Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering.
From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them:
- consent? No.
- necessary for performance of a contract involving the data subject? No.
- legal obligation? No.
- vital interests? No.
- public interest? No.
legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails.
It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do.
In conclusion, your client's idea is a bad idea:
- They likely do not have a legal basis for this under the GDPR.
- They are likely violating more specific anti-spam laws in their jurisdiction.
- They are working hard to get their domain put on spam filter lists.
Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis.
Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.