The introduction of the GDPR and the amended Electronic Communications Act has caused concern among many companies; however, in B2B sectors, cold calls and emails remain an effective — and, most importantly, legal—method of acquiring customers.
The key to security is following a few simple rules regarding data collection, processing, and informing recipients.
Legal basis
The foundation of safe operations is the use of data that has been legally obtained and is used for business purposes.
Marketing activities in the B2B model are based on the controller’s legitimate interest (Article 6(1)(f) of the GDPR).
This means that, as a business, you have the right to establish business relationships with potential partners, provided that:
- you use data obtained legally (e.g., from public registers such as CEIDG and KRS, or professional databases such as the Business and Individuals Database),
- you communicate exclusively in a professional context,
- You respect the other person's privacy and objections.
Data purchased from the "Business and People Database" website is covered by an unlimited license, which allows you to use it repeatedly for internal purposes within your company, with no time restrictions.
Step 1: Preparing the subpage
Before you make your first phone call or send an email, you need to have a place to refer recipients who ask about the processing of their data.
A. Create a dedicated GDPR page
Post the information required by the GDPR (listed below) on your website.
B. Use the template
You can use this example as a guide: LINK
C. Prepare the link
You will provide it in the body of the email or—if requested—during the phone call.
In accordance with the regulations, every recipient of the campaign should have access to the following information:
- Information about the data controller,
- Purpose of data processing,
- Legal basis for data processing,
- Recipients of the data,
- Transfer of data to third countries (outside the European Economic Area),
- Data subjects' rights (including the right to access, rectification, erasure, and withdrawal of consent),
- The right to lodge a complaint (if the data subject believes that their data is being processed in violation of the GDPR)
Read the full text of the GDPR article
Step 2: Cold calling – how to talk to people?
In cold calling, it is good practice to start the conversation by briefly introducing yourself and asking if the other person has a moment to hear about the service.
Ask for permission
You should ask for permission to make an offer over the phone right at the beginning of the conversation. In your opening remarks, you should only briefly describe the services you provide.
"Good morning, this is [first and last name] from [company name], which specializes in [description of services offered].
I’d like to know if you’ll be in need of such services in the near future and if we could take a moment to discuss the possibility of working together.
What's next?
Once you have their consent, you can continue the conversation and provide them with detailed information about your offer.
When contacting someone by phone, be sure to comply with the information obligation under Article 14 of the GDPR.
There are two ways to do this:
1️⃣ Before the phone call (via text message or email) – send a message with a link to the page containing information about the protection and processing of personal data.
Text message:
"Good morning,
We would like to inform you that [name] processes your personal data. For more information, please visit: [URL of the privacy policy page]."
Email:
"Good morning,
In accordance with the information obligation under Article 14 of the EU General Data Protection Regulation (GDPR), please review the information regarding our company’s processing of your personal data:
[link to the page on data protection]
Best regards
[first and last name]
[Company Name]"
2️⃣ At the beginning of the phone call— when asking for permission to present an offer—provide the website address containing the required information.
Step 3: Cold emailing – disclosure requirement
In the case of cold emailing, you must also comply with the information obligation under Article 14 of the GDPR. This information should be provided no later than at the time of the first contact with the recipient.
This is most commonly done by including a link in the email to a webpage containing information about the processing of personal data.
"Good morning, in accordance with the information obligation (Article 14 of the GDPR), please review the information regarding our company’s processing of your data: [link to the website]."
It is also important to distinguish between personal email addresses (e.g., imie.nazwisko@firma.pl) and general or functional addresses (e.g., kontakt@firma.pl):
- Personal addresses constitute personal data and are subject to the GDPR.
- General addresses are generally not considered personal data; however, their use for marketing purposes is still subject to regulations governing electronic communications.
Important Disclaimers
It is worth noting that the GDPR regulates the processing of personal data, but it is not the only legal instrument related to personal data protection in Poland.
The requirement to obtain consent may arise from other provisions, in particular:
In practice, this means that the lack of "GDPR consent" does not always preclude contact; however, any form of marketing communication should also be evaluated in light of these laws.
Any person whose data is used for direct marketing purposes has the right to object to such processing. This objection is binding and does not require justification.
Once such a request is received, the administrator should immediately cease all marketing communications and remove the data from the active databases used in campaigns.
Please note that the information above does not constitute legal advice, and its accuracy may change as case law evolves.
Last updated: January 2026.
