In short
This article describes a general framework, up to date with our checks as of 8 September 2026. It is not legal advice: a bulk campaign, a purchased file or automated processing warrant a lawyer's opinion. The competent authorities are the CNIL (France), the Data Protection Authority (Belgium), the FDPIC (Switzerland) and the CNPD (Luxembourg).
Many SME leaders put off prospecting because they do not know what they are allowed to do. The answer fits in a few lines: writing to a professional about their work is permitted in all four French-speaking markets, provided you meet three simple obligations. Only Switzerland changes the rule for bulk email.
This framework has a consequence that is rarely noticed: it rewards exactly what makes a prospect reply. A targeted message, sent to someone the subject concerns, is both the safest legally and the most effective commercially.
A business email address is still personal data
firstname.lastname@company.com identifies a person. It is therefore personal
data, and the GDPR applies. contact@company.com identifies nobody and falls
outside the scope.
The fact that an address is professional does not change whether the GDPR applies. It changes the legal basis you can rely on. In B2C, prior consent is required. In B2B, you can rely on legitimate interest, under one condition that the CNIL states clearly: the message must relate to the recipient's professional role.
One example is enough to set the boundary. Offering production management software to the operations director of an SME: related to their role. Offering the same thing to their accountant because their address appears in the same file: not related.
Three obligations: one sentence and one column
Legitimate interest is not a blank cheque. It comes with three duties.
Inform. The person must know that you are processing their data, where it comes from and what it is used for. When the data was not collected from them, which is the case for all prospecting, the information must be given at the latest at first contact. Two lines at the foot of the message are enough, for example: "I found your contact details on your company's website. If you would rather not receive messages from me, simply reply 'stop'."
Allow objection. Not a twelve-field form: a one-word reply must be enough. An objection is respected immediately, with no follow-up and no counter-proposal.
Limit retention. The CNIL takes three years from the last contact initiated by the prospect. Beyond that, deletion or anonymisation. Conversely, the record of an objection is kept: it is what stops a colleague from contacting the same person six months later.
In practice, these obligations cost one sentence in the message and one "objection" column in the tracking file.
What changes from one market to another
France
B2B prospecting by email without prior consent: possible, on the basis of legitimate interest, with information and a right to object. This is known as the opt-out regime. Prior consent remains the rule for private individuals. The technical side, so that these emails actually arrive (sending domain, SPF, DKIM, DMARC), is covered in B2B prospecting email: GDPR and deliverability.
Belgium
Legitimate interest can be the basis for processing the data, but email is also subject to a stricter rule than in France. The Royal Decree of 4 April 2003 exempts from prior consent messages sent to the "impersonal" email addresses of legal entities (info@, contact@). For a named address (firstname.lastname@company.be), the most common reading requires prior consent. So be careful: when in doubt, use LinkedIn or the company's generic address. The Data Protection Authority also expects the same rigour as in France on where files come from and how long they are kept. The practical details are in the article on B2B prospecting email.
Switzerland
This is where the rule changes. Switzerland is not a member of the European Union and applies its own data protection law (the revised Federal Act on Data Protection), alongside its unfair competition law. The latter requires prior consent for mass advertising by electronic means. A bulk send to Swiss addresses is therefore handled on an opt-in basis.
Two nuances matter. An individual, personalised message, addressed to a professional in the context of their role, is not mass advertising. And if you write from Switzerland to people located in the European Union, or the other way round, the GDPR applies on top of the local law.
Luxembourg
The GDPR applies, under the supervision of the CNPD, with a regime broadly aligned with the French one for B2B. For a bulk campaign to Luxembourg addresses, have the set-up validated before sending rather than after.
The law is only part of the gap between these four countries. Language, conventions and the expected level of formality are another, covered in detail in the prospecting differences between France, Belgium, Switzerland and Luxembourg.
LinkedIn: two frameworks instead of one
A LinkedIn message is not an email within the meaning of the rules on electronic communications. Many conclude that there are no rules. There are two.
The GDPR. Harvesting profiles, even public ones, is data processing. A public profile is not open to any use: collecting it triggers a duty to inform the people concerned.
LinkedIn's terms of use. They prohibit scraping and automated sending. No authority needs to step in: LinkedIn restricts the account itself. For a managing director whose profile is the first point of contact with clients, that is the more concrete of the two risks.
The practical conclusion is the same in both cases: a carefully prepared message, sent by the person themselves, puts neither the account nor compliance at risk. It is also the principle Trouve Tes Clients follows: it prepares the messages but sends nothing on LinkedIn on the user's behalf.
Six rules to apply from your next campaign
- A message related to the recipient's role, always.
- No file whose origin you cannot trace.
- An information notice from the first contact.
- An objection acted on immediately, and recorded.
- Deletion after three years without a response from the prospect.
- No automated sending on LinkedIn.
These rules fit naturally into a follow-up sequence on LinkedIn and by email: the information notice goes in the first email, and an objection ends the sequence the same day.