We want to send offers to companies by e-mail – how do we set this up in practice?

Article 81 ERĮ has three paragraphs. Each needs different action:

How to assess the amendment legally, where its limits are and what the risks are is covered in the dat.lt article (link below). This page is about how to do it.

The first job is to give every address on the list a type. One column in your spreadsheet is enough.

The legal-person rule applies only where the recipient really is a legal person. Where the business is a sole trader's individual activity, the recipient is a natural person, and consent is needed for any of their addresses (Article 81(1) ERĮ).

Why treat named addresses separately? ERĮ defines a subscriber as a person who has concluded a contract for public electronic communications services (Article 3(1) ERĮ), and a registered user as a person who is not a subscriber and is identified by a user identification code (Article 3(61) ERĮ). The subscriber of a company mailbox is usually the company itself, a legal person, and the employee may be only an actual user (Article 3(23) ERĮ), whom Article 81 does not mention. However, an employee with their own login may be treated as a registered user, and that user is a natural person. Until VDAI or the courts clarify it, the safest course is not to send advertising to a named address without consent. If you send anyway, write down the decision and its basis, and every GDPR requirement below still applies.

Article 5(2) GDPR requires you to be able to demonstrate compliance with the principles. For a B2B list this means one thing: every address must carry a note of where it came from. Our recommendation – a table like this:

Three rules worth keeping:

• Do not collect more than you need. An address, the company name and its sector are usually enough (Article 5(1)(c) GDPR).
• Do not buy lists without checking them. In a bought list the source column may be empty, and it is you who will have to prove it.
• Enter marketing in your record. If you must keep a record of processing activities, B2B marketing must appear in it with its purpose, data categories and the other fields (Article 30(1) GDPR); our recommendation is to describe it as a separate process.

If you have decided to write to a named address without consent, the GDPR basis is usually legitimate interest (Article 6(1)(f) GDPR). Recital 47 GDPR says that direct marketing may be regarded as carried out for a legitimate interest. Such a basis is possible, but it works only after a written balancing of interests. How to do that: see the legitimate interest balancing test (in Lithuanian).

Three more things to note in the test:

• the offer relates to the person's job – for example, workplace safety training for a production manager;
• the frequency of e-mails is moderate and the opt-out works at once;
• whether a person whose address is published with their job title can reasonably expect such an offer (recital 47 GDPR).

Keep in mind: legitimate interest under the GDPR does not replace consent where ERĮ requires consent. So this route is a risk, not a way out.

Where the person gave you the address themselves (a business card, an enquiry through your form), the information is given when the address is collected (Article 13(1) and (2) GDPR) – for example, in the form or in your reply to the enquiry.

Where you obtained a named address other than from the person, you must inform them under Article 14 GDPR. If you use the address to communicate with the person, the information is given at the latest at the first communication, and in any case no later than one month after obtaining the address (Article 14(3)(a) and (b) GDPR). The easiest place is the first e-mail itself.

The right to object to direct marketing must be brought to the person's attention explicitly and separately from any other information, at the latest at the first communication (Article 21(4) GDPR).

A footer template for the first e-mail (adapt it to your details):

This e-mail is sent by [company name, company code, address]. We found your work e-mail address on [source]. We use it only to send offers relevant to your work, relying on legitimate interest, and keep it until [period, or until you opt out].

You have the right to object at any time to the use of your address for direct marketing. Click [unsubscribe] or reply to this e-mail with the word "UNSUBSCRIBE". We will not write again.

More about your rights (access, rectification, erasure, restriction, objection) and your right to complain to the State Data Protection Inspectorate – [link to the privacy notice].

The template covers the information in Article 14(1) and (2) GDPR through a link to the privacy notice. Check that the notice really contains every item, including the source of the data (Article 14(2)(f)) and your legitimate interest (Article 14(2)(b)).

Where a person objects to direct marketing, their data is no longer processed for that purpose (Article 21(3) GDPR). For a generic company address, the opt-out must be ensured under Article 81(1) ERĮ. In practice:

1. the opt-out link or a reply by e-mail works without logging in and without charge;
2. the opt-out is carried out in every system – the CRM, the sending platform, the sales team's spreadsheets;
3. our recommendation: keep a separate "do not contact" list holding only the address and the opt-out date, so that the address is not loaded again from a new source.

Before you press "Send", check:

• [ ] every address has a type and a source;
• [ ] sole traders (individual activity) – only with consent (except under the existing-customer rule, Article 81(2) ERĮ);
• [ ] named addresses – only with consent or with a written legitimate interest test;
• [ ] the sender is visible and real (Article 81(3) ERĮ);
• [ ] every e-mail has a working way to opt out;
• [ ] the "do not contact" list is removed from the send;
• [ ] for a named address not obtained from the person, the first e-mail carries the Article 14 GDPR information; for one obtained from the person (a business card, an enquiry through your form), the Article 13 GDPR information was given when it was collected; in both cases the right to object is stated separately;
• [ ] the content relates to the recipient's work;
• [ ] where the sending platform is a processor, a data processing agreement is in place with it (Article 28(3) GDPR).

Today, open your contact list and add two columns: "type" and "source". Set aside addresses without a source until you find it. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities, where marketing is recorded too.

May we write to an info@ address without any consent?
Yes, if the recipient is a legal person (not a sole trader) and it is given a clear, free and easy way to opt out (Article 81(1) ERĮ). The sender must be visible, and the e-mail must contain a valid address for stopping the messages (Article 81(3) ERĮ).

Does a named address published on a company website mean we may write to it?
No. A published address is still personal data. For named addresses, see the section on address types.

Does the own-customer exception apply to B2B e-mails?
The exception in Article 81(2) ERĮ is for customers who are natural persons. For a company customer, the legal-person rule in Article 81(1) now applies.

Who supervises these rules?
The State Data Protection Inspectorate supervises the ERĮ provisions on data processing and privacy protection (Article 5(2)(1) ERĮ).

• Can we send a newsletter to existing customers? (in Lithuanian)
• How to carry out a legitimate interest balancing test? (in Lithuanian)
• Consent: how to ask for it and how to prove it
• Must we have a website privacy policy? (in Lithuanian)

The law and the risk: Direct marketing by email and SMS: when consent is needed – dat.lt

• E-mail advertising, legal persons, opt-out – Article 81(1) of the Law on Electronic Communications (ERĮ); own-customer exception – Article 81(2); sender identity and opt-out address – Article 81(3)
• Subscriber, registered user and actual user – Article 3(1), 3(23) and 3(61) ERĮ
• Supervision – Article 5(2)(1) ERĮ
• Personal data – Article 4(1) GDPR
• Data minimisation and accountability – Article 5(1)(c) and 5(2) GDPR
• Legitimate interest – Article 6(1)(f) GDPR; direct marketing – recital 47
• Informing when data was not obtained from the person – Article 14(1) and 14(2) GDPR; timing – Article 14(3)
• Right to object to direct marketing – Article 21(2), 21(3) and 21(4) GDPR
• Informing when data is obtained from the person – Article 13(1) and 13(2) GDPR
• Contract with a processor – Article 28(3) GDPR
• Record – Article 30(1) GDPR

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda; ERĮ – e-tar.lt edition in force from 2026-07-01 (Article 81 amended by Law No XV-815, in force from 2026-04-22). This text is general information and is not individual legal advice.