Germany B2B Email: A GDPR and UWG Review Checklist
February 27, 2026 · 3 min read · by Ahmet Faruk Yilmaz, Founder of Asphia
TL;DR
GDPR processing and permission to send commercial email are separate questions in Germany. UWG §7 generally requires prior express consent for commercial email, subject to a narrow existing-customer exception. Obtain jurisdiction-specific legal advice before sending.
B2B outreach to Germany requires two separate analyses: whether personal-data processing has a GDPR basis and whether the commercial email itself is permitted under German sending rules. This article is general information, not legal advice. Before sending, have qualified German counsel assess the campaign, recipient category, data source, and message.
Read the current statutory text in UWG §7 and obtain advice for the specific campaign.
Germany’s UWG (Unfair Competition Act) is a separate sending-rule consideration alongside GDPR. Do not use an assessment made for another EU market as a substitute for a Germany-specific review.
GDPR Processing and UWG Sending Permission Are Different
GDPR Article 6(1)(f) can be relevant when assessing whether prospect data may be processed, but it is not permission to send promotional email. Under UWG §7(2)(2), commercial electronic mail generally requires the recipient’s prior express consent. UWG §7(3) contains a limited existing-customer exception with specific conditions.
Record the consent or assess whether each condition of the existing-customer exception is met. Relevance, a business address, an opt-out, or a documented legitimate-interest assessment do not independently satisfy the UWG sending rule.
The exception concerns an address obtained from a customer in connection with a sale, direct marketing for similar own goods or services, no objection, and clear notice of the right to object when collected and with each use. Seek legal advice for any fact pattern outside it.
Keep a documented GDPR assessment and a separate record of the legal permission relied on for sending. The depth and retention of that documentation should be decided with counsel.
A GDPR basis and permission to send are separate checks.
The Pre-Send Compliance Checklist
Run this before any German sequence launches.
Data sourcing
- Record the proposed data source, the minimum data fields, and its provenance.
- Have counsel assess the source, transparency notice, and recipient category before use.
- Set a data-quality review cadence that matches the campaign and data source.
Email content
- Subject line is not misleading. Do not imply a prior relationship that does not exist.
- Have sender identity, purpose, and required notices reviewed before use.
- Relevance can inform the review, but it does not itself establish permission to send.
Opt-out mechanics
- Preserve consent or applicable-exception evidence and follow counsel’s advice on the required objection and identity notices.
- Define the route, escalation, and timing for objections with counsel, then test every import and send path.
- Consider whether a controlled exclusion record is needed to respect requests without retaining unnecessary data.
Data storage
- Record the accountable owner, access controls, and reviewed retention approach.
- Verify data-processing roles and contractual requirements for each vendor with counsel.
Follow-up limits
- Set agreed sequence limits and stopping conditions before launch.
- Test how an objection or negative reply is captured and applied across the relevant tools.
Where German Outreach Commonly Goes Wrong
Three failure modes show up repeatedly in Germany-targeted sequences.
Assuming a contact label settles the legal analysis. Personal, professional, corporate, and sole-trader contexts can require different assessment. Escalate unclear cases.
No documented decision. Preserve the approved analysis of the legal route, ownership, data source, and objection process before launch.
Disconnected objection handling. A request can be lost between mailboxes, CRM imports, and manual sends. Test the agreed workflow across those paths.
Making the Review Operational
Once counsel approves a route, turn it into a testable workflow: assign an owner, document the intended audience and data source, configure the permitted send path, and test the objection route without contacting real prospects. Re-review when the market, provider, data source, or message changes.
The Bottom Line
Do not treat GDPR legitimate interest, relevance, or an unsubscribe as blanket authorization for German commercial email. UWG §7 generally requires prior express consent, with a narrow existing-customer exception. Use this checklist only as a starting point and obtain German legal advice before sending.
For more on building outreach that avoids spam filters alongside GDPR compliance, see AI cold email that avoids spam.
Request the signal tier list.
A practical view of how we rank observable signals before outreach. We review each request for fit and may reply by email; delivery is not automatic.
By submitting, you agree to processing described in our Privacy Policy.
Your request was submitted. If it is a fit, we may follow up by email.
One more step: send the prepared request to faruk@asphia.consulting
FAQ
Is cold email legal in Germany under GDPR?
GDPR Article 6(1)(f) may be relevant to processing personal data, but it does not itself authorize commercial email. Germany's UWG §7 generally requires prior express consent for commercial email, subject to a narrow existing-customer exception. This is general information, not legal advice; have German counsel assess the campaign.
Do I need consent to send cold emails to German businesses?
Generally, yes: UWG §7 treats commercial email without prior express consent as an unreasonable nuisance. The statutory exception is limited to an existing customer relationship, similar own goods or services, no objection, and clear opt-out information. Legitimate interest is a GDPR processing question, not a substitute for the UWG sending rule.
What is the UWG and why does it matter for cold email in Germany?
The UWG (Gesetz gegen den unlauteren Wettbewerb) is Germany's unfair competition law. Section 7 covers unreasonable nuisance and generally treats promotional electronic mail without prior express consent as prohibited. It has a narrow existing-customer exception. Relevance and a GDPR lawful basis do not by themselves establish permission to send.
How long can I store German prospect data under GDPR?
GDPR does not prescribe one fixed retention period. Retention, deletion, and any minimal record needed to respect objections should be defined for the actual processing purpose with German privacy counsel.
What must every cold email to a German prospect include?
Required content and notices depend on the applicable sending rule and campaign facts. Review sender identification, transparency, objection handling, and data-source information with German counsel rather than relying on a universal email template.
What happens if a German prospect asks where I got their data?
Transparency duties can apply when personal data comes from another source. Maintain accurate provenance and have counsel determine the applicable notice and response process; an incomplete response can create compliance and complaint risk.
Ahmet Faruk Yilmaz
Founder of Asphia. He builds and runs signal-based B2B outbound engines for lean teams, and writes about cold email, Clay, deliverability, and GTM engineering.
Want this run for you?
Explore our B2B outbound and GTM engineering services, then request the planning framework to scope your next campaign.
Request the planning framework →