Cold e-mail and calls to Polish companies: what GDPR and Polish law allow

Poland has stricter rules on B2B marketing contact than many of its neighbours, and since November 2024 they have become stricter still. A list of Polish companies with e-mails and phone numbers is legal to build and legal to buy. What you do with it next is governed by two sets of rules: GDPR, which applies when a contact is a person, and the Polish Electronic Communications Law, which applies to every marketing e-mail and call, including those to companies. This article explains both, with the practical model that Polish B2B sellers use to stay on the right side of them.

Rule one: marketing e-mail and calls need prior consent, also B2B

The Electronic Communications Law (Prawo komunikacji elektronicznej, PKE) has been in force since 10 November 2024. Its article 398 prohibits the use of telecommunications terminal equipment and automated calling systems for direct marketing, and the sending of unsolicited commercial communications, without the prior consent of the recipient. The provision replaced two earlier Polish rules with the same effect and does not distinguish between consumers and businesses. A generic address such as office@company.pl is covered just as a personal one is.

Enforcement belongs to the President of the Office of Electronic Communications (UKE), with fines of up to 3% of the previous year's revenue. The Polish consumer protection authority (UOKiK) can add its own penalties when consumers are affected, and the data protection authority (UODO) handles the GDPR side.

In plain terms: an unsolicited e-mail that presents an offer to a Polish company is, as a rule, not allowed. The same goes for a cold call made to sell something.

Rule two: a sole trader's contact details are personal data

About 81% of active Polish businesses are sole proprietorships, run by a natural person under their own name. Their business address, e-mail and phone number are personal data under GDPR. The data are public, because they come from the CEIDG register, but public does not mean free to use for any purpose. Processing them for direct marketing needs a legal basis, and the one usually relied on is legitimate interest (article 6(1)(f) GDPR), documented with a balancing test before the first contact.

GDPR also brings duties that apply at the first message: the information duty under article 14 (who you are, where you got the data, what you will do with it, how to object) and the right to object under article 21, which, for direct marketing, must be honoured without exception. A company address such as biuro@firma.pl belongs to a legal person and is outside GDPR, but it remains inside PKE.

What is allowed: the two step model

Polish practice, backed by UODO decisions and legal commentary, has settled on a two step approach that Polish B2B sellers and agencies now treat as the standard.

1. First message: ask, do not sell. A short e-mail that says who you are, where you found the contact (name the register or the website, not "public sources"), what you do in one sentence, and a question: would the recipient like to receive details? It contains no offer, no price list and no attachment. It contains the GDPR information clause and an obvious way to say no.
2. Second message: the offer, only after a yes. A positive reply is the consent that PKE requires. Now you may send the commercial message. A silence is not a yes, and a second "just following up" that contains an offer is where many campaigns cross the line.

The model is slower than a mass mailing and it works better. Reply rates of several percent on a tightly targeted first message are typical, and every reply is a conversation with someone who asked for it.

What is allowed: a phone call to ask for consent

A call whose only purpose is to ask whether the company would accept an offer by e-mail is treated as a consent request rather than marketing, provided the caller does not pitch on the call. Record the answer, send the offer only to those who agreed, and keep the log. For companies with a published switchboard number this is often the fastest route to a documented yes.

What is not allowed

• Sending an offer, a brochure or a price list as the first contact, to any address.
• Describing the data source vaguely. "Your data come from publicly available sources" has been found insufficient; "from the CEIDG register" or "from your website firma.pl" is what the authority expects.
• Continuing after an objection, or taking more than a few days to act on one.
• Deleting an objecting contact entirely. The contact must go on a suppression list so that it is never imported and mailed again by mistake.
• Buying a list without knowing where the records come from. The buyer is the data controller and has to be able to name the source of each record.

A compliance checklist for a campaign aimed at Polish companies

Where this leaves a list of Polish companies

A list is the input to the process above, not a licence to skip it. What a good list does is make the process possible: every record names its source register and date, so you can state the source truthfully in your first message; every record carries the NIP and REGON, so you can verify the company before you write; and the supplier maintains a suppression list of its own, so companies that have objected to the supplier do not reappear in your file.

That is how bazy.biz lists are built. Each record shows the register it comes from and the date of the last update, objections we receive are enforced across all lists, and every order comes with a note on the legal basis for B2B contact in Poland. If you are planning a campaign aimed at Polish companies, tell us the target and we will reply with the count, the price and the note.

This article is a general overview as of October 2026 and not legal advice. The Electronic Communications Law and GDPR are enforced case by case; for a specific campaign, consult a lawyer familiar with Polish law.