If you run B2B outreach into the Czech market, you have almost certainly wondered: when exactly does contacting a company cross the line under GDPR? The regulation is frequently misread as a blanket ban on cold outreach. It is not. But there are clear rules you need to follow. Here is what the law actually says.

Company Data vs. Personal Data: The First Distinction That Matters

GDPR protects natural persons, not legal entities. This means that a company's registration name, company ID (IČO), registered address, and general contact address (info@, sales@) listed in the Czech Business Register or the ARES public database are not personal data under GDPR. Reaching a company at one of these addresses is outside GDPR's direct scope.

The picture changes the moment you work with a named individual's contact details — jan.novak@company.cz is personal data, even in a B2B setting. The same applies to sole traders: where an individual runs a one-person business, their business address and ID number can identify a natural person and are therefore treated as personal data.

Large company databases built on public registers — such as databazekontaktu.cz with 4.4 million Czech firms sourced from ARES — primarily handle company-level (non-personal) data, which places their core use in a lower-risk GDPR category than databases of individual employee contacts.

Legitimate Interest: The Legal Basis for B2B Cold Outreach

When you do process personal data for outreach (a named person's work email, for instance), the standard legal basis is legitimate interest under Article 6(1)(f) GDPR. Recital 47 of the Regulation explicitly acknowledges that direct marketing may constitute a legitimate interest — the EU legislature did not intend to ban B2B cold outreach.

To rely on it lawfully, your processing must pass a three-part test:

  • Purpose test: Do you have a genuine, specific commercial interest — offering a relevant service to an identifiable target audience?
  • Necessity test: Is processing the personal data actually necessary to pursue that interest?
  • Balancing test: Does your interest outweigh the individual's rights and reasonable expectations?

Document the outcome in a Legitimate Interest Assessment (LIA). The more targeted and relevant your outreach — right industry, right role, right company size — the more easily it passes the balancing test. You can build exactly that segment with an export of companies by industry. Bulk blasting an unrelated product to anyone you can find will not pass.

Czech Act 480/2004: Rules for Electronic Commercial Communications

Alongside GDPR, Czech law adds a layer through Act No. 480/2004 Coll. on Certain Information Society Services (implementing the EU ePrivacy Directive). Section 7 is the key provision.

The default rule: sending commercial communications by electronic means (email, SMS) requires the recipient's prior consent. However, Section 7(3) provides an exception for existing customers: if you obtained a contact during the sale of a product or service, you may send commercial communications about your own similar products or services — provided the recipient always has a simple, free-of-charge way to opt out.

For cold emails sent to generic company addresses from public registers, the law does not create an explicit exception, but Czech data protection practice and ÚOOÚ (Czech DPA) guidance distinguish between a generic company mailbox and an individual employee's personal address. A cold email to info@company.cz is treated as materially lower-risk than a direct approach to jan.novak@company.cz with no prior relationship.

Practical Rules for Cold Email and Cold Calling

Whether you are emailing or calling, these rules apply across the board:

  • Relevance first: Only contact companies and individuals for whom your offer is objectively pertinent — the right sector, the right role, the right scale of business.
  • Disclose your source: State clearly where you obtained the contact (public business register, ARES, industry directory).
  • Easy opt-out: Every communication must include a simple, free way to unsubscribe. Honor opt-outs immediately and record them.
  • No deception: Subject lines and sender identities must not be misleading — this is covered by both advertising law and criminal provisions.
  • Cold calling: Telephone outreach to companies follows similar logic; individuals may register with the Czech Robinson List (APMS) which you are obliged to check and respect.
  • Document your LIA: Keep a record of why you concluded that legitimate interest prevails in your specific use case.

When You Cannot Avoid Explicit Consent

Legitimate interest does not cover every scenario. Explicit consent is required when:

  • you are targeting consumers (B2C) rather than businesses,
  • your data comes from sources other than public registers (social networks, private web scraping) where the person did not expect commercial use,
  • you are processing special-category data or building profiles with no clear relevance to the offer.

This article is educational in nature and does not constitute legal advice. For guidance on your specific situation, consult a qualified attorney or data protection specialist.

B2B outreach and GDPR are not fundamentally incompatible. The legitimate interest basis exists precisely to permit proportionate, relevant commercial communication. The principles are consistent: be targeted, be transparent, and always respect the right to say no. Start from a precisely targeted segment — see How to Find B2B Contacts for Czech Companies (Practical Guide) — and get nationwide data through the company database subscription.