A company processing data that can identify individual EU residents must comply with GDPR rules. The data processing company must receive consent before marketing to those individuals. ‘Legitimate interest’ only applies to B2B data being used to send marketing emails and telephone calls.  Data that is not considered personal data can be contacted without consent but must be careful to only send information that is of legitimate interest to the recipient. Business email addresses, including individuals that can be identified from the name, is not considered personal data.