I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now.

The companies listed on the website are companies the client knows they exist and has gathered from websites such as HubSpot. The client then gathered emails for the personnel that are working in those companies.

The companies are added to our database and the company personnel have the option to claim the company and change in its profile. The client wants to send emails to the contacts that he has (which he got no consent from) that our website is hosting a profile of their company and they should feel free to claim it.

Would this be in violation of GDPR law?


Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering.

From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them:

  • consent? No.
  • necessary for performance of a contract involving the data subject? No.
  • legal obligation? No.
  • vital interests? No.
  • public interest? No.
  • legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails.

    It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do.

In conclusion, your client's idea is a bad idea:

  • They likely do not have a legal basis for this under the GDPR.
  • They are likely violating more specific anti-spam laws in their jurisdiction.
  • They are working hard to get their domain put on spam filter lists.

Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis.

Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.