B2B Data Compliance: GDPR, CCPA, CASL and CAN-SPAM Explained for Marketers

Important: this guide is general information, not legal advice. Laws change and their application depends on your situation, so consult a qualified lawyer for decisions about your own campaigns.

GDPR (European Union) and UK GDPR

The GDPR covers personal data about identifiable people in the EU, and the UK has an equivalent law. A named person's business email and job title count as personal data. To process it you need a lawful basis; for B2B prospecting, organisations commonly rely on legitimate interests, which requires balancing your interests against the individual's rights and documenting that assessment.

GDPR also requires transparency (telling people how you use their data), honouring rights such as access and erasure, keeping data accurate, and keeping it secure.

ePrivacy rules for email: EU and UK PECR

Email marketing is also governed by ePrivacy rules, which vary by country. In the UK, the Privacy and Electronic Communications Regulations (PECR) generally allow marketing emails to corporate subscribers (such as a company email address) without prior consent, provided you identify yourself and offer an easy opt-out. Sole traders and some partnerships are treated like individuals. Several EU countries are stricter and require consent even for B2B email, so check the rules for each country you target.

CCPA / CPRA (California)

California's privacy law originally had a temporary exemption for B2B contact data, which ended on 1 January 2023. Business contact information about California residents is now covered. Depending on whether your business meets the law's thresholds, obligations can include giving notice at collection, honouring requests to know and delete, and offering an opt-out of the sale or sharing of personal information.

CASL (Canada)

Canada's Anti-Spam Legislation applies to commercial electronic messages, including B2B email. It is consent-based: you need express or implied consent. Implied consent can apply in limited situations, for example where a person has conspicuously published their business email without saying they do not want unsolicited messages, and your message is relevant to their role. Every message must identify the sender and include a working unsubscribe mechanism.

CAN-SPAM (United States)

CAN-SPAM applies to commercial email, including B2B. It is an opt-out law: prior consent is not required, but you must use accurate header information, non-deceptive subject lines, identify the message as an advertisement where required, include a valid physical postal address, provide a clear way to opt out, and honour opt-out requests within 10 business days.

Practical checklist for compliant B2B outreach

• Know which countries your contacts are in, and apply the rules for each.
• Document your lawful basis for using the data, especially for EU and UK contacts.
• Keep messages relevant to the recipient's professional role.
• Identify your company clearly and include a physical address.
• Include a simple unsubscribe link and honour opt-outs promptly across all systems.
• Keep suppression lists and check them before every campaign.
• Keep data accurate with regular cleansing and verification.
• Work with data providers who can explain their sources and compliance practices.

See how we handle data in our privacy policy.

Frequently asked questions