Two separate tests decide whether you may email a candidate you found yourself: the GDPR (do you have a lawful basis, did you inform the person, can they object?) and the rules for the channel (in Germany § 7 UWG, which treats unsolicited email advertising strictly). A lawful basis under the GDPR does not by itself permit a cold email. Whether a tailored job approach counts as "advertising" under § 7 UWG is disputed, and we know of no higher-court ruling that settles it for first emails to candidates. This guide shows what the sources say, how to lower the risk, and what a compliant first email contains. It is practical guidance based on the sources linked below, not legal advice. Status: November 2026.
The two tests, side by side
| Question | Rule | What it means for your email |
|---|---|---|
| May I process the data at all? | Art. 6(1)(f) GDPR, legitimate interest, with a documented balancing test | A specific vacancy, only role-relevant data, a professional source |
| Do I have to inform the person? | Art. 14 GDPR | Who you are, source, purpose, legal basis, rights, at the latest with the first message (outer limit one month) |
| Can they object? | Art. 21 GDPR | A clear opt-out; an objection stops the outreach in every system |
| Is the channel allowed? | § 7 UWG (Germany); Directive 2002/58/EC, Art. 13 (EU) | Email advertising generally needs prior express consent; the existing-customer exception rarely fits a first approach |
What the GDPR allows
For a limited search and a first approach, many organisations rely on legitimate interest under Art. 6(1)(f): filling a concrete vacancy is a real interest, provided the person's rights do not override it. Write the balancing test down: the interest, why the data is needed, what the person could reasonably expect, and the safeguards. A public professional profile is in a different position from information that is private or visible only to connections. The Hessian data protection authority makes this distinction in its published discussion of active sourcing. More on the data side is in our GDPR checklist for active sourcing.
Art. 14 matters most for email, because the first message is where you can deliver the notice. It has to name the source, including whether the data was publicly accessible, and the right to object. Putting a short notice in the footer and linking the fuller privacy information is the usual practical solution.
What German competition law adds
§ 7 UWG protects recipients from unreasonable nuisance, independently of data protection. For email, § 7(2) No. 3 requires prior express consent for advertising, with a narrow exception for existing customers in § 7(3). Two points help you plan.
- Is a job approach advertising? The law does not answer this for candidates, and commentary differs. We found no ruling on cold emails to candidates; the well-known Federal Court of Justice decision on headhunters, Direktansprache am Arbeitsplatz III (BGH, 22 November 2007, I ZR 183/04), concerns telephone calls at the workplace and is often used by analogy. Treat the email question as open and get legal advice for your campaign.
- Austria and Switzerland differ. In Austria, § 174 (3) TKG 2021 makes electronic mail for direct marketing, including SMS, unlawful without the recipient's prior consent. In Switzerland, Art. 3 (1) lit. o UWG covers mass advertising by telecommunications sent without consent. Both differ from § 7 UWG in detail, and neither answers whether a single tailored job approach counts as advertising; check the local rules and get advice if you contact candidates there.
How to lower the risk in practice
- Start on the platform the person uses professionally. A LinkedIn or XING message is a different channel from an email to an address you found. Many teams begin there and move to email after a reply or when the person has published the address for professional enquiries.
- Prefer business addresses that the person made public for contact, and avoid private addresses of unknown origin.
- Write one specific, honest reason for contacting this person, name the role and range, and avoid a mass-mailing tone.
- Identify yourself and give the notice. Name, company, source, purpose and a link to the privacy information in every first email.
- Make objection easy and binding. One reply stops all steps. Keep a minimal suppression record so a later import cannot re-activate the person.
- Cap the sequence. One first email and one or two follow-ups, then stop.
- Record the decision. Keep the balancing test and the channel review with your data protection officer or counsel.
Four patterns you can adapt
1. First email with the Art. 14 notice in the footer
Subject: [Role] at [company]: a question about your work on [topic]
Hi [first name], I read [specific work] and wondered whether a [role] in [city or remote] could interest you: [one concrete problem], range [€ from to]. Would a short call next week be worth it? If not, just tell me and I will not write again.
[Name], [company]. You are receiving this because I found your public professional profile on [source] and think the role fits your background. I process your name, contact details and professional profile for this one vacancy (Art. 6(1)(f) GDPR). Details, your rights and how to object: [privacy link]. Contact: [email].
2. Follow-up after five to seven days
Hi [first name], a short follow-up on my note about the [role]: [one new fact]. If the timing is wrong, tell me and I will close this on my side.
3. Answer to "Where did you get my address?"
Thank you for asking. I found your professional profile on [source] and your address at [place, e.g. the contact page you published]. I used it only to write to you about the [role]. I have now blocked further contact; if you want me to delete the data I hold, tell me and I will confirm in writing within [period].
4. Confirmation after an opt-out
Understood, [first name], I will not contact you again. I have deleted your data except a minimal entry that prevents a new contact. Thank you for letting me know.
More patterns for LinkedIn and email, with subject lines, are in recruiter outreach templates; a downloadable template collection is in preparation.
Where a tool helps and where it does not
Software can store the source, add the notice to every template, stop the sequence on a reply and keep the suppression list in one place. In Sprad Active Sourcing, LinkedIn and email outreach run in one inbox per candidate, a personal reply stops the sequence, and the system warns when someone was already contacted. A tool cannot create a legal basis or turn an unsuitable channel into a lawful one, so the channel decision stays with you and your counsel. See Sprad Active Sourcing and the guide to automating recruiting outreach.
FAQ
Can I email a candidate whose address I found on their website?
Under the GDPR, a public professional contact address can support a legitimate-interest assessment, but you must still give the Art. 14 notice and honour objections. Under § 7 UWG, whether an unsolicited job email is permitted remains disputed; seek advice before a campaign.
Do I need consent for every first email?
Not under the GDPR, which offers legitimate interest as a basis. For the channel, § 7 UWG points towards prior consent for email advertising, and the classification of job approaches is unsettled. That is why many teams start on a professional platform and move to email after a reply.
Is an unsubscribe link enough?
Only if the objection reaches every system you use and ends the outreach. A reply asking you to stop must have the same effect.
Are guesses of email addresses allowed?
Treat guessed addresses with caution: the source of the address must be explainable in your Art. 14 notice, and a guess adds a risk of reaching the wrong person. Prefer addresses the person published for professional contact.
Jürgen Ulbrich
Jürgen Ulbrich has more than a decade of experience in developing and leading high-performing teams and companies. As an expert in employee referral programs as well as feedback and performance processes, Jürgen has helped over 100 organizations optimize their talent acquisition and development strategies.
