GDPR (for B2B data)

How GDPR applies to B2B data

The regulation protects personal data, meaning information about a person who can be identified. A business contact record that names a person is exactly that. A row with a name, a job title, a work email and a profile URL describes a person, even though the context is professional. Company-level data such as headcount, industry or tech stack is a different matter when no person can be identified from it.

Three provisions shape most B2B data work.

• Lawful basis. Article 6 lists the grounds on which processing is lawful, and at least one must apply 1. For prospecting, the usual candidate is legitimate interests under point (f), which fails where the person's interests or fundamental rights override the interest being pursued 1.
• Transparency. When data was not collected from the person directly, Article 14 requires telling them who holds it, why, on what legal basis, which legitimate interest is pursued and which source it came from 2.
• Objection. Article 21 gives people the right to object to processing for direct marketing at any time, and once they object, their data can no longer be processed for that purpose 3.

Timing matters as much as content. Article 14 requires the notice within a reasonable period and no later than one month after obtaining the data, or at the first communication if the data will be used to contact the person 2. In cold outreach, that first email is often where the notice has to appear. Article 21 adds that the right to object must be brought to the person's attention explicitly, at the latest at that first communication, and presented separately from other information 3.

Roles decide who carries which duty. The company that decides why and how contact data is used is the controller. A provider that processes data on its behalf acts as a processor, and the relationship is written down in a data processing agreement. A B2B data provider can sit in either role depending on how it works, which is why buyers ask for a DPA and a subprocessor list during security review.

Data enrichment touches all three provisions at once. Appending a work email or a direct dial to a contact is new processing of personal data, so it needs a basis, a notice and a path for objections. Firmographics about the company alone usually fall outside the regulation, unless they are tied back to a named person in the same record.

This page explains how the regulation is structured for data teams. It is not legal advice, and national rules on electronic marketing can add their own consent requirements on top.

What a B2B data team should document

Regulators and enterprise customers tend to ask for similar evidence. Five records cover most of it.

**A legitimate interests assessment.** Write down the interest, why the processing is necessary for it and why the person's rights do not override it, which mirrors the test in Article 6(1)(f) 1. Keep one per use case, since prospecting and product analytics are different purposes.

**Source records.** For every list, record where each field came from. Article 14 requires telling people the source of their data and, where relevant, whether it came from publicly accessible sources 2. A list with no provenance cannot meet that duty.

**A notice plan.** Decide where and when the Article 14 information reaches people, for example in the first outreach email with a link to a privacy notice, inside the one-month limit 2.

**An objection and suppression process.** Route every opt-out to a suppression list that each tool checks before sending or enriching again, since an objection to direct marketing ends that processing 3. A suppression list that only the sequencer reads will let the next enrichment run add the same person back.

**Vendor documents.** Collect a DPA, a subprocessor list, data residency details and retention periods from every data provider. RichAPI offers a DPA, lists its main infrastructure vendors, runs API infrastructure on AWS in the EU region and purges request logs after 30 days 4. It also states that some third-party data sources process lookups outside the EU 4.

Review these records whenever a new tool joins the stack. A new enrichment step, sequencer or AI SDR is new processing and may need its own assessment before it touches the list.

Example of a GDPR check before enriching a prospect list

A sales team has a list of conference contacts with names, companies and profile URLs, and wants work emails for an outbound campaign. Before any call to an email finder, the RevOps lead runs a short check.

Check            Answer for this list
Lawful basis     legitimate interests, assessment on file
Necessity        work email only, no personal email added
Balancing        contacts met the company at a trade event
Notice           privacy line and source in the first email
Objection        one-click opt-out, synced to suppression
Source record    event list plus enrichment provider per row
Vendor terms     DPA signed, subprocessors reviewed

The assessment records the interest, why the work email is necessary for it and why the contact's rights do not override it 1. Personal emails stay out of scope, which keeps the processing to what the purpose needs.

The first email carries the Article 14 information, including where the data came from and the right to object, set apart from the pitch 23. Two contacts reply asking to be removed. Their addresses go onto the suppression list, the sequencer stops, and the next enrichment run skips them 3.

The team also checks its own vendor. RichAPI's security page lists AWS infrastructure in the EU region, an available DPA and request logs purged after 30 days, and that goes into the vendor file 4.

Rows with no known source are dropped instead of enriched, because a missing source makes the Article 14 notice impossible to complete 2. The match rate on the remaining rows is lower than on the raw list, and every row that remains can be defended. The resulting B2B contact data is smaller, documented and ready for a complaint or an audit.