; the rules apply in B2B too.
  • Buying lists. You can't show where the data came from or on what basis it was collected, and the people on it didn't expect you.
  • Keeping data "just in case". Birthdays, mobile numbers and private details don't help outreach and add risk; keep what the purpose needs.
  • Slow or partial opt-outs. An objection has to stop every message from every tool and colleague, not just one campaign.
  • Treating a glossary as legal advice. Requirements differ by country; agree your rules with a lawyer once and follow them.

Learn it in the course

  • Outbound that respects consent · Reaching companies that have never heard of you: whom to contact, on what lawful basis, which data to keep, how to honor an opt-out, and what a good cold message looks like.
  • Partner terms and legal guardrails · Tiered commission, deal registration, a partner marketing fund and conflict rules, plus the lines you don't cross: no fixed resale prices, no ban on passive sales, consent before sharing client data.