Is Cold Email Legal in Ireland? The B2B Answer

Is cold email legal in Ireland?

Yes, cold email to businesses in Ireland can be legal, but the answer depends on who receives it. Irish law separates a company from a person. A company can be emailed until it tells you to stop. A person needs to have consented, unless you write to an address they use mainly for work and the email is only about that work. Whichever case applies, every email must say who you are, give a working address for opting out, and be stopped the moment someone objects. This guide sets out the rules by recipient type. It is a practical summary from someone who runs outreach, not legal advice, and the Data Protection Commission is the place to confirm anything that matters to your business.

It is, within limits that depend on the recipient. The rules for marketing by email sit in Regulation 13 of the ePrivacy Regulations, Statutory Instrument 336 of 2011. Read as made in 2011, it sets three different starting points:

So a short, relevant email to a finance director at their work address, about their firm's finance work, sits in a different place from the same email sent to her personal inbox. The regulations make each unlawful email a separate offence, so the difference matters at the level of every single message.

To a person, the rule is consent. Regulation 13(1) bars unsolicited marketing email to a subscriber or user who is a natural person unless they have told you they consent.
To a person at a work address, Regulation 13(2) says that rule does not cover an email to an address that reasonably appears to be used mainly for the person's commercial or official activity, where the email relates solely to that activity.
To a company, Regulation 13(4) only stops you once the company has told you it does not consent.

The ePrivacy Regulations 2011, Statutory Instrument 336 of 2011, on the Irish Statute Book (opens in a new tab)

Which rules apply, GDPR or the ePrivacy regulations?

Both, at the same time. The Data Protection Commission's FAQ on consent for electronic direct marketing explains that the ePrivacy Regulations are an extra set of rules for marketing by phone, text and email, read together with the GDPR and the Data Protection Act 2018.

The ePrivacy Regulations decide whether you may send the email at all. The GDPR decides how you may use the personal data behind it: the name, the work address, the job title and the note about where you found them.

A work address that names a person is personal data, so the GDPR applies to it in full. You need a lawful basis, and for outreach that is usually legitimate interests. Recital 47 of the GDPR says the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest, but it also says that interest needs careful assessment, including what the person could reasonably expect. That assessment is your job, and it should be written down.

Does it matter whether I email a company or a person?

Yes. It is the single question that changes the answer. The checklist below shows what should be in place before the first email goes, for each type of recipient.

A company address that names nobody, such as the general info or accounts inbox. Starting point: Regulation 13(4), allowed until the company tells you it does not consent. In place before sending: your identity in the email, a working opt out address, and a suppression list so a refusal is kept for good.

A named person at a company, at their work address. Starting point: Regulation 13(2), outside the consent rule if the address is mainly used for work and the email is only about that work. In place before sending: everything above, plus a written legitimate interests assessment, and the GDPR notice in the first email: who you are, why you are writing, where you got the address and that they can object.

A sole trader. Starting point: a sole trader is a natural person, so Regulation 13(1) applies unless the address plainly serves the trade and the email is only about the trade. In place before sending: everything above, and caution: if the address looks personal, or the trade and the person cannot be told apart, get consent or do not send.

A consumer, or any personal inbox. Starting point: Regulation 13(1), consent first, with one exception for existing customers under Regulation 13(11). In place before sending: recorded consent you can produce, or an existing customer relationship that meets every condition of 13(11).

The Data Protection Commission is the authority to check your reading with. Its FAQ states the general rule for electronic direct marketing as clear, affirmative consent, and it describes the existing customer exception in detail. Where your list sits close to the line between a business and a person, treat the stricter row as the one that applies.

B2B email outreach: a practical guide for small businesses

What must every cold email carry?

Whatever the recipient type, Regulation 13 sets duties that do not change:

Then honour every objection. Under Article 21(3), once a person objects to direct marketing, their data can no longer be used for it (GDPR text on EUR-Lex, read 2026-10-19). In practice that means a suppression list checked before every send, including sends from a new campaign or a new tool.

Keep records too. Regulation 13(14) puts the burden of showing that a person consented on the sender, so if you rely on consent anywhere, keep proof of when and how it was given.

Who you are. Regulation 13(12)(a) makes it an offence to send marketing email that disguises or conceals the identity of the sender, or the business it is sent for.
A valid address for opting out. Regulation 13(12)(c) requires a valid address to which the recipient can send a request to stop, and 13(10)(c) requires a valid address at which you can be contacted. A reply that works, plus an unsubscribe line, covers both.
Where you got the address. Where you collected a person's details from somewhere other than the person, Article 14 of the GDPR requires you to tell them the source, and Article 14(3)(b) says that if you are going to write to them, it is due at the latest with the first email (GDPR text on EUR-Lex, read 2026-10-19).
The right to object, stated plainly. Article 21(4) says the right to object to direct marketing must be brought to the person's attention, at the latest at the first communication, clearly and separately from other information (GDPR text on EUR-Lex, read 2026-10-19).

Reporting and compliance, how I work with your data

What does a lawful basis assessment look like for one campaign?

A legitimate interests assessment does not need to be long. For one campaign, a page that answers these questions in writing is a reasonable record:

Date it, keep it with the campaign, and review it when the list source or the offer changes.

What is the purpose? For example: introducing a bookkeeping service to finance managers at Irish firms of 10 to 50 staff.
Why is email to these people necessary for it? The service is relevant to their role, and email to a work address is the least intrusive way to ask whether it is of interest.
Where did each address come from? Name the source, such as the company's own website or a lead provider, and the date it was collected. This is also what the first email has to tell the person.
Would the person reasonably expect it? A short, relevant email about their work, to their work address, is closer to what they expect than a message to a personal inbox about something unrelated.
What protects them? Your identity in every email, the source of their address, a working opt out, a suppression list, a limit of two or three follow ups, and deletion of the data from that campaign once it ends.
Who is excluded? Personal addresses, consumers, sole traders whose address cannot be told apart from their personal one, and anyone on the suppression list.

When should you ask a solicitor instead of a freelancer?

I run B2B email outreach and I follow these rules in the work, but I am not a solicitor, and nothing here is legal advice. Ask an Irish solicitor, or the Data Protection Commission, before you send when:

The cost of advice is small next to the exposure. On conviction on indictment, Regulation 13(15) sets a maximum fine of €250,000 for a company and €50,000 for an individual, and each email can be its own offence (Statutory Instrument 336 of 2011 as made, Irish Statute Book, read 2026-10-19).

the list was bought from a third party and you cannot say how each address was collected;
a large share of the list is sole traders or personal addresses;
you are writing about something sensitive, such as health, finance for individuals or anything aimed at children;
you have had a complaint, or a letter from the Data Protection Commission;
the campaign also goes to other EU countries, where the national rules on business email can differ from Ireland's.

Common questions about cold email in Ireland

Can I email a sole trader in Ireland without consent? Only in a narrow case. A sole trader is a natural person, so the consent rule in Regulation 13(1) is the starting point. The 13(2) exception can apply where the address reasonably appears to be used mainly for the trade and your email is only about the trade. If the address looks personal, or you cannot tell, get consent first or leave them off the list.

Is an info address at a company personal data? Usually not, if it identifies nobody. A shared company inbox is a company address, so Regulation 13(4) applies: you may write until the company asks you to stop. It can become personal data when it plainly belongs to one person, as it often does in a one person business, and the GDPR then applies to it.

Does a LinkedIn connection count as consent? No. Consent under the GDPR means a freely given, specific, informed and unambiguous indication, given by a statement or a clear affirmative action, and the Data Protection Commission applies the same meaning to marketing consent. Accepting a connection request is agreement to connect, not agreement to receive marketing email. If you write to a connection, the rules for their recipient type above still apply.

What happens if someone complains to the Data Protection Commission? The Commission enforces the ePrivacy Regulations and can investigate. Sending marketing email in breach of Regulation 13 is a criminal offence, each email counts separately, and if consent is in question, it is for the sender to prove it. The practical defence is the record: your assessment, the source of each address, the opt out in every email, and a suppression list that shows the person was removed when they asked.

When a managed service makes sense

If you sell to other businesses in Ireland or the UK and want outreach run within these rules, that is what B2B Email Outreach covers. I write the emails, send them from your own mailbox, follow up and report back, with the sending and warm-up tools included, for €450 a month (the pricing page). Contact lists and Email Setup are separate, and legal advice is not included: you stay responsible for confirming the rules that apply to your campaign.

To start, send a short written brief through the contact page, and I confirm the scope in writing before any payment.

Sources

The ePrivacy Regulations 2011, Statutory Instrument 336 of 2011, on the Irish Statute Book (opens in a new tab) — checked 2026-10-19
FAQ on consent for electronic direct marketing, from the Data Protection Commission (opens in a new tab) — checked 2026-10-19
The General Data Protection Regulation, full text on EUR-Lex (opens in a new tab) — checked 2026-10-19