Is Cold Email Legal in Ireland? What the DPC Enforces

What does Irish law say about B2B sales email?

Short answer: in Ireland, a private individual has to opt in before you send them marketing email. A company can be emailed until it tells you to stop. Named employees sit in a grey area, covered below. The only exception the DPC lists is for existing customers, and its pages set out no separate first-contact rule for business recipients.

The regulations themselves do. Regulation 13(4) of S.I. 336/2011 bars unsolicited marketing email to a subscriber "other than a natural person" once that subscriber has told the sender it does not consent. For company addresses, that is an opt-out rule: once a company tells you to stop, every further email is a breach. Regulation 13(15) treats a breach as a criminal offence.

Ireland's Data Protection Commission (DPC) says electronic direct marketing covers marketing by phone, fax, text message and email. It falls under the GDPR, the Data Protection Act 2018 and an extra set of ePrivacy rules (DPC FAQ on the rules that apply). The general rule is consent: a clear, affirmative act, such as a specific opt-in (DPC FAQ on consent).

Business addresses are covered as well. The DPC once prosecuted a company after a business owner complained, and its case note says the opt-out rule includes business subscribers. Once a business has told you it does not consent, emailing it again is an offence (DPC case study on the Viking Direct Ireland prosecution).

So, for an Irish campaign:

• A sales email to an Irish private individual who never opted in breaks the DPC's general rule.
• A sales email to a named person at a business is the grey area. Regulation 13(4) treats the company as the subscriber and only bars email once it objects. But the address still belongs to one person, and the DPC pages above do not say which view they take. Plan for the stricter reading and ask your solicitor.
• Every marketing email needs a working way to opt out, and ignoring a business's "no" has already led to a prosecution.

This is not legal advice. Before an Irish campaign starts, have an Irish solicitor sign off on the legal basis for each group of recipients.

My rule: no guessing. I build the list, and I check every address before a campaign touches it. The email itself is short and plain, written the way one person writes to another. Before my team sends anything, opt-out and exclusion handling is already running, whatever the market.

Who can you email and who needs extra care?

The DPC's consent rule turns on who receives the message, so sort every Irish contact into one of four groups before it enters a sequence. The table is how my team sorts them. It is our working practice, set deliberately stricter than anything the DPC has published about business contacts.

The second row is where most of your Irish list will sit, and it is the row founders get wrong. "It's a work address" is true. A work address with someone's name in it still points at one human being, and that person decides whether your email was welcome. Plan as if every named recipient will ask, "Why me, and where did you get this?"

Relevance is your best protection, and it starts with titles. Go back to past deals and find out who actually signed off on the purchase. Target the job titles that niche really uses, and drop catch-all titles such as Assistant, Associate or a bare Manager that could mean anyone. A wrong-fit recipient is the one most likely to object, and an irrelevant email is hard to defend.

A few decision rules for sorting the list:

• If the address carries a person's name, treat it as that person, whatever the domain.
• If the domain is a free webmail provider, do not email it. Find the person on LinkedIn.
• If the company is one person trading alone, treat them as an individual and use LinkedIn.
• If you cannot say in one sentence why this role needs your offer, remove the contact.
• If you are unsure which group a contact belongs to, put it in the stricter group.

What must every Irish sales email include?

The DPC says marketing material should always include a valid address for opt-out requests, and that an unsubscribe request must be actioned (DPC direct marketing guidance, 2019). My team adds three more elements, so every message, first email and follow-ups alike, carries four:

The opt-out line only counts if something happens when people use it. That is where the real risk sits. The line is there, a prospect replies "no", and the sequence keeps running because nobody read the reply. Or the reply landed in one mailbox while two others still had the same person queued.

A stop request has to travel further than the message it answered:

• Every sending mailbox and every sending domain stops for that person the same day.
• LinkedIn stops too. A "no" by email is a "no" on every channel.
• Colleagues on your team who planned to reach the same person are told.
• The address goes onto a permanent exclusion list that is checked before any future list is loaded.

Someone who said stop and then received a third email has a grievance and a written record of it. That is exactly how the Viking prosecution below began.

When does the existing customer rule help?

The existing-customer exception is the only route around consent that the DPC lists, and it is narrow. According to its consent FAQ, every one of these conditions must hold:

1. You obtained the email address lawfully, from the customer, in the course of selling them a product or service.
2. The email promotes your own product or service, of a kind similar to what they bought.
3. The customer was clearly given the chance to object when you collected the details, and gets that chance again in every message.
4. Your first marketing email goes out within 12 months of the original sale.

None of that covers prospecting. The customer's colleague whose address you found yourself, a contact from an event, a name from a bought list: none of them bought from you. Keep customers in a separate file with the sale date next to each address, so a buyer from three years ago never lands in a cold sequence by accident.

Customers still help prospecting in a different way: list the companies that already buy from you, then look for Irish companies like them, and email those only under the prospect rules.

What does the DPC actually do about direct marketing?

The DPC's 2025 annual report covers 1 January to 31 December 2025. For electronic direct marketing it reports:

The count nearly doubled in a year. The figure covers all electronic direct marketing, so it does not show how much of it concerned B2B email.

The case that matters most for B2B senders is older. In April 2017 a business owner complained to the DPC about marketing emails from Viking Direct Ireland. The owner had asked to be removed, but the company's internal process failed to move the address to its suppression list.

The company pleaded guilty to one charge in Dublin Metropolitan District Court in May 2018. The court applied the Probation of Offenders Act instead of a conviction and fine, and the company agreed to pay the DPC's prosecution costs. A warning the DPC had given the same company in 2012 weighed in the decision to prosecute (DPC case study).

In a 2026 DPC prosecution for marketing offences, Brown Thomas Arnotts Limited pleaded guilty. The court applied the Probation of Offenders Act and ordered it to pay EUR 1,000 to a local charity and EUR 1,000 towards the DPC's legal fees. The amounts were small, but it was a criminal case, and the DPC warned that non-compliance "may result in a criminal prosecution".

What this means for a founder:

• Assume any recipient can raise it. You do not choose who reads your email.
• Your records are your defense. If a file is opened on you, you will want to show where the address came from, when it was verified, what was sent, and when an opt-out was honored.
• Leave penalties to your solicitor. For what other European regulators have fined, see GDPR fines for cold outreach. The Viking case ended without a fine and the Brown Thomas payments were small, but neither tells you what your own file would cost. Aim for a process that makes any file on you dull.

How should a B2B team stay compliant before sending?

Most of this is plain list and sending hygiene. Run these seven steps in this order before the first Irish email goes out.

1. Audit where every contact came from. Each row needs a source and a date, and it must fit one of the recipient groups above. Lists bought cheap from freelancers tend to bring low open rates and high bounces, and they give you no source to show a complainant. This lead list audit walkthrough covers the full check.
2. Verify every address. Use NeverBounce or DeBounce, send only to verified addresses, and hold bounces below 0.5%. A guessed address can easily reach the wrong person. The DPC logged 6,521 personal data breach notifications in 2025, and half arose from correspondence sent to the wrong recipient (DPC 2025 annual report), though that figure is not specific to marketing.
3. Load the exclusion list first. Include past opt-outs from every channel, customers who objected, and anyone your team already spoke to. Check the list on every upload.
4. Send from separate, authenticated domains. Keep outreach off your billing and main business domain. I set up SPF, DKIM and DMARC on each sending domain before any message leaves it. My team gives every client dedicated sending IPs, and a single client can run on 10 to 20 of them when that keeps deliverability safe. The full build is in domains, inboxes, and setup work.
5. Warm up, then add volume. A new mailbox needs 10 to 14 days of warm-up before it writes to a prospect. Raise volume only after that.
6. Write the first message like a person. Keep it short and plain, and make it about their situation. Use no attachment, an honest subject and the opt-out line. If you would be embarrassed to read it aloud to the recipient, rewrite it.
7. Put someone on the replies. Have someone watch replies so interested leads and removal requests both get handled. A stop request that sits unread for a week counts the same as an ignored one.

If a step fails, stop there and fix it. Skipping step 2 to hit a launch date is how a careful campaign ends up in someone's complaint.

What is the safest way to run Ireland outbound?

For Irish prospects, my team relies on email and LinkedIn outreach. We do not run dialing floors or pure cold calls. If a client wants the phone in the mix, we ring only people who already replied, engaged or opted in.

The rules I apply to Irish contacts:

• If the list is uncertain, hold the email. Verify it, sort it into the four groups, and only then choose channels.
• If you have a named decision-maker, start on LinkedIn. I never let an email open the conversation with an Irish buyer: a connection or message on LinkedIn goes first, and the email arrives as a warm follow-on.
• If the contact is a personal inbox or a one-person business, stay on LinkedIn.
• If they engaged on LinkedIn, send a short warm email with your full identity and the opt-out line.

Do not force email into every campaign. One or two messages never do the job for me; I plan at least 5 to 6 touchpoints, ideally across more than one channel. For one UK social media marketing agency, LinkedIn outreach with warm emails, plus cold email, produced 714 sales calls in 12 months. Here is how LinkedIn and email work as one outreach sequence.

Here is an illustrative pair for a company selling site-safety software to Irish civil engineering contractors. The names are invented.

LinkedIn connection note:

Hi Aoife, I work with civil engineering contractors on site-safety records and noticed your team runs several sites at once. Happy to connect.

There is no pitch and no link. If she accepts and engages, the email follows a few days later. Expect her to check your profile first, so give it something worth finding. A weak message backed by a strong profile still beats a perfect message from a ghost.

Warm email:

Subject: Safety sign-off across your sites

Hi Aoife,

Thanks for connecting last week. Quick question: when your crews are on three or four sites at once, who signs off the daily safety checks, and is that still on paper?

We help contractors keep those checks in one shared record a director can see each morning. If it is worth 15 minutes, I can show you what one looks like.

Tom Kelly, Kelly Site Systems Ltd, kellysite.example

Not relevant? Reply "no" and I won't contact you again.

It runs about 80 words. One question, one small ask. A person can answer it in one sentence, and it carries a named sender, a company and the working opt-out the DPC's guidance asks for. It is not trying to close anything. Calls come out of conversations, and this email exists to start one.

Tomorrow, pull 50 Irish contacts from your current list and sort them into the four groups. The share that lands in the strict rows shows how much of your plan should start on LinkedIn.

Wondering how much of your Irish list should start on LinkedIn? We can sort your contacts into the four groups together on a call.