GDPR and LinkedIn Outreach: Documenting Legitimate Interests for EU Prospects

LinkedIn outreach to EU prospects triggers the UK and EU GDPR the moment you view a profile, save a name, or send a connection request. The regulation applies to all processing of personal data, including names, job titles, and LinkedIn URLs, regardless of whether the contact is a consumer or a business professional.

Most B2B organisations rely on legitimate interests as the lawful basis for outreach, because consent is impractical before initial contact. But legitimate interests is not a free pass. It places responsibility on you to justify what you want to do, to protect the prospect's rights, and to document both before you start.

This guide explains the three-part test, what a legitimate interests assessment must contain, when and how you tell prospects, and the template you need to stay compliant.

What lawful basis covers B2B outreach to a prospect in the EU?

Article 6(1)(f) of the GDPR permits processing when it is necessary for the purposes of legitimate interests pursued by you or a third party, except where the prospect's interests or fundamental rights override yours. This is the basis most organisations use for cold B2B outreach, because obtaining consent before initial contact is not feasible.

The October 2024 ruling by the Court of Justice of the European Union (Case C-621/22) confirmed that commercial interests qualify as legitimate interests under GDPR. Profit motive alone does not disqualify a purpose, but you must still satisfy the three-part test and document your reasoning.

Consent is mandatory for any processing that falls outside the legitimate interests framework, including automated decision-making, profiling for ad targeting, and any processing of special category data such as health information or political opinions. For standard B2B outreach (commenting on posts, sending connection requests, opening conversations), legitimate interests applies if you complete the assessment properly.

What does a legitimate interests assessment need to contain?

A legitimate interests assessment is a documented record demonstrating that you applied the three-part test to your specific processing activity. The ICO refers to it as an LIA. The GDPR does not mandate a specific format, but you must address each element of the test and record the outcome before you begin processing.

Purpose test: Identify the legitimate interest. Why do you want to process this person's data? Common legitimate interests for LinkedIn outreach include business development, building a sales pipeline, or establishing relationships with decision-makers in a target market. Be specific. 'Improving our services' will not hold up under scrutiny; 'contacting CTOs at SaaS companies to book discovery calls for our API monitoring tool' will.

Necessity test: Show that processing is necessary to achieve that purpose. Could you achieve the same result with less data, or without processing personal data at all? If you only need to send one message, processing ten years of LinkedIn activity history fails the necessity test. If a generic company email address would work, collecting individual contact details may not be necessary.

Balancing test: Weigh your interests against the prospect's rights and freedoms. The ICO's March 2026 guidance requires you to consider the nature of the data (is it sensitive or particularly private?), the prospect's reasonable expectations (would they anticipate this contact?), the likely impact (could it cause harm, embarrassment, or intrusion?), and any safeguards you can put in place to reduce risk.

For LinkedIn outreach, the balancing test typically turns on whether the prospect would reasonably expect to be contacted by someone in your position. A recruiter reaching out to a candidate with a public profile listing 'open to opportunities' passes the test more easily than a cold sales message to someone with a locked-down profile and no indication they want commercial contact.

What should your LIA document include?

Your LIA should contain a description of the processing activity (what data you collect, from whom, and for what purpose), identification of the legitimate interest (whose interest it is and why it qualifies), a necessity assessment (why this processing is required and why alternatives were ruled out), a balancing assessment (working through the factors in the ICO guidance), and a conclusion with a review date.

Record the data categories: names, job titles, LinkedIn profile URLs, company names, and any other identifiable information you collect or store. State the scope: 'We will comment daily on posts by target prospects, send connection requests to approximately 100 to 200 individuals per week, and follow up via LinkedIn message once connected.' Be precise about retention: 'We will retain connection records for 12 months or until the prospect objects, whichever is sooner.'

The balancing section should address reasonable expectations explicitly. For LinkedIn outreach, consider whether the prospect's profile is public, whether they have indicated openness to commercial contact, whether your approach aligns with the norms of the platform, and whether you provide an easy way to opt out in every message.

Set a review date. The ICO requires you to refresh your LIA if there is a significant change in purpose, scope, or context. If you expand from 100 connection requests per week to 500, or shift from UK prospects to a global list including children's data, the original assessment no longer applies.

When and how does the prospect have to be told?

You must tell the prospect that you rely on legitimate interests, and what those interests are, either at the point of first contact or within one month of collecting their data. This transparency requirement is mandatory under Articles 13 and 14 of the GDPR.

For LinkedIn outreach, the most practical approach is to include a privacy notice line in your first message or your LinkedIn profile's 'About' section. The notice does not need to be lengthy, but it must be clear. A compliant first-contact line might read: 'I'm reaching out because I think our API monitoring tool could help your team. I'm processing your LinkedIn profile data under legitimate interests for business development purposes. You can object at any time by replying 'stop' or visiting [link to full privacy policy].'

Your full privacy policy must cover the lawful basis (legitimate interests), the specific purposes (business development, sales outreach), the data categories (name, job title, LinkedIn URL), retention periods (typically 12 months or until objection), and the prospect's rights (access, rectification, erasure, restriction, objection, and complaint to a supervisory authority).

If you obtain contact details from a third party (a purchased list, a LinkedIn scraping tool, or a data provider), you must provide transparency information within one month of obtaining the data. Relying on the third party's privacy notice is not sufficient; you must issue your own notice covering your specific processing purposes.

Does the prospect have a right to object?

Yes. Under Article 21 of the GDPR, individuals have an absolute right to object to processing based on legitimate interests for direct marketing purposes. You must stop processing their data for that purpose the moment they object. For non-marketing purposes, you must stop unless you can demonstrate compelling legitimate grounds that override the individual's rights, which is a high bar.

For LinkedIn outreach, treat every objection as absolute. If a prospect replies 'not interested,' 'stop contacting me,' or 'remove me from your list,' you must honour that request immediately and add their details to a suppression list to prevent future contact. Continuing to message someone who has objected is not only a GDPR breach; it damages your reputation and wastes time.

Make objecting easy. Include an opt-out instruction in every message. 'Reply STOP to opt out' or 'Let me know if you'd prefer not to hear from me' both work. Do not require the prospect to navigate a complex unsubscribe process or contact a separate data protection officer. The easier you make it to object, the fewer complaints you will receive and the stronger your compliance position.

When does consent become mandatory instead?

Consent is required for any processing that cannot satisfy the balancing test, including profiling for ad targeting, automated decision-making, processing special category data (health, race, religion, political opinions), and processing children's data for marketing purposes. The GDPR sets a higher bar for consent than for legitimate interests: it must be freely given, specific, informed, unambiguous, and as easy to withdraw as it was to give.

For LinkedIn outreach, consent is rarely practical before initial contact. You cannot ask for consent until you have made contact, and you cannot make contact without processing data. This is why legitimate interests exists. But if your outreach includes tracking pixels, behavioural profiling, or integration with ad platforms, consent becomes mandatory for those elements even if legitimate interests covers the initial message.

The October 2024 EDPB Guidelines 1/2024 reaffirmed that online tracking via cookies or pixels requires consent under the ePrivacy Directive, regardless of any GDPR lawful basis. If your outreach includes email tracking links or LinkedIn message read receipts that identify individuals, you need consent for that layer of processing even if the message itself is covered by legitimate interests.

What happens if you get the LIA wrong?

Supervisory authorities can request your LIA during an investigation or audit. If you cannot produce a documented assessment, or if the assessment fails to satisfy the three-part test, you have no valid lawful basis for the processing. That is a breach of Article 6(1), which can result in fines of up to 20 million euros or four per cent of annual global turnover, whichever is higher.

The ICO's October 2024 guidance on how to apply legitimate interests in practice states that there is no perfect formula for the outcome of the balancing test, but you should be confident that the risks you have identified do not override your legitimate interests. If you are not sure, it is safer to look for a different lawful basis or to redesign your processing to reduce the impact.

Most compliance failures come from skipping the assessment entirely, not from getting a detail wrong. Documenting your reasoning, even if imperfect, demonstrates accountability and good faith. Treating legitimate interests as a box to tick without justification does not.

Template: legitimate interests assessment for LinkedIn outreach

Processing activity: Daily commenting on LinkedIn posts by target prospects (CTOs and VPs of Engineering at B2B SaaS companies with 50 to 500 employees), sending connection requests to approximately 100 to 200 individuals per week, and following up via LinkedIn message once connected. Data collected: name, job title, company name, LinkedIn profile URL. Retention: 12 months or until the individual objects.

Legitimate interest: Business development. We are a B2B SaaS company offering API monitoring tools. Our legitimate interest is to identify and engage with decision-makers who may benefit from our product, to build a sales pipeline, and to book discovery calls with qualified prospects.

Necessity: Viewing and commenting on prospects' public LinkedIn posts is necessary to establish familiarity before sending a connection request. Sending a connection request with a brief introductory note is necessary to open a conversation. Storing names and job titles for 12 months allows us to track previous contact and avoid duplicate outreach. We do not process sensitive data, and we limit data collection to publicly available profile information.

Balancing: The prospects we contact have public LinkedIn profiles, hold professional roles in our target market, and operate in a B2B context where commercial outreach is common. They would reasonably expect to be contacted by vendors offering relevant tools. The impact on their privacy is minimal: we send one connection request, and if accepted, one follow-up message. We provide an easy opt-out ('reply STOP') in every message, and we maintain a suppression list to honour objections immediately. We do not process children's data, special category data, or data from individuals who have previously objected.

Conclusion: The balancing test favours our legitimate interest. We will proceed under Article 6(1)(f), provide transparency information in our first message, and review this assessment every six months or if our outreach scope changes. Date: [insert date]. Next review: [insert date].

Template: first-contact privacy notice for LinkedIn messages

Include this line in your connection request or first message: 'I'm reaching out under legitimate interests (business development) to see if [product/service] could help your team. You can object anytime by replying STOP, and you can read our full privacy policy at [link].'

Your linked privacy policy must cover the lawful basis (legitimate interests for business development), the data categories (name, job title, LinkedIn URL, company name), retention periods (12 months or until objection), your identity and contact details, and the prospect's rights (access, rectification, erasure, restriction, objection, portability where applicable, and complaint to the ICO or relevant supervisory authority).

What if the prospect is outside the EU?

The GDPR applies to any processing of personal data of individuals in the EU, regardless of where your business is located. If you are targeting prospects in the UK, the UK GDPR applies. If you are targeting prospects in EU member states, the EU GDPR applies. If your prospect list includes both, you must comply with both regimes, although the requirements are nearly identical.

For prospects outside the EU and UK (for example, in the United States, Canada, or Australia), the GDPR does not apply, but other data protection laws may. Many jurisdictions have adopted GDPR-inspired frameworks with similar principles. Conducting an LIA and providing transparency information is a defensible global practice, even where not strictly required by local law.