PKE and GDPR — can you send cold emails in Poland
Cold email to companies in Poland is no longer the 'grey area nobody looks at'. Since 10 November 2024, the Electronic Communications Law (PKE) requires consent for marketing messages sent to natural persons — including sole proprietors and companies. The old B2B exemption from the electronic services act no longer works the same way. The consequences are fines, a burned domain and reputation damage. Most cold email guides ignore this, because they were written before 2024.
Instead of panicking, build a conscious legal basis in 4 steps:
- KNOW YOUR DATA SOURCE: where did the contact come from (CEIDG/KRS data is public, but 'public' does not mean 'I can send marketing'),
- IDENTIFY THE RECIPIENT CATEGORY: a company (legal entity) vs a sole proprietorship (natural person — consent is mandatory for marketing there),
- CHOOSE A BASIS: consent (safest) or legitimate interest (GDPR Art. 6(
- (f)) for purely B2B outreach to legal entities — but that is a matter for a legal assessment, not your own interpretation,
- IMPLEMENT FORMAL OBLIGATIONS: sender identification, honest subject line, a working and honored opt-out, a GDPR privacy notice where you collect data. This process is not 'boring paperwork' — it is part of deliverability: providers (Gmail, Outlook) increasingly block senders without credible identity.
Scenario A (consent required): you send a marketing cooperation offer to the owner of a sole proprietorship — that is a natural person, so for marketing you need consent or a clear legal basis. Scenario B (lower risk, but no guarantee): you write a specific, non-marketing-flavored message to a limited company (sp. z o.o.) about concrete business cooperation, and the data comes from a public register — legitimate interest may apply, but the final assessment belongs to a lawyer. Scenario C (always fine): the contact has history — they bought something, downloaded a resource, or are in your CRM with consent to marketing contact. The difference between A and B is key: the recipient type and the nature of the message.
You are a lawyer specializing in PKE and GDPR for technology companies. Context: I am planning cold outreach. My situation: - Recipient country: [COUNTRY] - Recipient type: [COMPANIES / SOLE PROPRIETORS / MIXED] - Data source: [PUBLIC REGISTER / BOUGHT LIST / OWN CRM] - Message: [DESCRIBE THE MESSAGE] Task: 1. Assess whether I need consent for this type of message (PKE/GDPR) 2. List the risks and formal obligations for my case 3. Draft 3 sentences for the email footer: sender identification + opt-out + GDPR notice 4. Suggest subject-line phrases that are not misleading or in bad faith IMPORTANT: state that this is educational material, not binding legal advice. End with a section: 'verify this with a lawyer'. Format: 4 sections, specific.
Variations & alternative scenarios
European version: the same analysis, but with recipients from 3 EU countries — check differences in local law.
B2C version: change the context to consumers — explain why consent is absolutely required there.
Practical exercise
Take your prospect list (or 5 sample entries from CEIDG/KRS) and assign each company a category: legal entity / sole proprietorship. For each, write the legal basis you plan to use and the formal obligations you must meet. Write your own email footer with an opt-out.