B2B prospecting that holds up under Article 6(1)(f).

Three different answers under the same GDPR. NL: yes, under the Telecommunicatiewet Art. 11.7, to a legal entity at a business address with identification and a working opt-out. UK: yes to a corporate subscriber under PECR Reg. 22 (limited companies, LLPs, government bodies); no to most sole traders and partnerships, which the ICO treats as individual subscribers. DE: generally no without prior consent under UWG §7(2) Nr. 3, even for B2B - the BGH has consistently treated unsolicited business email as anti-competitive. Your sending posture should match the recipient's jurisdiction, not your own.

An LIA is the document that records why your direct marketing is a legitimate interest under Article 6(1)(f), why processing is necessary to achieve it, and why the prospect's rights and freedoms do not override it. Three columns, one page is enough. You need it because Article 5(2) GDPR makes you accountable for the basis you claim, and 'we discussed it informally' is not accountability. Run one per campaign type, store it with your processing register, and revisit it when the campaign motion changes.

AVG is GDPR. The Algemene Verordening Gegevensbescherming is the Dutch name for the Regulation. The Netherlands also has a national implementation act, the UAVG, which fills in the open clauses (criminal data, BSN, age of consent for children). The substantive obligations on a Dutch B2B sender are the same whether you call them AVG or GDPR.

At minimum: the source of each contact and the date added, the date and basis of last verification, every message that went out, every objection or unsubscribe received, your LIA per campaign type, your verwerkersovereenkomst with each processor, and your transfer impact documentation where data crosses to the US or other third countries. This is the Article 30 record of processing in practical form. Most enforcement actions turn on whether you can produce these in days, not whether the underlying processing was sympathetic.

Not by default for plain B2B email to identified roles at identified companies. A DPIA under Article 35 is triggered when processing is 'likely to result in a high risk' - typically large-scale behavioural profiling, automated decision-making with legal effects, or sensitive data. If your motion stays at 'business contact, business message, business opt-out' the LIA is enough. If your tool ingests browsing data, builds intent scores from cookies, or processes data on a scale the AP has flagged, run the DPIA. The AP publishes the list.

Heavily. Schrems II struck down Privacy Shield and required Transfer Impact Assessments when EU personal data lands on US infrastructure under FISA 702 reach. SCCs are still required as the contractual basis. The Data Privacy Framework re-opens a route for DPF-certified US recipients, but you have to check the certification per processor and accept that the framework is under active legal challenge. EU-built and EU-hosted is the simpler posture - fewer documents, smaller surface area, cleaner answer when a prospect or regulator asks.

You answer with a specific source and date, not a vendor brand. With Hooklyne, every contact in a prospect package ships with the source URL or registry citation that supplied it - a public KVK page, a Companies House entry, a registered data partner under their own basis. You can paste the answer back to the prospect in under a minute and it satisfies the right of information under Articles 13 and 14.

No. This is plain-language operator guidance based on how the AVG, GDPR, ePrivacy, and the AP's published enforcement record work in practice. Before you scale a sending motion - especially across NL, UK and DE - get a DPO or specialist counsel to review your LIA, your processor agreements, and your transfer documentation. The cost of that review is small compared to a single Article 83 fine.