Lawful Basis and Recipient Boundaries for Delegated B2B Outbound

Published September 23, 2026.

Outbound sequencing is usually delegated as a task list: load the list, launch the sequence, handle the replies, log the activity. The legal basis for contacting each recipient is treated as a solved problem that preceded the engagement. In practice it is often the least documented part of the workflow. A list can be assembled from several sources, each with a different justification for contact, and the sequence then treats every record the same way. This research examines what primary guidance from the UK Information Commissioner's Office, the U.S. Federal Trade Commission, and Canada's anti-spam statute establishes about lawful basis, identification, and opt-out, then translates those facts into a handoff standard for delegated B2B outreach.

The decision this article supports is whether a prospect list and its sequence are ready to be handed to an operator. Readiness means the team can state, for the records in the list, why contact is permitted, whether the recipient can identify the sender, and how an opt-out will be honored. A delegate can execute a sequence; the delegate cannot invent the lawful basis for it. That basis must travel with the list.

The decision this research supports

The founder or sales lead delegating outreach is making two decisions at once. The first is operational: how much of the sequence work to hand over. The second is a compliance decision disguised as procurement: which records may be contacted at all, and under what justification. When the second decision is left implicit, the assistant becomes the person who discovers the problem, usually after a complaint.

The risk profile is asymmetric. A well-run sequence with a documented basis produces pipeline. A sequence without a documented basis creates complaints, deliverability damage, and regulatory exposure that no amount of reply handling can repair. The suppression and approval controls for delegated outbound already treat the audience and opt-out state as release inputs. This article addresses the layer beneath suppression: the reason the record is in the list.

What the primary sources establish

The ICO's direct marketing guidance describes direct marketing broadly and explains that organizations must have a lawful basis for processing personal data for marketing, that they must tell people what will happen to their data, and that they must honor the right to object. The guidance also addresses electronic mail marketing and the consent or soft opt-in conditions that apply under the electronic communications rules, alongside the separate lawful-basis question under the data protection framework. This establishes that the legal analysis has more than one layer, and that both layers must be satisfied.

The ICO's legitimate interests guidance describes legitimate interests as one possible lawful basis and sets out a three-part test: identifying the interest, showing that the processing is necessary for it, and balancing it against the individual's rights and expectations. It emphasizes that legitimate interests is not a default and that the assessment must be documented. This is directly relevant to B2B outreach, where legitimate interests is often assumed rather than assessed.

The FTC's CAN-SPAM compliance guide describes requirements for commercial email, including accurate header and subject information, clear identification of the message as an advertisement where applicable, a working opt-out mechanism, and prompt honoring of opt-out requests. It is a U.S. commercial email standard and applies alongside, not instead of, data protection rules in other jurisdictions.

Canada's Anti-Spam Legislation, as published on the federal Justice Laws website, sets out consent requirements for commercial electronic messages, including express and implied consent categories, sender identification, and unsubscribe requirements. Its implied-consent categories and time limits illustrate how a jurisdiction can define the permitted window differently from another, which matters for any list that spans countries.

GDPR Article 6, as published by a reference source, enumerates the lawful bases for processing and provides the general framework that legitimate interests must satisfy. It is included as the underlying reference for the lawful-basis concept used throughout the guidance above.

Findings

Lawful basis is a property of the record, not the campaign

The sources treat the justification for contact as something that attaches to processing a person's data. That means a single campaign can contain records with different justifications, or records with none. The practical consequence is that a list should carry a basis field and a source field for each record, and a sequence should not launch until every record has a defensible basis. Treating the campaign as the unit of justification hides the records that do not qualify.

Legitimate interests requires a documented assessment

The ICO's three-part test establishes that legitimate interests is an active assessment, not a label. The assessment identifies the interest, tests necessity, and balances the individual's expectations. Where a business claims legitimate interests for B2B outreach, the documentation of that assessment is the evidence a delegate can point to when asked why a person was contacted. Without it, the basis is an assertion.

Identification and opt-out are separate obligations

CAN-SPAM and the CRTC guidance both require accurate sender identification and a working unsubscribe path, and the ICO guidance reinforces the right to object. These are distinct from lawful basis. A record may be lawfully contactable and still fail because the message is not correctly identified or does not honor an opt-out promptly. For a delegated sequence, the identification fields and the opt-out mechanism should be verified before launch, not after the first complaint.

Jurisdiction changes the permitted window

The anti-spam statute's implied-consent categories and time limits show that the same record may be contactable in one jurisdiction and not another, or only for a defined period. A list assembled without geographic context cannot be screened against those differences. The finding is that geography belongs in the list's provenance, and the sequence should apply jurisdiction-appropriate rules where the list spans regions.

Operating model

The sources support a handoff bundle with five artifacts. First, a basis and source field on each record, naming the lawful basis and where the data came from. Second, a legitimate interests assessment document where that basis is used, recording the three-part test. Third, an identification and opt-out specification that states the sender identity, the physical or contact information required, and how opt-out requests are received and honored, with a target response time. Fourth, a jurisdiction map that groups records by the rules that apply and notes any time-limited consent. Fifth, a suppression record that shows a record is never re-contacted after an opt-out, which connects to the lead list data provenance standard on the intake side.

The rhythm mirrors the risk. Basis and provenance are verified before a list enters a sequence. Opt-out handling is reviewed after every sending cycle. Jurisdiction rules are confirmed when a new market is added. The delegate executes the sequence and escalates any record whose basis or opt-out state is unclear rather than deciding it.

Boundaries and limitations

This research is bounded by its sources. It relies on guidance from the ICO, the FTC, the CRTC, and a published copy of GDPR Article 6, and it describes the requirements those documents state. It is not legal advice, and it does not determine which basis applies to any specific message or jurisdiction. The sources are regulator guidance and legal reference material, not performance data, so no claim is made about response or revenue. The operating model is an inference from those requirements and cannot verify a specific team's list or sequence. Where jurisdictions conflict, the team's own counsel determines the applicable rule.

Evidence-led conclusion

The guidance establishes that lawful basis, identification, and opt-out are separate requirements, that legitimate interests must be documented, and that jurisdiction can change what is permitted. That structure is why a delegated sequence can run smoothly and still be non-compliant: the smoothness measures the tooling, not the basis. The fix is to attach a basis and source to each record, document the legitimate interests assessment where used, verify identification and opt-out before launch, and screen by jurisdiction. When that bundle travels with the list, the operator executes within a defined boundary instead of discovering it through complaints. Teams preparing to delegate outreach can assemble the basis and provenance fields first, which is the compliance layer behind the outbound sequencing VA service and the lead list building VA service.

Sources

1. UK Information Commissioner's Office, Direct marketing guidance, checked September 23, 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/
2. UK Information Commissioner's Office, Legitimate interests, checked September 23, 2026: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/
3. U.S. Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business, checked September 23, 2026: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
4. Justice Laws Website, Canada's Anti-Spam Legislation, S.C. 2010, c. 23, checked September 23, 2026: https://laws-lois.justice.gc.ca/eng/acts/E-1.6/
5. Intersoft Consulting, GDPR Article 6, Lawfulness of processing, checked September 23, 2026: https://gdpr-info.eu/art-6-gdpr/