--- title: "GDPR and B2B Phone Prospecting in Europe · Pipecorn" description: "You can cold call business contacts in Europe under the GDPR. What it asks of you, how France, Germany and the UK differ, and what Pipecorn handles." canonical: "https://pipecorn.com/gdpr-phone-prospecting" --- # Calling business contacts in Europe under the GDPR > You can cold call business contacts in Europe under the GDPR. What it asks of you, how France, Germany and the UK differ, and what Pipecorn handles. Source: https://pipecorn.com/gdpr-phone-prospecting GDPR and phone prospecting You can call a prospect's work number in Europe when the call is about their job and you stop when they object. Each country then sets its own calling rules. [Sign up for free](https://app.pipecorn.com/register)[Read our DPA →](https://pipecorn.com/dpa) What the GDPR asks of you ## Four things to have in place _before the first call_ A work number is personal data when it belongs to a named person, so the GDPR applies to a B2B call list the same way it applies to an email list. 1. ### Have a reason tied to their job Most B2B calls rest on legitimate interest (Article 6(1)(f)), and recital 47 says direct marketing can be one. Write down why this person, in this role, would care about your offer. Finance software pitched to a CFO passes that test, and calling everyone at the company usually doesn't. 2. ### Say where the number came from You did not get the number from the person, so Article 14 applies: tell them who you are, why you call and where the number came from, at the latest on that first call. Point them to your privacy notice for the rest. 3. ### Stop when they say stop An objection to direct marketing has no exceptions (Article 21). Put the number on your own do-not-call list, and check that list before every import and every campaign. 4. ### Keep only what you call Delete the contacts you decide not to call, and set how long you keep the ones you do. A list of 5,000 bought “just in case” is hard to justify. The call itself ## France, Germany and the UK set _different rules_ The GDPR covers the data. Whether you may pick up the phone at all is national law, and France, Germany and the UK answer it differently. | Country | Calls to businesses | Calls to consumers | What to check | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | France | Allowed on legitimate interest when the call is about the person's job, for example software pitched to an IT director. They must be informed and able to object for free ([CNIL](https://www.cnil.fr/fr/prospection-commerciale-par-telephone-hors-automate-dappel-quelles-sont-les-regles)). | Prior consent since 11 August 2026, apart from calls about an ongoing contract. | If you bought the numbers, make sure people were told their number could be used for prospecting. | | Germany | At least presumed consent ([§7(2) no. 1 UWG](https://www.gesetze-im-internet.de/uwg%5F2004/%5F%5F7.html)): a concrete reason to think the company wants the call, tied to its line of business. | Prior express consent. | Courts read presumed consent narrowly. Have a lawyer look at your targeting and your script. | | United Kingdom | Allowed unless the number is on the TPS or the CTPS, or the business told you not to call ([ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/)). UK GDPR applies on top. | Allowed unless the number is on the TPS or the person objected. | Screen every business number against both the TPS and the CTPS, plus your own list. | This is a summary of the rules as we read them on 29 October 2026, and it is not legal advice. Other EU countries set their own rules for calls. Check your campaign with your counsel, and for Germany read our [page on calling German businesses](https://pipecorn.com/phone-coverage/germany). Who is responsible ## Who answers for _what_ * You ### The controller of your campaign You choose who to call and why. So the reason for each segment, the Article 14 notice, your do-not-call list and how long you keep the data are on your side. * Pipecorn ### Responsible for its own database We buy only from providers whose legal basis we can show you, process data in the EU and are SOC 2 Type II audited. The reports are on [compliance.pipecorn.com](https://compliance.pipecorn.com/). * Paperwork ### A DPA any customer can sign Our [Data Processing Agreement](https://pipecorn.com/dpa) lists what we process, our sub-processors and how we help you answer a data subject's request. * Removals ### People can ask us directly Anyone can ask us to remove their data through the [data request form](https://forms.gle/1SygJvUpHmL8LRu17), and we take them out of the database. That does not replace your own list. On the call ## The Article 14 notice _in one sentence_ Most teams cover the notice in the opening of the call and send the rest in writing. You can adapt this line to your script: I'm calling from Acme. We found your work number through Pipecorn, a B2B data provider. If you'd rather we didn't call again, tell me and I'll take you off our list. Then put the link to your privacy notice in the follow-up email. If the person objects, log it in your CRM the same day, so the next rep and the next import both skip them. ### Sources * [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj): Articles 6(1)(f), 14 and 21, recital 47 * [CNIL, prospection commerciale par téléphone](https://www.cnil.fr/fr/prospection-commerciale-par-telephone-hors-automate-dappel-quelles-sont-les-regles) (France) * [§7 UWG, Gesetz gegen den unlauteren Wettbewerb](https://www.gesetze-im-internet.de/uwg%5F2004/%5F%5F7.html) (Germany) * [ICO, telephone marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/) (United Kingdom)